Investigating Cybersecurity Incidents at ASPIRE 2A and Exanet

Transparency on cybersecurity breaches affecting vital research infrastructure is essential for public trust and institutional accountability. In Parliament, I asked whether full investigation reports on recent cybersecurity incidents at National Supercomputing Centre’s ASPIRE 2A and A*STAR’s Exanet network would be publicly released. I also inquired about specific recovery, validation and hardening measures taken, and whether any data was exfiltrated.

The Minister for Trade and Industry (Energy and Industry) stated that external forensic investigations found no evidence of data compromise or exfiltration in either incident. The Minister explained that detailed investigation reports will not be made public to avoid aiding malicious actors, and outlined measures including device rebuilding, access control tightening and enhanced threat simulations.

This is the full question and answer in Parliament on 8 Sep 2026:

Release of Investigation Reports into Cybersecurity Incidents Affecting ASPIRE 2A and A*STAR Exanet Network and Data Recovery Measures Taken

Mr Gerald Giam Yean Song asked the Minister for Trade and Industry (Energy and Industry) (a) whether full investigation reports on the recent cybersecurity incidents affecting National Supercomputing Centre Singapore’s ASPIRE 2A and A*STAR’s Exanet network will be publicly released; (b) what specific recovery, validation and hardening measures were taken; and (c) whether any data was exfiltrated and, if so, what data was compromised.

Dr Tan See Leng: Following the cybersecurity incidents affecting the National Supercomputing Centre Singapore (NSCC)’s ASPIRE 2A system on 22 May 2026 and A*STAR’s Exanet network on 24 July 2026, the affected systems were promptly isolated, and investigations were immediately conducted to establish the nature, extent and impact of the incidents.

External forensic specialists were also engaged to investigate and establish the root cause in each case. Detailed investigations found no evidence of data compromise or exfiltration in either incident. The detailed investigation reports will not be publicly released, as doing so could provide information useful to malicious actors.

The affected ASPIRE 2A system and computing devices in the Exanet network were rebuilt, scanned for any residual elements of the attack, inspected and cleared for use before being returned to service. Additional security measures, including tighter enforcement of access controls and enhancement of endpoint protection, were immediately implemented to strengthen safeguards against unauthorised access.

NSCC and A*STAR conduct regular reviews of their cybersecurity protocols to ensure these remain robust and current, and have accelerated their cybersecurity initiatives which had commenced prior to the incidents, such as enhancing cybersecurity threat simulation through more sophisticated red-teaming. Lessons learnt from these incidents have also been applied across our research infrastructure.