How many ransomware attacks happened in Singapore in 2024/25?

CSA's Singapore Cyber Landscape report recorded 159 ransomware cases in 2024/25, representing a 21% year-on-year increase. Manufacturing, retail, and professional services were the most affected sectors.

How much does a ransomware attack cost Singapore businesses?

The average ransomware recovery cost for Singapore SMEs exceeds S$200,000, including downtime, data recovery, legal obligations, and reputational damage. Many businesses also face PDPA notification requirements if personal data is compromised.

What is the most effective defence against ransomware?

The 5 most effective controls are: (1) MFA on all accounts, (2) EDR on all devices, (3) automated patch management, (4) tested immutable backups, and (5) 24/7 SOC monitoring to detect ransomware precursor activity before encryption begins.

Ransomware Singapore 2026: Statistics, Trends & Prevention Guide

Singapore Ransomware Statistics 2024/25

The Cyber Security Agency of Singapore (CSA) recorded 159 ransomware cases in its 2024/25 Singapore Cyber Landscape report — a 21% year-on-year increase. This is not a statistic about large enterprises. The majority of victims are small and medium-sized businesses, precisely because they present weaker defences and faster ransom payment decisions.

Which Industries Are Targeted?

The three most-targeted sectors in Singapore are:

Manufacturing — operational technology (OT) networks often run unpatched legacy systems
Retail & F&B — high volumes of customer payment data with inconsistent endpoint security
Professional Services — law firms, accounting firms, and consultancies hold valuable client data ransomers can monetise

The Real Cost of a Ransomware Attack

The ransom payment is only a fraction of the total cost. For Singapore SMEs, average total recovery costs exceed S$200,000, including:

Business downtime (average 3–7 days for SMEs)
IT recovery and forensic investigation
PDPA breach notification obligations and potential PDPC fines
Customer notification and reputational damage
Cyber insurance premium increases

5 Controls That Stop Ransomware

Multi-Factor Authentication (MFA) — Over 90% of ransomware attacks begin with compromised credentials. MFA on all email, cloud, and remote access eliminates this entry point.
Endpoint Detection and Response (EDR) — Traditional antivirus is signature-based and misses novel ransomware variants. EDR detects behavioural indicators of attack (IOAs) before encryption begins.
Automated Patch Management — 60% of breaches exploit known vulnerabilities that had a patch available. Critical patches must be applied within 14 days (Cyber Essentials SS 712 requirement).
Immutable, Tested Backups — Ransomware specifically targets backup systems. Immutable backups (3-2-1-1 rule) with tested restore procedures are your recovery safety net.
24/7 SOC Monitoring — Ransomware deployment is not instantaneous. Attackers spend days to weeks in your network before encrypting files. A SOC monitoring for lateral movement, credential dumping, and staging activity catches attacks before they execute.