Almost 9 in 10 organisations surveyed in Singapore encountered at least one cybersecurity incident in 2025, according to the Cyber Security Agency of Singapore (CSA). Ransomware emerged as the most commonly reported threat among both businesses and non-profit organisations (NPOs).
The findings, released in the Singapore Cybersecurity Health Report 2025 at Singapore International Cyber Week (SICW) 2026 on 14 October, coincide with the launch of a free Cyber Incident Helpline. The new service provides businesses with initial advice on assessing suspected attacks, containing potential damage and obtaining specialist assistance when needed.
Ransomware tops incident reports as business impacts decline
Between October and November 2025, CSA surveyed 2,005 businesses and NPOs of varying sizes to examine their experiences with cybersecurity incidents, resulting business impacts, adoption of protective measures and challenges in improving their security. Across both groups, ransomware was the most commonly reported incident, followed by compromised credentials and social engineering attacks, including phishing and impersonation scams.
Although incidents remained widespread, the proportion of organisations reporting certain business consequences was lower than in CSA’s 2023 survey. Among businesses, the share reporting incident response costs declined by 3.8 percentage points, while those experiencing business disruption and financial losses fell by 3.1 and 2.7 percentage points respectively. NPOs recorded larger reductions across several categories: the proportion reporting data loss declined by 18.4 percentage points, while business disruption and financial losses fell by 8.2 and 7.4 percentage points respectively. Despite these reductions in reported business impacts, CSA has urged organisations to strengthen their ability to respond to attacks and recover from disruptions alongside efforts to prevent incidents.
Gaps remain in essential cybersecurity measures
An evolving cyber threat landscape is increasing the speed, scale and sophistication of cyber threats
Threat landscapeFrequency of incidents
Businesses
Non-profit organisations
Top 5 incident types in 2025
Businesses
- 1 Ransomware
- 2 Compromised credentials
- 3 Social engineering
- 4 Software / zero-day vulnerabilities
- 5 Denial of Service (DOS) attack
Non-profit organisations
- 1 Ransomware
- 2 Compromised credentials
- 3 Social engineering
- 4 Data breaches
- 5 Software / zero-day vulnerabilities
Source: Singapore Cybersecurity Health Report 2025. Bars use a common 0–60% scale.
The report identified uneven adoption of basic cybersecurity controls across the five categories covered by CSA's Cyber Essentials mark, with adoption rates ranging from 71% to 80%. Software and system update measures recorded the highest adoption at 80%, whereas asset management and protection measures were the lowest at 71% each. CSA cautioned that weaknesses in individual areas could undermine an organisation's overall cybersecurity resilience, even where other protective measures have been implemented. The survey also identified barriers to improving cybersecurity: among surveyed businesses, 56% cited a lack of cybersecurity knowledge and experience, 46% believed they were unlikely targets of cyberattacks, and 37% reported insufficient manpower and resources, with NPOs facing similar challenges.
To address these gaps, CSA is encouraging organisations to use its cybersecurity toolkits and Cybersecurity Health Check tool, which provide guidance and help identify areas requiring improvement. Businesses requiring professional assistance can also use CSA's CISO-as-a-Service programme to engage consultants in developing tailored cybersecurity plans, with eligible small and medium-sized enterprises (SMEs) able to receive up to 70% co-funding. Organisations are also encouraged to implement the baseline protections under Cyber Essentials and consider progressing towards the Cyber Trust Mark as their operations grow and cybersecurity risks become more complex.
New helpline offers initial incident guidance within two hours
The Cyber Incident Helpline (CIH), launched by the Singapore Business Federation (SBF), provides businesses with a dedicated point of contact when cybersecurity incidents occur. Operating under the Cyber Resilience Centre (CRC), the service was officially launched at SICW 2026 by Senior Minister of State for Digital Development and Information Tan Kiat How. The helpline offers first-response advice to businesses of all sizes, including SMEs without dedicated cybersecurity personnel or established incident response arrangements. SBF describes the service as free and confidential, covering a range of cybersecurity concerns, including ransomware, malware infections, business email compromise, phishing, unauthorised system access, suspected data breaches and other suspicious activities affecting business operations.
Organisations seeking assistance can submit an incident support request through the CRC portal, providing basic information about the suspected attack. A trained CIH operator reviews the submission to assess the incident's nature, severity and urgency, before a CIH representative contacts the organisation within two hours of request submission to gather additional information and provide initial guidance. This advice may include recommendations on containing the incident, limiting further damage and determining appropriate response measures. Where specialised intervention is required, businesses may receive a list of pre-approved cybersecurity partners that they can engage for remediation and recovery assistance.
The service is advisory and does not undertake technical remediation on behalf of affected organisations. It does not conduct forensic investigations, collect digital evidence, perform remote troubleshooting, restore compromised systems or recover data. Nor does CIH monitor organisational networks, act as a designated incident responder or breach coach, select vendors, or report incidents to regulators and authorities on a business's behalf. Organisations requiring these services must make separate arrangements for specialist support. Businesses can submit requests through the Cyber Resilience Centre portal at www.cyberresilience.sg or contact the helpline at 6890 9555.
Cyber Resilience Centre combines incident support with training
The CRC was established in 2025 by SBF in partnership with SGTech and the Singapore Chinese Chamber of Commerce and Industry, with CSA's support. It helps organisations, particularly SMEs, improve their cybersecurity preparedness through health clinics, workshops, guidance and exercises. According to CSA, close to 500 organisations have benefited from the centre's clinics and workshops to date, while another 300 organisations are expected to participate in a phishing simulation exercise.
