Nine in 10 Singapore Organisations Had a Cyber Incident Last Year. Almost Half of Businesses Think They Are Not a Target

15 OCT 2026 — Almost nine in 10 Singapore organisations had at least one cybersecurity incident in 2025, and ransomware was the most common kind, according to a survey released by the Cyber Security Agency of Singapore (CSA) at Singapore International Cyber Week. Yet 46 per cent of the businesses in the same survey said they were unlikely to be targeted at all. Alongside the Singapore Cybersecurity Health Report 2025, released on 14 October, the government launched a Cyber Incident Helpline for organisations, aimed mainly at smaller firms without their own security staff.

What the survey found

CSA surveyed 2,005 businesses and non-profit organisations between October and November 2025. Among businesses, 30 per cent reported a single incident in the year and 51 per cent said incidents happened several times a year. A smaller group reported them far more often: 9 per cent several times a month, 6 per cent several times a week and 4 per cent several times a day.

Ransomware topped the list of incident types for both businesses and non-profits. It was followed by compromised credentials and social engineering, such as phishing and impersonation scams. For businesses, software and zero-day vulnerabilities came fourth and denial-of-service attacks fifth.

Fewer reported harms, but not few

CSA highlighted that fewer organisations reported business impacts than in its 2023 survey. Among businesses, the share reporting incident response costs fell by 3.8 percentage points, business disruption by 3.1 and financial losses by 2.7. Non-profits reported larger falls, including an 18.4-point drop in data loss.

The full report puts those changes in context: "almost all" organisations that had an incident suffered some business impact. Among businesses hit, 45 per cent reported disruption, 44 per cent data loss and 42 per cent reputational damage. Reputational damage among non-profits rose 6.8 points to 51 per cent, the only impact that grew. The declines are small downshifts from high levels, so the improvement is real but modest.

Where the gaps are

The survey measured adoption of the five groups of measures in CSA's Cyber Essentials mark. Keeping software and systems updated scored highest, at 80 per cent. Knowing what assets need protection and applying secure configurations and access controls, scored lowest, at 71 per cent each. Backups and incident response planning sat at 73 per cent.

The barriers businesses gave are revealing. Lack of knowledge or experience led at 56 per cent, and believing themselves an unlikely target came second at 46 per cent, ahead of lack of manpower at 37 per cent and lack of budget at 28 per cent. That belief is hard to square with a survey in which almost every organisation was hit. Compromised credentials, the second most common incident, are one place a small firm can act cheaply. Our password strength tester shows how quickly common passwords fall to guessing attacks.