Cyber Incident Helpline 6890 9555: When SMEs Should Call

What the Cyber Incident Helpline is

CSA announced the helpline in its press release of 14 October 2026, launched at Singapore International Cyber Week. It is run by the Cyber Resilience Centre (CRC), which the Singapore Business Federation set up in 2025 with the Singapore Chinese Chamber of Commerce and Industry and SGTech, with CSA's support. The CRC website states that the helpline itself is managed by RSM Stone Forest IT.

CSA describes the service as initial incident triage, advisory support and referrals to service providers and resources. In plain terms: someone with cyber experience listens to what happened, tells you how serious it looks, explains how to contain it, and refers you to specialists if you need hands-on help.

When an SME should call the helpline

The helpline is meant for businesses facing a suspected or active incident, and for those wanting preventive advice. Good reasons to call include:

• files on a PC or shared drive have been encrypted or renamed, or a ransom note has appeared;
• a staff mailbox is sending phishing to your contacts, or has rules you did not create;
• your website shows content you did not publish, or your host has suspended it for malware;
• someone has logged in to an admin account from an unknown location;
• a supplier or customer says they received a fake invoice that looks like it came from you;
• you are not sure whether something is an incident at all and want a second opinion.

CSA's own survey shows why the service exists. In the Singapore Cybersecurity Health Report 2025, almost nine in 10 of the 2,005 organisations surveyed reported at least one incident in 2025. Ransomware was the most commonly reported, followed by compromised credentials and phishing or impersonation. Among businesses, 56% cited a lack of knowledge and experience as a barrier.

What to have ready before you call

The CRC online form asks for your name, role, email, mobile, sector, staff strength, company name and UEN, then the nature of the incident, when the business found out, the signs you saw and what was affected. You can attach up to five screenshots or PDFs of 1MB each. Having this ready makes the triage call faster.

The CRC says its agents will never ask for bank details, passwords, PINs or one-time passwords. If anyone claiming to be from the helpline asks for these, hang up. Scammers copy new government services quickly.

How it fits with police, SingCERT and PDPC reporting

The helpline is advice and triage. It does not take over your legal duties, and several reports can apply to the same incident.

If personal data is involved, the clock that matters most is the PDPC one: assess the breach quickly, and notify within three calendar days once you decide it is notifiable. Our PDPA data breach notification guide walks through that decision. SingCERT's Cyber Aid page also reminds organisations that the police are the authority for investigating cybercrime.

What happens after the helpline call

Based on the CRC pages, the flow looks like this.

1. 1

   You call or submit the online form

   Describe what happened, when it started and what you have observed. Online, you choose between an incident report and a general enquiry.

2. 2

   Callback within 2 hours

   During operating hours, a CRC agent calls back. Calls are described as confidential and for information only.

3. 3

   Triage and severity assessment

   The agent helps you work out how serious it is and what is affected.

4. 4

   Containment advice

   You get first-level advice on stopping the spread, such as isolating devices or locking accounts.

5. 5

   Referral if needed

   If you need hands-on recovery, the CRC refers you to vetted specialists. Any paid work is between you and that provider.

The official pages do not publish a fee for the helpline or for referred work. Ask at the start of the call whether the triage is free and get a written quote before any paid work begins.

Prepare now so the call is short

A helpline works best when you already know who your admins are, where your backups live and how to lock an account. CSA's press release points SMEs to its Cybersecurity Health Check tool, the CISO-as-a-Service programme (up to 70% co-funding for eligible SMEs) and the Cyber Essentials mark as the baseline.

• Write down the helpline number, the police e-services link and your bank's fraud line on one page.
• Name one person who can take the callback and make decisions.
• Keep an offline list of admin accounts for email, domain, website and accounting.
• Test one restore from backup this quarter.
• Turn on MFA for every email and admin account.

Our Cyber Essentials checklist covers the baseline controls, and the hacked business email guide is the first-hour plan for the most common SME incident.

Do it yourself or get help?

Calling the helpline is the right first step for most small businesses with an active incident, and it costs you nothing to save the number today. What the helpline cannot do is write your plan in advance or fix your accounts for you.

If you want a one-page plan with names, numbers and steps for ransomware, hacked email and data breaches, Incident & Ransomware Response Plan (S$390) builds it with you. If a mailbox has already been taken over, Hacked Email Recovery (S$290) locks it down and removes the attacker's rules and access.