IT Emergency After Hours in Singapore: What to Do and Who to Call

First: how urgent is it really?

Sort the problem before you pick up the phone. Some emergencies get worse by the minute; others are annoying but can wait until the morning without real harm.

First-hour steps for the four common emergencies

These are containment steps, not a full fix. They limit damage until proper help is available.

1. 1

   Hacked email: change the password and sign out everywhere

   From a clean device, reset the password, turn on MFA, and use Microsoft 365's or Google's admin console to sign the user out of all sessions. Then look for forwarding and inbox rules the attacker added.

2. 2

   Ransomware: isolate, photograph, don't pay

   Disconnect affected devices from the network, photograph the ransom note, and disconnect backup drives so they don't get encrypted too. Follow our ransomware first-steps guide.

3. 3

   Website hacked or down: check before you panic

   Check from mobile data, check your host's status page and whether the domain has expired. If the site is defaced, put it in maintenance mode or ask the host to suspend it.

4. 4

   Money lost: call the bank first

   Call your bank's fraud hotline to try to stop or recall the payment, then file a police report online. Speed matters more than anything else here.

5. 5

   Write a timeline as you go

   Note what you saw, when, and what you changed. You will need it for the police, your insurer and a possible PDPC breach assessment.

Detailed playbooks: ransomware: what to do and website down: what to check first.

Free official channels and when they're open

Singapore has several free channels for businesses. Their hours differ, which matters at 11pm on a Saturday.

CSA announced the Cyber Incident Helpline on 14 October 2026. It is run by the Cyber Resilience Centre; outside its hours, submit the online form so an adviser calls back, and follow our guide to when to call the helpline. SingCERT reports go through CSA's Cyber Aid tool. Police reports can be filed through Police e-Services, and the ScamShield Helpline is 1799.

If personal data may have been exposed, start a breach assessment straight away. A breach is notifiable if it is likely to cause significant harm or affects 500 or more people, and PDPC must then be told within 3 calendar days of that assessment. PDPC's self-assessment tool helps.

What paid IT help can and can't do after hours

Most small IT providers, including us, are not on call around the clock. Larger managed service providers sell 24/7 support contracts, and incident response firms run hotlines, usually under a retainer or at premium hourly rates. Ask what "24/7" means: a person who can log in and act, or a ticket logged until morning.

To be clear about our own service: IT Sorted works remotely through bookings on this site, paid upfront, with contact through the site chat. We don't offer phone support or an emergency on-call line. Our Hacked Email Recovery (S$290) is scheduled for completion in one day, and a Quick Fix (1 hour) (S$119) suits a single urgent setting change. For ransomware in progress, follow the containment steps above and use the official channels first.

The fridge-door contact sheet

Emergencies go faster when nobody has to hunt for a login or phone number. Print one page, keep it in the office and at home, and update it twice a year.

Do it yourself or get help?

In the first hour, you are the incident responder: contain, call the bank if money is involved, report, and write things down. The skilled clean-up (finding how attackers got in, restoring from backups, proving what was accessed) can usually start the next working day without making things worse, as long as containment was done.

The best time to prepare is now. Our Incident & Ransomware Response Plan (S$390) gives you playbooks for ransomware, hacked email and lost devices, a filled-in contact sheet, PDPC notification steps and a 30-minute tabletop exercise for your team. For a mailbox that is already compromised, book Hacked Email Recovery (S$290).