In this guide · 8 sections
- 01The 2025 numbers at a glance
- 02Takeaways 1 and 2: ransomware hits SMEs most
- 03Takeaways 3 and 4: phishing is under-reported and looks legitimate
- 04Takeaways 5 and 6: defacements and old website files
- 05Takeaway 7: infected devices and supply chains
- 06Map each trend to a control and a cost
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
In 2025, CSA received reports of 165 ransomware cases, with SMEs the most affected, and about 4,800 phishing attempts. Infected systems rose 142% to 284,300, and most of the 62 defaced websites belonged to SMEs with poor cyber hygiene.
The 2025 numbers at a glance
All figures are from the Singapore Cyber Landscape 2025/2026 report (CSA, published 30 June 2026), chapter 'The Cybersecurity Situation in Singapore'. They count incidents reported to or observed by CSA, so they are a floor, not the full picture.
| Measure | 2024 | 2025 | Change |
|---|---|---|---|
| Ransomware cases reported to CSA | 159 | 165 | +4% |
| Phishing attempts reported to CSA | about 6,100 | about 4,800 | -21% |
| Infected systems observed in Singapore | about 117,300 | 284,300 | +142% |
| Defaced Singapore websites | 67 | 62 | -7% |
| Phishing sites using HTTPS | 69% | 79% | +10 points |
The same report includes Singapore Police Force scam figures: scam cases fell 27.6% from 51,501 to 37,308 in 2025, and losses fell 17.9% from S$1.1 billion to S$913.1 million.
Takeaways 1 and 2: ransomware hits SMEs most
Ransomware cases rose only slightly, from 159 to 165, but CSA states that SMEs were the most affected, 'consistent with their generally lower levels of cybersecurity maturity and more limited resources'. Wholesale and retail, manufacturing and construction together made up almost half of the incidents. Wholesale and retail alone accounted for 32 cases (19.4%).
The top groups attacking Singapore organisations were Akira, Qilin and LockBit. CSA notes that Qilin affiliates phished IT service provider administrators with fake ScreenConnect login alerts and captured session tokens to get past MFA. In other words, your IT provider's accounts are part of your attack surface.
Control: offline or immutable backups you have test-restored, MFA on every admin account, and a written plan for the first hour. Our ransomware response guide has the steps.
Takeaways 3 and 4: phishing is under-reported and looks legitimate
About 4,800 phishing attempts were reported to CSA in 2025, down from 6,100. CSA itself warns that these figures 'likely underrepresent the true scale', because many incidents go unreported when no money is lost. Banking and financial services were spoofed in 70% of reported attempts, followed by government (IRAS was the most impersonated agency) and logistics (DHL delivery notices).
Two details matter for staff training. First, 79% of reported phishing sites used HTTPS, up from 69%, so the padlock is not a safety sign. Second, CSA describes toolkits that bypass MFA using adversary-in-the-middle pages and QR-code phishing ('quishing'), alongside AI voice cloning and deepfakes.
Control: phishing-resistant MFA, email filtering and a short staff briefing. See our guide to setting up MFA for business accounts.
Takeaways 5 and 6: defacements and old website files
Website defacements fell again, to 62 in 2025 from 67 in 2024 (and 340 in 2022). CSA's description is pointed: most defaced sites belonged to SMEs 'whose web environments demonstrated poor cyber hygiene', and neglected pages and directories, such as legacy setup or configuration files, let attackers in.
CSA also found that defacements in October and December made up more than half of the year's incidents, linked to campaigns that exploit holiday lulls in monitoring and patching. That is a reason to check your website before the year-end break, not after.
Control: remove old installers, test copies and unused plugins; keep the CMS updated; monitor uptime and file changes. If it has already happened, follow our website hacked guide.
Takeaway 7: infected devices and supply chains
The sharpest rise was in infected systems, up 142% to 284,300. CSA links this to the Malware-as-a-Service economy and to consumer IoT devices with default passwords or unpatched firmware. In a small office, think CCTV recorders, smart TVs in meeting rooms and cheap Android TV boxes on the same Wi-Fi as the finance PC.
The report also highlights software supply chains: attackers compromising a trusted vendor's development or update process to spread malicious code through normal updates. Our explainer on the 2026 npm supply-chain advisories covers what to ask your web developer.
Control: change default passwords, put IoT devices on a separate guest network, and keep endpoint protection on every work laptop.
Map each trend to a control and a cost
Most of these controls are settings, not purchases. Where you want help, these are our fixed prices; your own costs may be lower if you do it yourself.
| Trend in the report | Control | Typical cost |
|---|---|---|
| Ransomware hits SMEs most | Tested backups + incident plan | S$290 backup set-up; S$390 response plan |
| Phishing and MFA bypass | App or passkey MFA, email filtering | Free settings; S$590 Microsoft 365 / Google lockdown |
| Defaced SME websites | Remove old files, update, monitor | S$290 website hardening; from S$29/month monitoring |
| Infected devices | Endpoint protection, default passwords changed | From S$19/user/month (Protect Standard) |
| Supply-chain compromise | Vendor contract clauses, access review | Mostly time; S$290 health check to review |
CSA also points SMEs to its baseline standard: the revised Cyber Essentials mark, relaunched in April 2025. The report says more than 800 organisations had achieved at least Cyber Essentials certification by early 2026.
Do it yourself or get help?
A short internal review is a good start: list your admin accounts and check MFA, test-restore one backup, and remove anything old from your website. That covers several of the report's trends in a day.
If you would rather have an outside view, our Security Health Check (S$290) reviews accounts, devices, email and website against these trends and gives you a prioritised list. Protect Standard (S$19 per user a month) then keeps endpoint protection, updates and monitoring running on every device.
Frequently asked questions
It is an annual publication by the Cyber Security Agency of Singapore that reviews the country's cybersecurity situation over the previous year. The 2025/2026 edition, published on 30 June 2026, covers 2025 data on ransomware, phishing, infected systems and website defacements, plus national initiatives such as the revised Cyber Essentials and Cyber Trust marks.
CSA received reports of 165 ransomware cases in 2025, up from 159 in 2024. Small and medium enterprises were the most affected. Wholesale and retail, manufacturing and construction together accounted for almost half of reported incidents. Unreported cases are not included, so the real number may be higher.
Reported phishing attempts fell to about 4,800 in 2025 from about 6,100 in 2024, according to CSA. However, CSA says these figures likely understate the real scale because many incidents are not reported. Phishing has also become harder to spot, with most fake sites using HTTPS and some kits able to bypass SMS-based MFA.
CSA found that most of the 62 defaced Singapore websites in 2025 belonged to SMEs with poor cyber hygiene. Neglected or outdated pages and directories, such as old setup or configuration files, gave attackers a way in. More than half of the year's defacements happened in October and December, during holiday lulls in monitoring.
Turn on strong multi-factor authentication for email and every admin account, then test that you can restore a backup. These two steps address the phishing and ransomware trends that CSA highlights, cost little or nothing, and can be done in a day. After that, clean up old website files and change default device passwords.