Why data breaches are surging in Singapore

Even before the incident, the writing was already on the wall. A Cyber Security Agency of Singapore’s (CSA) report published in June described a threat landscape defined by AI-driven speed, scale, and sophistication. It noted that malware-infected systems in Singapore more than doubled from 117,300 in 2024 to over 284,300 in 2025.

These figures shatter a longstanding assumption that businesses have a buffer of time to test and roll out security patches. Historically, this belief led many organisations to delay software upgrades and defer fixes, especially non-critical ones, to save money and avoid operational downtime.

“These practices were accepted in the past as defence relied heavily on ‘security through obscurity’,” said Vignesa Moorthy, founder and CEO of managed internet and security services provider ViewQwest, referring to the assumption.

“Deferring an upgrade often means running unsupported software that receives no fixes at all. In an environment where flaw discovery is automated, faster and cheaper, that old gamble no longer holds,” he added.

Increasingly, cyberdefenders are making containment decisions under extreme time pressure – frequently with incomplete forensic data – to gauge the full blast radius of an attack across both the organisation and its supply chain. Their response has to be automated to match the speed of incoming attacks.

Fight AI with AI 

Government leaders in Singapore and major cybersecurity firms have issued urgent calls for organisations to “fight AI with AI” to counter the surge in AI-accelerated cyberattacks.

In the weeks leading up to the late-October 2026 breach wave, Coordinating Minister for National Security K. Shanmugam made adopting AI for defence a central pillar of Singapore’s refreshed Cybersecurity Strategy 2026.

Speaking at the opening of Singapore International Cyber Week in October, Shanmugam said: “Singapore will seek to act earlier, act at national scale and act at the speed of the threat.”

At the same conference, Minister for Digital Development and Information Josephine Teo also urged cyberdefenders to counter automated threats at scale using AI, but cautioned that human oversight and accountability cannot be outsourced to machines.

Even before this, CSA has been backing those calls with funding. Through its annual CyberCall innovation challenge, the agency recently awarded $5.6 million to 13 local projects from its 2025 cohort to build AI-powered threat-hunting tools.

The newly opened CyberCall 2026 goes further, seeking solutions that can automatically detect and respond to fast-moving intrusions, spot fake aircraft tracking signals that disrupt aviation operations, and help small businesses manage cybersecurity on their own.

Businesses must heed these warnings.

For instance, AI can be used to safely test the cyberdefences of an organisation by autonomously hacking to find vulnerabilities before hackers do, and verifying fixes for those vulnerabilities.

If the recent wave of breaches proves anything, waiting for attackers to strike before upgrading defences is no longer viable.

What businesses owe consumers 

Stronger technical defence is only half the solution. Businesses and regulators have much to do to protect consumers.

When breaches do occur, customers in many cases are forced to shoulder the burden of identity and fraud defence on their own.

Businesses must move beyond sending out boilerplate compliance notices and start offering customers effective remediation. That would require a major shift, but it is only fair that they do so.

Organisations have far greater resources than individuals to shoulder the financial fallout of a breach caused through no fault of the consumer’s. 

Possible remedies include providing affected customers with paid access to monitoring tools that alert them if their leaked NRIC, e-mail address or phone number surface in illicit data dumps.

This will help to mitigate the immediate threat of fraudulent loan applications, impersonations or account takeovers as one’s NRIC, full name and date of birth cannot be cancelled or reissued like a credit card.

Instead of asking users to stay vigilant and figure out security settings on their own, breached companies should also roll out extra default safeguards to protect customer accounts.

These safeguards include mandating password changes or the use of Singpass when customers log in after a data breach.

Regulators, too, can do their part to require baseline post-breach restitution, in addition to the mandatory notifications, to ensure service providers are directly accountable when that trust is broken.

For instance, regulators could mandate paid access to identity monitoring tools that alert affected victims of the extent of their personal data exposure.

Another post-breach restitution could be the creation of a priority, toll-free helpline staffed by trained fraud specialists to help victims freeze compromised accounts and liaise with law enforcement to crack down on impersonation attempts.

While the recent spate of data breaches is less about a sci-fi rogue AI breaking encryption and more about systemic cyber-hygiene failures, the lesson is clear: Firms need to step up their cyber defences now before it is too late. And they cannot simply wish victims “all the best” when their hygiene standards slip.