• 28 May, 2026
• No Comments

60% of Data Breaches Start with Cyber Incidents. Are You Prepared?

Data breaches continue to be one of the most significant operational and regulatory risks facing organisations today. While many businesses focus on sophisticated cyberattacks, the reality is often more complex. Breaches can stem from ransomware, system vulnerabilities, misconfigurations, human error and failures in governance. The latest findings from Singapore’s Data Breach Landscape 2025 reveal that organisations across all industries continue to face similar challenges despite years of awareness campaigns, technology investments and regulatory guidance.

The report highlights an important reality. Data breaches do not discriminate based on organisation size, sector or maturity. Whether an organisation is a multinational corporation, a financial institution or a growing SME, the same underlying weaknesses frequently appear. Understanding these patterns is essential for organisations that wish to strengthen their data protection posture and reduce the likelihood of becoming the next breach headline.

Cyber incidents remain the dominant threat

One of the clearest findings from the report is that cyber incidents remain the primary driver of large-scale data breaches. According to the findings, cyber incidents accounted for 60 per cent of cases where regulatory actions were taken. Ransomware continues to appear across multiple industries and organisations of varying sizes, demonstrating that attackers remain highly opportunistic in their targeting.

This trend reflects a broader global pattern. Attackers are increasingly automating reconnaissance activities, exploiting known vulnerabilities more quickly and leveraging ransomware-as-a-service platforms to scale operations. As a result, organisations that fail to maintain strong cybersecurity fundamentals often become attractive targets.

The significance of this finding is not merely that cyberattacks remain common. Rather, it highlights that many successful attacks continue to exploit weaknesses that could have been identified and addressed earlier through proper security assessments, patch management programmes and ongoing monitoring. Technology alone does not prevent breaches. Effective governance and proactive security practices remain equally important.

Human error continues to create opportunities for breaches

While cyberattacks often receive the most attention, human error remains a remarkably persistent contributor to data breaches. The report notes that internal lapses continue to occur at relatively stable levels, with administrative errors and system issues emerging as recurring causes.

Administrative mistakes may include sending sensitive information to the wrong recipient, incorrectly configuring user permissions or bypassing verification procedures. These errors often appear minor at first, but can have significant consequences when personal data is involved.

System-related issues create similar challenges. Inadequate testing before deploying changes, configuration errors, and weaknesses introduced during migration exercises can leave systems vulnerable without anyone realising it. The fact that these issues continue to appear year after year suggests that many organisations still struggle to embed data protection considerations into everyday operational processes.

The lesson is clear. Cybersecurity and data protection are not solely technical disciplines. They are organisational responsibilities that require awareness, accountability and consistent execution across all levels of the business.

Lessons from the case studies

The case studies featured in the report provide valuable insight into how seemingly routine projects can evolve into serious security incidents. In one example, an organisation failed to properly transfer security policies and related identifiers during a large-scale software migration exercise. The resulting gap remained undetected for months before threat actors exploited it to access and exfiltrate customer data, which later appeared for sale on the dark web.

What makes this example particularly noteworthy is that the root cause was not a sophisticated attack technique. Rather, it was a failure of process governance. The incident demonstrates how important it is to treat system migrations as security-critical projects that require rigorous validation, oversight and testing.

A second case study involved attackers exploiting vulnerabilities in publicly accessible applications and dormant systems that had not been properly decommissioned. The breach resulted in customer data being exfiltrated and published on hacking forums. According to the report, outdated servers, the absence of threat detection tools and the lack of multi-factor authentication contributed significantly to the incident.

Together, these examples demonstrate that many breaches originate from overlooked operational weaknesses rather than groundbreaking technical exploits.

Visibility matters as much as prevention

Another important theme emerging from the report is the growing need for stronger visibility and monitoring capabilities. Many organisations focus heavily on perimeter defences such as firewalls and access controls, yet fail to establish sufficient mechanisms for detecting suspicious activity once attackers gain access.

The report recommends investing in data loss prevention technologies and database-level monitoring to identify unusual activity such as unexpected spikes in data access, bulk exports or unfamiliar login behaviour. It also highlights the importance of implementing controls that can automatically block suspicious data transfers before information leaves the organisation.

This shift reflects an evolving security philosophy. Rather than assuming breaches can always be prevented, organisations must recognise that some attacks will succeed. The critical question then becomes how quickly suspicious activity can be identified and contained before significant harm occurs.

Building a culture of data protection

Technology is only one component of an effective data protection strategy. The report’s recommendations around the B.E.S.T. framework reinforce the importance of maintaining strong operational discipline. Regular backups, encryption, access controls and asset maintenance all contribute to reducing risk and limiting the impact of incidents.

More importantly, these measures work best when they become part of organisational culture. Employees must understand why controls exist and how their daily actions influence security outcomes. Leadership teams must also recognise that data protection is not merely a compliance exercise. It is a business resilience issue that affects customer trust, operational continuity and regulatory exposure.

As regulatory expectations continue to evolve, organisations that embed data protection into business operations will be far better positioned than those that rely on reactive measures after an incident has already occurred.

How Privacy Ninja helps organisations strengthen data protection

The trends highlighted in Singapore’s Data Breach Landscape 2025 reinforce the importance of taking a proactive approach to cybersecurity and data protection. Privacy Ninja helps organisations address these challenges through a combination of technical, operational and compliance-focused services.

Our Vulnerability Assessment and Penetration Testing (VAPT) services help identify weaknesses before attackers can exploit them. By simulating real-world attack scenarios, organisations gain actionable insights into vulnerabilities across networks, applications and supporting infrastructure.

Privacy Ninja’s DPO-as-a-Service supports organisations in building sustainable data protection programmes that align with PDPA requirements while strengthening governance and accountability. We also assist organisations with Data Breach Management, helping clients prepare for incidents, respond effectively when breaches occur and strengthen controls to prevent recurrence.

By combining security testing, advisory services and practical operational guidance, Privacy Ninja enables organisations to move beyond compliance and build meaningful resilience against evolving threats.

The findings from Singapore’s Data Breach Landscape 2025 offer an important reminder that many breaches remain preventable. Cyber incidents continue to dominate regulatory investigations, while human error and operational weaknesses create opportunities for attackers to succeed. The recurring nature of these issues suggests that organisations must place greater emphasis on governance, monitoring and continuous improvement.

The most successful organisations will not necessarily be those with the largest security budgets. Rather, they will be those that maintain visibility into their environments, invest in proactive testing, strengthen operational discipline and prepare for incidents before they occur. As the threat landscape continues to evolve, a proactive and integrated approach to data protection will remain one of the most valuable investments any organisation can make.