5 Ransomware Singapore facts: What your organisation should know
Ransomware has become rampant in Singapore, and there is a need for every organisation in Singapore to rethink how they should handle the personal data that they collect, use, and disclose during their business operations.
What is ransomware?
Ransomware is the software that powers cyber extortion, a type of computer crime in which your data or equipment is held hostage for a fee. Cyber fraudsters frequently target small companies because they have fewer security measures in place since they are simple and profitable targets.
When ransomware infects a system successfully, the cybercriminals typically provide instructions for communication and the amount to be paid to get the decryption key. Depending on the organization, the cost ranges from thousands of dollars to millions, all paid in Bitcoin.
Since ransomware has been prevalent in Singapore, here are 5 ransomware Singapore facts that every organisation should know and take note of.
Also Read: Guarding Against Common Types of Data Breaches in Singapore
5 ransomware Singapore facts
1. Singapore organisations among most targeted in the world by ransomware attacks
According to a recent study, ransomware attacks are on the rise, and Singaporean organisations are among the most targeted in the world. Despite this, businesses in the region prioritise recovery over prevention, according to a report released last month by cyber-security technology firm Cybereason.
Criminals are increasingly employing a “double extortion” strategy, in which they not only encrypt the data but also steal it and threaten to leak or sell it online.
According to Cybereason, Singapore businesses have experienced the highest volume of such attacks among the countries polled, with 80% of respondents here reporting a ransomware attack in the last 24 months. The average figure worldwide was 72%.
The percentage of Singapore organisations that reported at least one attack in the previous year increased from 60% in last year’s report to 80% this year.
C.K. Chim, Cybereason’s field chief security officer for the Asia-Pacific region, stated that the recent ransomware “gold rush” among cyber criminals is due to the fact that such attacks are becoming easier to carry out, while many organisations are also becoming more reliant on digital infrastructure than before.
2. Ransomware hits 65% of organisations in Singapore
Sophos, a next-generation cybersecurity firm, has released the State of Ransomware 2022 annual survey and review of real-world ransomware experiences.
According to the report, 65% of Singaporean organisations surveyed were infected with ransomware in 2021, up from 25% in 2020. The average ransom paid by Singapore organisations that had data encrypted in their most significant ransomware attack more than sixfold increased from US$187,500 in 2020 to US$1.16 million in 2021.
Even if they had other means of data recovery, such as backups, 48% of the organisations that had data encrypted paid the ransom to get their data back.
The main findings of the Singapore State of Ransomware 2022 survey, which covers ransomware incidents in 2021 and related cyber insurance issues, include more businesses becoming victims.
In 2021, ransomware attacks targeted 65% of Singapore organisations, more than doubling the previous year’s (25%). 64% of attacks resulted in data encryption, a significant increase from the 49% reported by Singapore respondents in 2020.
3. Singapore companies pay an average of S$1.5M after a ransomware attack
As included in its name, ransomware involves ransom money that cybercriminals demand in exchange for encryption keys for the encrypted data files.
According to a study conducted by cybersecurity firm Cybereason, organisations in Singapore hit by ransomware attacks pay a whopping average of S$1,491,750 in ransom.
4. 56% of organisations that paid a ransom were hit for the second time within a span of four to seven days
Being hit by a ransomware attack should already be a warning for all organisations in Singapore, but this is not the case for the majority of those already victimized.
According to the study conducted by Cybereason, 56% of organisations that paid a ransom were hit again within four to seven days, and 55% said their services were either not released or corrupted after payment.
5. Despite recurring or severe attacks, local organisations are only planning to up their security budget by 12% on average
Organisations in Singapore have to make sure that the proposed increase in budget for cybersecurity is enough to prevent the impending and looming cyber-attacks.
The implication of a successful infestation of ransomware
Successful ransomware would only mean one thing; there is a breach of the protection obligation as stipulated in the PDPA.
This not only means losing the trust of customers and potential clients to the organisation, or besmirching the reputation of the organisation that took years to build but also can be made to pay whopping financial penalties, which can range up to S$1,000,000.
In the case of Royal Caribbean Cruises (Asia), the organisation was made to pay S$16,000 due to a successful ransomware attack with a demand of 0.08 Bitcoins in order to recover the deleted data that affected 6,004 of the Organisation’s customers.
The same happened with Audio House, which was made to pay S$10,000 for the successful ransomware attack that affected 98,000 individuals’ names, addresses, email addresses, and telephone numbers in the nature of contact information, were affected.
How Privacy Ninja can help
The best way to ensure that your system is vulnerability free from any ransomware attack is to conduct penetration testing. This also ensures the prevention of financial penalties due to breach of the protection obligation of the PDPA. Privacy Ninja can secure your system from vulnerabilities by scanning for potential entry points of bad actors and suggesting solutions to patch it up. Privacy Ninja offers the most affordable quote and has a Price Beat Guarantee. Contact us now!
Also Read: How GDPR Singapore impacts businesses and its compliance
0 Comments