Singapore Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Singapore
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Singapore, checked 7 Nov 2026. CSA issues alerts and advisories instead, and launched the Singapore Cybersecurity Strategy 2026 on 13 Oct 2026.
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
| Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Phishing attempts reported to CSA | about 4,800 (down 21% from 6,100) | 2025 | CSA, Singapore Cyber Landscape 2025/2026 |
| Ransomware cases reported to CSA | 165 (up from 159) | 2025 | CSA, Singapore Cyber Landscape 2025/2026 |
| Infected systems detected in Singapore | 284,300 (up 142%) | 2025 | CSA, Singapore Cyber Landscape 2025/2026 |
| Defaced Singapore websites | 62 (down from 67) | 2025 | CSA, Singapore Cyber Landscape 2025/2026 |
| Share of reported phishing spoofing banking and financial services | 70% | 2025 | CSA, Singapore Cyber Landscape 2025/2026 |
| Scam and cybercrime cases | 41,974 (down 24.8%) | 2025 | SPF, Police Life (25 Feb 2026) |
| Scam losses | S$913.1 million (down from S$1.1 billion) | 2025 | SPF, Police Life (25 Feb 2026) |
| Scam cases | 37,308 | 2025 | The Star (ST/ANN, police figures) |
| Scam and cybercrime cases | 18,391 (down 17.9%) | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Scam cases | 16,821 (down 14.4%) | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Scam losses | about S$410.6 million (down 17.9%) | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Government official impersonation scam losses | S$90.8 million (down 31.7%) | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Cryptocurrency scam losses | about S$65.5 million (16% of losses) | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Scam losses recovered by the Anti-Scam Centre | more than S$97.7 million | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
| Malicious websites disrupted by SPF | 52,200 | January to June 2026 | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| UNC3886 | State-aligned | CSA said in February 2026 that this China-linked APT breached parts of all four major Singapore telcos' networks. | CSA press release | |
| ShinyHunters | Extortion | Claimed the May 2026 Canvas breach that exposed NUS, SUSS and SIM student data, and listed Aman Resorts in April. | AsiaOne · ransomware.live | Profile |
| Qilin | Ransomware | Listed Singapore victims including Neo Group, Pleiad Investment Advisors and One Legal in 2026. | ransomware.live · ransomware.live | Profile |
| The Gentlemen | Ransomware | Listed MIMS, Times Software, NTU Alumni Club and Charles & Keith in 2026. | ransomware.live · ransomware.live | Profile |
| Everest | Ransomware | Listed Bolttech, K Subsea Group and an unnamed Singapore energy storage terminal in 2026. | ransomware.live · ransomware.live | Profile |
| Orova | Ransomware | Listed several Singapore firms in October and November 2026, including Raffles United Holdings, Detronics and Harry's International. | ransomware.live · ransomware.live | Profile |
| Eclipse | Ransomware | Listed TTG Asia Media, Global AirFreight International and Royal Plaza on Scotts in 2026. | ransomware.live · ransomware.live | Profile |
| Insomnia | Ransomware | Claimed the January 2026 attack on SGX-listed Enviro-Hub Holdings, which the company confirmed as ransomware. | ransomware.live | |
| Incransom | Ransomware | Claimed SGX-listed LHT Holdings in March 2026 after the company disclosed encrypted systems. | ransomware.live | Profile |
| Krybit | Ransomware | Listed ProHealth and Disk Precision Group among Singapore victims in 2026. | ransomware.live | Profile |
| N0n | Extortion | Listed Apical Group and Ocean Network Express in October 2026. | ransomware.live | Profile |
| Government official impersonation scam syndicates | Scam syndicate | SPF said this scam type caused S$90.8 million in losses in the first half of 2026, the second highest of any type. | SPF, Mid-Year Scam and Cybercrime Brief 2026 |
Laws and rules this year
- 13 Oct 2026Singapore Cybersecurity Strategy 2026. The government launched a five-year strategy to build national cyber defence capabilities for critical infrastructure, secure the wider cyberspace, accelerate quantum-safe migration and grow the cyber workforce. Source
- 7 Oct 2026Digital Infrastructure Bill passed. Parliament passed a bill creating IMDA licensing regimes for the security, resilience and sustainability of major cloud services and data centres. Source
- 7 Oct 2026MAS Guidelines on AI Risk Management for financial institutions. MAS issued supervisory expectations for how financial institutions manage AI risk, with a transition period to 7 October 2027. Source
- 9 Sep 2026Scams (Countermeasures) and Other Matters Act 2026. Parliament passed a law adding account disabling and service limitation orders, offences for supplying or misusing online accounts, and administrative penalties of up to S$10 million per breach of OCHA codes or directives. Source
- 17 Aug 2026New and enhanced Codes of Practice under the Online Criminal Harms Act. SPF issued Messaging, Social Media and E-Commerce Codes requiring platforms such as WhatsApp, Telegram, Facebook and Carousell to curb scams, with government anti-spoofing due by 30 September 2026 and the rest by 31 January 2027. Source
- 2 Mar 2026Cyber Trust Mark requirements for CII owners, auditors and licensed providers. CSA will require CII auditors to hold Cyber Trust Mark Level 5 by end-2026, licensed pen-test and SOC providers to hold CTM Promoter Tier 3 by 31 December 2026, and CII owners to reach Level 5 for supporting non-CII systems by end-2027. Source
Full stories
- M1 customer data breach Singapore · 6 Nov 2026
- Amadeus airline data breach Malaysia, Singapore, Japan +3 · 4 Nov 2026
Official statements
- 6 Nov 2026Advisory on attacks against remotely accessible operational technology control systems, citing the European supermarket refrigeration attacks. CSA
- 6 Nov 2026CSA, GovTech and IMDA issue a joint advisory on using personal AI agents safely and securely. CSA
- 3 Nov 2026Alert on active exploitation of PHP2Shell against network and security products including Palo Alto Networks firewalls. CSA
- 28 Oct 2026Advisory on malware campaigns spreading through WhatsApp. CSA
- 21 Oct 2026Alert on critical PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) allowing unauthenticated remote code execution. CSA
- 13 Oct 2026Launch of the Singapore Cybersecurity Strategy 2026, including an enhanced national cyber command centre for critical infrastructure. Yahoo Finance
- 13 Oct 2026Senior Minister K Shanmugam launched Singapore's Cybersecurity Strategy 2026 at Singapore International Cyber Week. CSA
- 7 Oct 2026Parliament passed the Digital Infrastructure Bill, and MAS issued its Guidelines on AI Risk Management. Parliament
- 30 Sep 2026Advisory on the CARBONATO botnet campaign targeting exposed Docker daemons. CSA
- 8 Sep 2026MHA moved the second reading of the Scams (Countermeasures) and Other Matters Bill, which Parliament passed the next day. MHA
- 26 Aug 2026SPF reported scam losses of about S$410.6 million in the first half of 2026, down 17.9%. SPF
- 18 Aug 2026SPF announced new OCHA Codes of Practice for messaging, social media and e-commerce services issued on 17 August. SPF
- 3 Jul 2026SLA said an IBM-managed test cloud environment holding data of about 70,000 people was accessed without authorisation. SLA
- 30 Jun 2026CSA released the Singapore Cyber Landscape 2025/2026, reporting 165 ransomware cases and 284,300 infected systems in 2025. CSA
- 2 Mar 2026At the Committee of Supply, CSA announced Cyber Trust Mark requirements for CII owners, CII auditors and licensed cybersecurity providers. CSA
- 26 Feb 2026PDPC published a ransomware decision against SESAMi and Abecha and accepted undertakings from Cycle & Carriage, Lian Beng Group and St Francis Methodist School. PDPC
- 26 Feb 2026The PDPC fined SESAMi S$8,750 and issued directions to it and subsidiary Abecha after a 2024 ransomware attack encrypted a shared drive holding personal data, including bank and card details, of about 39,000 people. PDPC decision
- 26 Feb 2026The PDPC accepted a voluntary undertaking from Cycle & Carriage Industries over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls. Baker McKenzie
- 26 Feb 2026The PDPC accepted a voluntary undertaking from Lian Beng Group over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls. Baker McKenzie
- 26 Feb 2026The PDPC accepted a voluntary undertaking from St Francis Methodist School (International) over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls. Baker McKenzie
- 25 Feb 2026SPF reported 41,974 scam and cybercrime cases in 2025, down 24.8%, with scam losses of S$913.1 million. SPF
- 9 Feb 2026CSA disclosed that UNC3886 had targeted all four major telcos and that Operation Cyber Guardian, its largest coordinated cyber response, had contained the intrusion. CSA
- 8 Jan 2026PDPC published decisions fining People Central, Singapore Data Hub, Air Sino-Euro Associates Travel and Goldheart Jewelry over data breaches. PDPC
- 8 Jan 2026The PDPC fined Singapore Data Hub S$17,500 after at least two threat actors accessed its servers in 2024 and exfiltrated personal data that was likely posted on a hacking forum. PDPC decision
- 8 Jan 2026The PDPC fined HR software provider People Central S$17,500 after a threat actor exploited SQL injection flaws, deleted databases and likely exfiltrated data of 95,000 client employees, which was later found for sale on the dark web. PDPC decision
- 8 Jan 2026The PDPC fined the travel agency S$47,000 after a cyberattack exfiltrated personal data of 336,759 people, citing an outdated operating system, no MFA on privileged accounts and no data protection officer. Baker McKenzie
- 8 Jan 2026The PDPC fined Goldheart Jewelry, an Aspial subsidiary, S$58,000 after attackers exploited its unpatched Magento store, exfiltrated data of 41,379 customers and published the database on an online forum. PDPC decision PDF
Incidents
36 of 36 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedDoctor Anywhere | 7 Nov 2026 | Health | Data leak | None | Confirmed. A malicious cyber incident leaked user personal data. Police report filed; PDPC is investigating. It learned of the breach on 29 October, engaged Ensign InfoSecurity and says clinical records were not affected. | AsiaOne · The Straits Times via Yahoo✓ 8 Nov |
| ⚠️ ClaimedBOSH Engineering Private Limited | 7 Nov 2026 | Manufacturing | Ransomware | Claimed. Qilin listed the Singapore engineering firm on its leak site on 7 November. No data volume stated and no press coverage found. | ransomware.live✓ 8 Nov | |
 ✅ ConfirmedM1Full story | 6 Nov 2026 | Telecom | Data leak | None | Confirmed. A breach found on 30 Oct exposed customer names, NRIC/FIN numbers, birth dates, mobile numbers, emails and addresses. Contained; payment data not affected. PDPC said on 6 November it is investigating; M1 has not said how many customers were affected. | Mustsharenews · Goody Feed✓ 8 Nov |
 ✅ ConfirmedSingapore AirlinesVia a vendorFull story | 4 Nov 2026 | Transport | Supply chain | None | Confirmed. About 46,000 booking records held by reservation provider Amadeus were accessed, about 620 with contact, travel document or KrisFlyer details. SIA's own systems were not breached. | The Star✓ 7 Nov |
 ✅ ConfirmedMoneySmart | 3 Nov 2026 | Finance | Intrusion | None | Confirmed. An unauthorised party accessed internal systems on 29 Oct and copied personal data of some Singapore and Hong Kong customers. PDPC informed. | The Star · Hong Kong Free Press✓ 7 Nov |
 ⚠️ ClaimedRaffles United Holdings | 3 Nov 2026 | Other | Ransomware | Claimed. The Orova group listed Raffles United Holdings on its leak site on 2026-11-03. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedDetronics | 3 Nov 2026 | Manufacturing | Ransomware | Claimed. The Orova group listed Detronics on its leak site on 2026-11-03. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedHarry's International | 2 Nov 2026 | Retail | Ransomware | Claimed. The bar and restaurant chain is listed on Orova's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedUnnamed energy storage terminal | 27 Oct 2026 | Energy | Ransomware | Claimed. Everest lists an unnamed Singapore energy storage terminal on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedAlliance Healthcare Group (Alliance Medinet) | 24 Oct 2026 | Health | Data leak | None | Confirmed. Alliance Healthcare Group told SGX that a third party gained unauthorised access to subsidiary Alliance Medinet's membership database, exposing names, ID numbers and contact details of about 110,000 members, and that it reported the incident to the PDPC on 21 October. | Little Big Red Dot · MLex✓ 7 Nov |
 ⚠️ ClaimedOcean Network Express | 12 Oct 2026 | Transport | Ransomware | Claimed. The Singapore-based container line is listed on N0n's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedApical Group | 12 Oct 2026 | Manufacturing | Ransomware | Claimed. The N0n group listed Apical Group on its leak site on 2026-10-12. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedGlobal AirFreight International | 8 Oct 2026 | Transport | Not disclosed | Claimed. The Eclipse group listed Global AirFreight International on its leak site on 2026-10-08. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedBee Cheng Hiang | 30 Sep 2026 | Retail | Data leak | None | Confirmed. The PDPC said an employee's AI-generated mailing script exposed the email addresses of 95,364 members to other recipients, its first notified AI-related breach, and accepted a voluntary undertaking from the company. | Mothership · Bloomberg✓ 7 Nov |
 ✅ ConfirmedSIMBA Telecom | 28 Sep 2026 | Telecom | Data leak | None | Confirmed. Names, ID numbers, birth dates, mobile numbers and emails of 23,549 customers were breached. PDPC is investigating. | Malay Mail · The Star✓ 7 Nov |
 ⚠️ ClaimedCharles & Keith | 26 Sep 2026 | Retail | Ransomware | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedGiti Corp | 18 Sep 2026 | Manufacturing | Ransomware | Claimed. The Killsec group listed Giti Corp on its leak site on 2026-09-18. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedTTG Asia Media | 8 Sep 2026 | Media | Ransomware | Claimed. The Eclipse group listed TTG Asia Media on its leak site on 2026-09-08. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedRoyal Plaza on Scotts | 2 Sep 2026 | Other | Ransomware | Claimed. The hotel is listed on Eclipse's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedNTU Alumni Club | 10 Aug 2026 | Education | Ransomware | Claimed. The The Gentlemen group listed NTU Alumni Club on its leak site on 2026-08-10. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedProHealth (prohealth.sg) | 2 Aug 2026 | Health | Ransomware | Claimed. The Krybit group listed ProHealth (prohealth.sg) on its leak site on 2026-08-02. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedAkribis Systems | 27 Jul 2026 | Manufacturing | Ransomware | Claimed. The Nightspire group listed Akribis Systems on its leak site on 2026-07-27. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedSingapore Land AuthorityVia a vendor | 3 Jul 2026 | Government | Supply chain | None | Confirmed. SLA said IBM told it of unauthorised access to an IBM-managed development and testing cloud environment that held names, NRIC numbers and property addresses of about 70,000 people; live systems were not affected and SLA notified the PDPC and police. | SLA press release✓ 7 Nov |
 ⚠️ ClaimedTimes Software | 15 Jun 2026 | Other | Ransomware | Claimed. The The Gentlemen group listed Times Software on its leak site on 2026-06-15. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedGlobal Schools Foundation | 10 Jun 2026 | Education | Data leak | Claimed. The Fulcrumsec group listed Global Schools Foundation on its leak site on 2026-06-10. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedOne Legal | 13 May 2026 | Other | Ransomware | Claimed. The Qilin group listed One Legal on its leak site on 2026-05-13. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedNational University of Singapore, SUSS and SIM (Canvas)Via a vendor | 8 May 2026 | Education | Supply chain | Confirmed. NUS said names, email addresses and matriculation numbers were exposed in the breach of the Instructure Canvas learning platform and that no login credentials were compromised; SUSS told students no passwords, NRIC numbers or financial data were involved. Claimed. ShinyHunters claimed the attack on Canvas. | AsiaOne · The Star✓ 7 Nov | |
 ⚠️ ClaimedMIMS | 6 May 2026 | Health | Ransomware | Claimed. The The Gentlemen group listed MIMS on its leak site on 2026-05-06. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedWOHA | 6 May 2026 | Property | Ransomware | Claimed. The Lamashtu group listed WOHA on its leak site on 2026-05-06. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedK Subsea Group | 13 Apr 2026 | Energy | Ransomware | Claimed. The Everest group listed K Subsea Group on its leak site on 2026-04-13. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedPleiad Investment Advisors (Singapore branch) | 9 Mar 2026 | Finance | Ransomware | Claimed. The Qilin group listed Pleiad Investment Advisors (Singapore branch) on its leak site on 2026-03-09. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedLHT Holdings | 4 Mar 2026 | Manufacturing | Ransomware | Confirmed. SGX-listed LHT Holdings said unauthorised access to certain IT systems led to encryption of selected systems, the incident was contained, and it found no evidence of personal or confidential data being accessed or exfiltrated. Claimed. The Incransom group listed LHT Holdings Limited on its leak site on 10 March 2026. | Tiger Brokers (company announcement) · ransomware.live✓ 7 Nov | |
| ✅ ConfirmedSingtel, StarHub, M1 and SIMBA Telecom | 9 Feb 2026 | Telecom | Intrusion | Confirmed. CSA said China-linked APT UNC3886 gained access to parts of all four major telcos' networks, reached critical systems in one case without disrupting services, and took a small amount of mainly network-related technical data, with no evidence customer data was accessed. | CSA press release · Help Net Security✓ 7 Nov | |
 ✅ ConfirmedEnviro-Hub Holdings | 26 Jan 2026 | Manufacturing | Ransomware | Confirmed. Enviro-Hub told SGX that an unknown party gained unauthorised access to its servers in a ransomware incident with no material impact on operations, and that it reported the matter to the PDPC. Claimed. The Insomnia group listed Enviro-Hub Holdings on its leak site on 7 February 2026. | Reuters via Tiger Brokers · ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedBolttech | 21 Jan 2026 | Finance | Ransomware | Claimed. The Everest group listed Bolttech on its leak site on 2026-01-21. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedNeo Group | 15 Jan 2026 | Retail | Ransomware | Claimed. The Qilin group listed Neo Group on its leak site on 2026-01-15. | ransomware.live✓ 7 Nov |
FAQ
Does Singapore have a national cyber threat level?
No published national cyber threat level was found for Singapore (checked 7 Nov 2026). CSA issues alerts and advisories instead, and launched the Singapore Cybersecurity Strategy 2026 on 13 Oct 2026.
Which organisations in Singapore confirmed cyber incidents recently?
12 incidents confirmed since January 2026: Doctor Anywhere, M1, Singapore Airlines, MoneySmart, Alliance Healthcare Group (Alliance Medinet), Bee Cheng Hiang, SIMBA Telecom, Singapore Land Authority, National University of Singapore, SUSS and SIM (Canvas), LHT Holdings, Singtel, StarHub, M1 and SIMBA Telecom and Enviro-Hub Holdings.
Which Singapore organisations appear on ransomware or leak sites?
24 claims, not confirmed by the organisations: BOSH Engineering Private Limited, Raffles United Holdings, Detronics, Harry's International, Unnamed energy storage terminal, Ocean Network Express, Apical Group and Global AirFreight International and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.