12 Cybersecurity Tips That Could Save Your Business From the Next Big Data Breach

Why Singapore Businesses Are in the Crosshairs

Singapore is one of the most connected economies on earth, and that connectivity cuts both ways. The same digital maturity that powers local business also widens the attack surface that criminals probe every day.

The numbers from the latest national report make the trend impossible for me to ignore.

KEY STAT

Phishing attempts reported in Singapore jumped 49% to roughly 6,100 cases in 2024, while ransomware cases rose 21% to 159 that year, according to CSA’s Singapore Cyber Landscape 2024/2025 report.

The picture since is mixed: Infected infrastructure climbed a further 142% to about 284,300 systems in 2025 and ransomware edged up to 165 cases, but phishing attempts actually fell 21% to roughly 4,800, per the Singapore Cyber Landscape 2025/2026 report by CSA.

Cost is the second half of the story. A breach is not just downtime; it is legal exposure, lost trust, and recovery bills that can dwarf the original prevention cost.

Globally, IBM’s 2026 Cost of a Data Breach report put the average breach at a record US$4.99 million, with the ASEAN regional average at US$4.12 million, both up roughly 12% from the year before.

Crucially, IBM found that phishing and stolen credentials remain the most common ways attackers get in, and that organisations using security automation contained breaches far faster and cheaper.

It Is Not Only Big Companies Anymore

There is a comforting myth I hear among smaller firms: “We are too small to be a target.” Attackers love that myth, because it keeps defences low.

In reality, automated attacks do not check your revenue first. They scan the whole internet for weak passwords, exposed servers, and unpatched software, then strike whatever they find.

CSA itself flagged that SMEs in professional services such as consulting, legal, and accounting were disproportionately targeted by ransomware, precisely because they hold valuable client data with leaner defences.

SINGAPORE INSIGHT

Singapore has turned cybersecurity into a legal expectation, not just good practice. Under the Personal Data Protection Act (PDPA), a business that suffers a notifiable data breach must alert the PDPC within three calendar days and tell affected individuals.

If you want the bigger regulatory picture, see our explainer on what the Cybersecurity Act in Singapore means for your organisation. Knowing your obligations is the first layer of defence.

So the question I’d ask is not whether your business will be probed, but whether your defences will hold when it is.

Here are the twelve cybersecurity tips that make the difference, starting with the layer attackers exploit most: your people.

1. Turn Every Employee Into a Human Firewall

In my view, your strongest security tool is not software. It is a workforce that pauses before it clicks.

Phishing remains the number one entry point for attackers in Singapore and across ASEAN, because it bypasses technology and targets human instinct: urgency, authority, and fear.

A single staff member entering credentials on a fake login page can hand over the keys to your entire network. That is exactly how Singapore’s largest breach began.

CASE EXAMPLE

SingHealth, 2018. Attackers gained a foothold through a phishing email, moved through the network, and stole the records of 1.5 million patients, including the Prime Minister.

The PDPC issued S$1 million in fines (S$750,000 to IT vendor IHiS and S$250,000 to SingHealth), partly because admin access was not protected by two-factor authentication, per Computer Weekly.

What to actually do

Awareness is a programme, not a one-off email, and here’s the rhythm I’d build:

• Run quarterly phishing simulations. Send safe, fake phishing emails and coach anyone who clicks, without blame.
• Teach the three red flags: unexpected urgency, requests for credentials or payment, and mismatched sender addresses or links.
• Make reporting effortless. Add a one-click “Report phishing” button or a clear inbox so staff can flag suspicious mail in seconds.
• Brief new joiners on day one, and refresh the whole team at least twice a year as scams evolve.

Singapore-specific scams matter too. Train staff to recognise fake government messages, spoofed bank SMSes, and WhatsApp “CEO” requests, and point them to ScamShield for verification.

WATCH OUT

AI has made phishing far harder to spot. CSA reported that around 12% of phishing emails now contain AI-generated content, producing flawless grammar and convincing tone.

“Bad English” is no longer a reliable giveaway. Teach staff to verify the request, not just the spelling. To understand how this technology works, see our primer on AI and machine learning made simple.

2. Kill Weak Passwords With a Password Manager

Stolen and reused passwords are among the most common ways attackers walk straight through the front door.

The problem, as I see it, is human nature. Asked to remember dozens of complex passwords, people reuse one across many accounts, so a single leak unlocks everything.

A password manager solves this elegantly. It generates and stores a unique, strong password for every account, and your team only needs to remember one strong master passphrase.

Build a sensible password policy

Modern guidance has shifted away from forcing frequent, confusing changes. Focus on strength and uniqueness instead:

• Use long passphrases. Four random words such as “river-candle-orbit-mango” beat “P@ss1!” and are easier to recall.
• Make every account unique. No reuse across email, banking, social, and admin systems.
• Deploy a business password manager (for example, Bitwarden, 1Password, or Keeper) so credentials are shared securely, never over chat or email.
• Change passwords on a trigger, not a calendar: immediately after a suspected leak or when a staff member leaves.

PRO TIP

Check whether your business emails have already appeared in known breaches using a service like Have I Been Pwned. If they have, reset those passwords now and switch on multi-factor authentication, which is Tip 3.

For very sensitive accounts, consider passkeys, a newer passwordless method that uses your device to log in. It removes the password entirely, which means there is nothing to phish or reuse.

3. Switch On Multi-Factor Authentication Everywhere

If you do only one technical thing this week, do this. Multi-factor authentication (MFA) is the single highest-impact, lowest-cost control most businesses overlook.

MFA adds a second proof of identity on top of the password, usually a code from an app or a tap on your phone. Even if a criminal steals the password, they still cannot get in.

The SingHealth case is a painful reminder: administrator access without two-factor authentication helped a sophisticated attacker move freely. The lesson scales down to any business.

Where to switch it on first

Roll out MFA in priority order, protecting your highest-value accounts first:

PRO TIP

Prefer an authenticator app (such as Microsoft Authenticator or Google Authenticator) over SMS codes. SMS can be intercepted or SIM-swapped, while app-based and hardware-key methods are far more resistant to phishing.

4. Patch and Update Before Attackers Find the Gapleading source of distributed denia

Most malware in Singapore exploited old, known weaknesses that already had fixes available. The patch existed; nobody applied it.

CSA directly attributed the 67% surge in infected systems to users failing to update and patch vulnerable software, per the Singapore Cyber Landscape 2024/2025 report.

In plain terms, outdated software is an unlocked door with a sign on it. Attackers scan the internet specifically for it.

Make patching boring and automatic

• Turn on automatic updates for operating systems, browsers, and apps wherever possible.
• Keep an asset list. You cannot patch what you forgot you own: laptops, servers, routers, and that one old PC in the corner.
• Prioritise internet-facing systems such as your website, VPN, and email gateway, since these are probed first.
• Replace end-of-life software. Once a vendor stops releasing security fixes, no amount of caution makes it safe.

CASE EXAMPLE

Marina Bay Sands, 2023. A March 2023 software migration left an API unprotected for six months; attackers exploited the gap in October 2023 and exfiltrated the data of 665,495 patrons, later found for sale on the dark web.

In October 2025 the PDPC fined MBS S$315,000, noting that security policies must be applied properly when moving from old systems to new, per Malay Mail and AsiaOne. Migrations and upgrades are exactly when gaps appear.

Websites deserve special attention. If you run on WordPress, outdated plugins are a leading cause of compromise, so keep core, themes, and plugins current. Our guide on building a professional WordPress website covers safe setup from the start.

5. Back Up Your Data the 3-2-1 Way

Ransomware has a simple business model: lock your files, then sell you the key. A clean, tested backup destroys that model.

With reliable backups, a ransomware demand becomes an inconvenience rather than a catastrophe. You restore and move on, instead of paying criminals and hoping.

The gold standard is the 3-2-1 rule, a memorable formula trusted by security teams worldwide.

The offsite, offline copy is the part that defeats ransomware. If a backup is always connected to your network, attackers can encrypt it too.

WATCH OUT

A backup you have never restored is a hope, not a plan. Test a restore at least quarterly to confirm the files actually come back and are not corrupted.

Backup essentials for a Singapore SME

• Automate it. Manual backups get forgotten; scheduled backups do not.
• Encrypt backups, so a stolen drive or cloud account does not leak your data anyway.
• Keep one version history. If malware sits undetected for days, you want a clean restore point from before the infection.
• Document the recovery steps so any team member can restore under pressure, not just one IT person.

6. Give Staff the Least Access They Need

Not everyone needs the keys to everything. The principle of least privilege means each person gets only the access their job actually requires, and nothing more.

Why it matters: if an account is compromised, the damage is limited to what that account could reach. A marketing login should not be able to wipe your finance database.

This single discipline shrinks the “blast radius” of almost every breach.

Put least privilege into practice

• Map roles to access. Decide who needs what, then grant accordingly, rather than giving everyone admin “to be safe“.
• Separate admin from daily accounts. Use a standard account for everyday work and a separate admin account only when needed.
• Review access quarterly. People change roles; their permissions should too.
• Offboard immediately. The day someone leaves, disable their accounts and revoke shared passwords.

CASE EXAMPLE

People Central, 2024. A threat actor sent an extortion email, then deleted databases and exfiltrated the data of 95,000 individuals from this HR software provider, later likely offered for sale on the dark web.

In January 2026 the PDPC fined the company S$17,500, per Baker McKenzie. Tight access controls and rapid detection are exactly what limit this kind of damage.

PRO TIP

Dormant and “ghost” accounts are a favourite attacker target. Keep a simple register of all user accounts and delete anything unused. A forgotten intern login from two years ago is a free way in.

7. Lock Down Email and Stop Business Email Compromise

Email is where most attacks land, and one type quietly drains the most money: business email compromise (BEC).

In a BEC scam, a criminal impersonates a boss, supplier, or client and asks finance to change bank details or rush a payment. No malware needed, just a convincing message and a moment of trust.

IBM found business email compromise and stolen credentials among the costliest and most common attack vectors in the region, alongside phishing, per reporting on the IBM data breach study.

Defences that stop BEC and email spoofing

Combine technical controls with a human verification habit:

• Set up SPF, DKIM, and DMARC. These email authentication records make it far harder for criminals to spoof your domain.
• Add a “verify by a second channel” rule. Any payment or bank-detail change must be confirmed by phone or in person, never by email alone.
• Flag external emails with an automatic banner so staff know when a message comes from outside the company.
• Use advanced email filtering to quarantine suspicious attachments and links before they reach inboxes.

WATCH OUT

Watch for tiny domain tricks. An email from “acc0unts@yourcompany.com” or “yourcompany-sg.com” can look almost identical to the real thing. Train finance staff to inspect the exact sender address before acting on any money request.

8. Secure Every Device, Including Personal Phones

Your data does not live in one building anymore. It travels on laptops in cafes, phones on the MRT, and home computers after hours.

Every one of those devices is a potential entry point, and the rise of remote and hybrid work has multiplied them.

Endpoint security means protecting each of these devices so a lost phone or infected laptop does not become a company-wide breach.

A practical device checklist

• Install reputable endpoint protection (antivirus or EDR) on every company device and keep it updated.
• Encrypt hard drives (BitLocker on Windows, FileVault on Mac) so a stolen laptop reveals nothing.
• Require screen locks and strong passcodes on all phones and tablets that touch company email or files.
• Enable remote wipe through your mobile device management or Google Workspace settings, so a lost device can be erased.
• Set a clear BYOD policy if staff use personal phones for work, separating company data from personal apps.

SINGAPORE INSIGHT

Free public Wi-Fi is convenient and risky. Coach staff to avoid logging into sensitive systems on open networks, or to use a company VPN that encrypts their connection. This matters whenever your team works from cafes, co-working spaces, or overseas.

Devices are also where good security habits become visible to customers. The same care that protects internal data builds the trust that wins business, a theme we explore in seven actionable ways to build trust in an online business.

9. Harden Your Network, Wi-Fi, and Remote Access

Your network is the perimeter of your business. If it is wide open, every other control has to work twice as hard.

The encouraging news is that most network hardening is configuration, not expensive hardware. It is about closing doors you left open by default.

Core network protections

• Change default router and device passwords. Factory passwords are published online and tried first by automated attacks.
• Use a firewall and keep its firmware updated to filter unwanted traffic at the edge.
• Separate your Wi-Fi networks. Put guests and personal devices on a separate network from business systems.
• Secure remote access with a VPN and MFA, rather than exposing internal systems directly to the internet.
• Disable unused services and ports so attackers have fewer ways in.

KEY STAT

Singapore was the seventh most attacked country globally in the fourth quarter of 2024, and the third-largest global source of distributed denial-of-service (DDoS) traffic, according to the Singapore Cyber Landscape 2024/2025 report. A hardened network is your first line of defence against that volume of probing.

Network segmentation is the unsung hero here. By splitting your network into zones, you stop an attacker who breaks into one area from roaming across everything, the same lateral movement that made the SingHealth breach so severe.

10. Vet Your Vendors and Supply Chain

Your security is only as strong as the partners you connect to. A breach at your payroll provider, web host, or marketing tool can become your breach.

CSA highlighted supply chain attacks as a growing risk, where criminals compromise a trusted vendor to reach many customers at once.

CASE EXAMPLE

Ezynetic, 2024. A ransomware attack on this software provider for licensed moneylenders exposed the data of 190,589 individuals, posted for sale on the dark web.

The PDPC pointed to weak password policies and infrequent security audits, ordered the firm to obtain CSA’s Cyber Trust certification, and noted that technology vendors carry a higher duty of care, per Baker McKenzie. When you hand data to a vendor, their hygiene becomes your liability.

How to manage third-party risk

• Ask about certifications. Does the vendor hold CSA Cyber Essentials, Cyber Trust, ISO 27001, or SOC 2? These signal real security maturity.
• Limit what they can access. Give vendors least-privilege access and remove it when the engagement ends.
• Put security in the contract. Require breach notification timelines and data protection commitments in writing.
• Keep an inventory of every tool that touches your data, including the free apps staff signed up for without telling you.

PRO TIP

“Shadow IT“, the unapproved apps and AI tools staff use on their own, is a fast-growing blind spot. Run a quick audit of which cloud services hold your data, and bring them under proper review. You cannot protect data you do not know you are sharing.

11. Write and Rehearse an Incident Response Plan

Hope is not a plan. The businesses that survive a breach are the ones that decided what to do before it happened.

An incident response plan is a simple, written playbook: who does what, in what order, when something goes wrong. In a crisis, it replaces panic with action.

Speed matters enormously. The faster you detect and contain a breach, the less it costs, a point IBM data consistently confirms.

What your plan should cover

• Roles and contacts: who leads, who handles IT, who talks to customers, and the external experts to call.
• Containment steps: how to isolate affected systems quickly without destroying evidence.
• Notification duties: your PDPA obligation to inform the PDPC within three calendar days of a notifiable breach, and to tell affected individuals.
• Recovery process: how to restore from backups and confirm the threat is fully removed.
• A communications template, so you respond to customers and media calmly and consistently.

SINGAPORE INSIGHT

Know who to call in Singapore. Report incidents and scams to the Cyber Security Agency of Singapore, notify the PDPC for personal-data breaches, and make a police report for fraud. Saving these contacts now saves precious time later.

Rehearse it. A short tabletop exercise, where you talk through a realistic scenario as a team, reveals gaps no document can. CSA even offers a free scenario role-play, “Cyber Essentials in Action“, to help SMEs practise.

12. Get Certified and Tap Singapore's Funding Support

Here is the part many businesses miss: in Singapore, you do not have to fund better security entirely on your own.

CSA and Enterprise Singapore have built a clear path for SMEs, from a beginner-friendly certification to co-funding that brings expert help within reach.

Start with the Cyber Essentials mark

The CSA Cyber Essentials mark is designed for SMEs with limited resources. It bundles the fundamentals (the very habits in this guide) into one achievable standard.

CSA has since expanded the Cyber Essentials and Cyber Trust marks to cover cloud, AI, and operational technology security, keeping pace with modern threats. Once your hygiene is solid, the Cyber Trust mark is the next, risk-based step.

SINGAPORE INSIGHT

Certified businesses can access real, practical perks: SMEs are eligible for co-funding through the CISO-as-a-Service scheme to develop a tailored cybersecurity health plan, Cyber Trust holders can get discounted cyber insurance, and certification fees may be supported under Enterprise Singapore’s Enterprise Development Grant.

Funding the tools and the skills

Security software and upgrades can also qualify for support. Many SMEs already use grants to digitalise, and the same mindset applies to security tooling, as covered in our guide to eligible tools under the PSG grant.

The most cost-effective control of all remains training. Building in-house awareness is far cheaper than any breach, and you do not need a degree to start, as we discuss in our article on whether you really need a cybersecurity degree in Singapore.

PRO TIP

Treat certification as a roadmap, not just a badge. Working towards the Cyber Essentials mark gives your team a structured checklist and a shared goal, turning scattered good intentions into a measurable security baseline.

What to Do in the First 24 Hours of a Breach

Even with strong defences, incidents happen. How you respond on the first day shapes everything that follows.

Keep this short sequence somewhere everyone can find it, because in the moment, clear steps beat clever ones.

1. Contain, do not panic. Disconnect affected devices from the network, but keep them powered on to preserve evidence.
2. Assess the scope. Work out what data and systems are affected, and whether personal data is involved.
3. Notify the right parties. Alert your incident lead, and prepare to inform the PDPC within three calendar days if it is a notifiable breach.
4. Preserve evidence. Take screenshots and logs; resist the urge to wipe and rebuild before you understand what happened.
5. Recover from clean backups once you are confident the threat is fully removed.
6. Review and learn. Document the cause and close the gap so the same door cannot be used twice.

WATCH OUT

Resist paying ransoms. Payment funds further crime, breaks no guarantee that you will get your data back, and may carry legal risk. A tested backup is your real leverage, which is why Tip 5 matters so much.

Conclusion

If there’s one idea to carry away, it’s this: strong cybersecurity is built from small, consistent habits, not a single expensive purchase.

The twelve tips in this guide work because they target how breaches actually happen: through people, passwords, unpatched systems, and over-trusted email. Notice how many of Singapore’s worst breaches traced back to the basics. A phishing email at SingHealth. A sloppy migration at Marina Bay Sands. Weak hygiene at vendors like Ezynetic. The fixes were rarely exotic.

That’s genuinely good news for your business. The controls that protect you most- MFA, backups, least privilege, and aware staff- are within reach of any team that decides to act. You don’t have to tackle all twelve at once either. Pick the three with the biggest gap today, perhaps MFA, backups, and phishing training, and build from there.

And remember, in Singapore you’re not on your own. Support from CSA and Enterprise Singapore can help fund the tools, the certification, and the expert guidance to get you there.

The most powerful upgrade of all, though, is knowledge that spreads across your whole team. Every employee who can spot a threat is one more layer of defence, and that’s exactly the layer attackers count on being missing.

Turn your team into that first line of defence. Our Cybersecurity Awareness & Essentials for Workplace Employees & Business Owners course gives your staff the practical skills to recognise phishing, handle passwords and data safely, and respond when something looks wrong- no technical background required. Equip your people before an attacker tests them.