Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Service Advisory

Due to a worldwide Microsoft Outlook disruption, emails to and from CSA may be delayed. We apologise for the inconvenience.

Cyber Security Agency of Singapore
Advisory

Advisory on Recent Uptick in Reported Cyber Incidents

13 November 2026

The Cyber Security Agency of Singapore (CSA) urges all organisations to take immediate steps to strengthen their cyber defences, as cyber threat actors increasingly exploit exposed vulnerabilities and poorly secured systems.

Cyberattacks are increasingly opportunistic. Threat actors actively scan the Internet for vulnerable systems, and organisations can become victims even if they are not specifically targeted. The growing use of Artificial Intelligence by threat actors could further accelerate the discovery and exploitation of vulnerabilities, reducing the time organisations have to secure their systems.

CSA has been closely monitoring these developments. Since September, the average monthly number of reported cyber incidents has been three times the January–August average. These incidents do not appear to be part of coordinated campaigns targeting Singapore, but reflect a broader global trend of opportunistic attacks. Some incidents have also involved compromised third-party suppliers, underscoring the importance of managing supply-chain risks.

Of particular concern is the growing use of Artificial Intelligence by malicious actors globally, which accelerates multiple stages of cyberattacks, from scanning public repositories for exposed credentials and crafting highly convincing social engineering lures, to identifying and exploiting software vulnerabilities more quickly and at a greater scale. This significantly compresses the window organisations have to detect and address vulnerabilities before they are compromised.

This poses an increasing risk to all organisations in Singapore, where they could face operational disruptions, reputational damage, and financial losses from successful cyberattacks.

Key Factors Driving Recent Incidents

Preliminary observations indicate that many recent incidents stem from common security gaps, particularly across third-party systems and exposed digital infrastructure:

  • Unpatched and Exposed Systems: Internet-facing servers, remote access ports, and APIs left unpatched or misconfigured without proper authentication or access controls.

  • Weak Identity and Access Management: Reliance on weak or reused passwords and the absence of Multi-Factor Authentication (MFA).

  • Third-Party and Supply Chain Risks: Vulnerabilities in vendor-managed systems, third-party software dependencies, and external service providers that act as entry points into organisational networks.

  • Social Engineering: Phishing campaigns targeting employees to harvest credentials or deliver malware.

Organisations should take immediate steps to reduce their exposure, followed by longer term sustained measures to strengthen their overall cyber resilience:

Immediate Mitigation Measures

  • Patch Vulnerabilities Quickly: Promptly apply security updates to Internet-facing servers, network appliances, software dependencies, and APIs, prioritising known exploited vulnerabilities.

  • Identify and Secure Internet-Facing Assets: Conduct an urgent audit of all external-facing systems, disable unnecessary services or open remote access ports, and enforce proper authentication and firewall rules.

  • Enforce Multi-Factor Authentication (MFA): Immediately enable phishing-resistant MFA across all privileged accounts, remote access portals, email systems, and cloud applications.

  • Review and Enforce Least Privilege Access: Audit user and service accounts to revoke excessive permissions, remove dormant accounts, and restrict administrative privileges strictly to those who require them.

Longer Term Measures

  • Strengthen Third-Party and Supply Chain Oversight: Assess the security posture of external vendors and service providers, establish clear cybersecurity requirements in vendor contracts, and segment third-party access from core internal networks.

  • Conduct Regular Phishing Simulations and Staff Training: Equip employees to recognise increasingly convincing, AI-assisted social engineering and phishing attempts through ongoing awareness training and simulated exercises.

  • Implement Continuous Monitoring and Vulnerability Management: Establish regular vulnerability scanning, centralised log monitoring, and automated patch management workflows to detect and remediate exposures before threat actors can exploit them.

  • Maintain and Test Business Continuity Plans: Develop, regularly update, and conduct tabletop exercises for incident response and business continuity plans, ensuring offline, immutable backups are in place to recover from disruptions.

  • Protect Internet-Facing Applications: Implement Web Application Firewalls (WAFs), Intrusion Prevention Systems (IPS), and virtual patching solutions to shield Internet-facing applications and reduce exploitation risks.

To help organisations strengthen their cyber resilience, CSA provides tailored toolkits, certification frameworks, and funding support under the SG Cyber Safe Programme:

Organisations may refer to the Cybersecurity Health Check tool [https://smesgodigital.gov.sg/web/CyberHealthCheckCSA (opens in new tab)] to assess their cybersecurity posture and identify areas for improvement.

Organisations are also encouraged to tap on CSA’s CISO-as-a-Service (CISOaaS) programme (https://www.csa.gov.sg/our-programmes/support-for-enterprises/sg-cyber-safe-programme/cybersecurity-certification-for-organisations/ciso-as-a-service-to-develop-cybersecurity-health-plan/ (opens in new tab)) to engage professional consultants to create a tailored cybersecurity plan, with up to 70 percent co-funding available to eligible SMEs.

For deeper technical guidance on mitigating data exposure, organisations should refer to CSA's Advisories on Protecting Yourself and Your Organisation from Data Breaches

(https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2023-001/ (opens in new tab)) as well as the PDPC-CSA Joint Advisory on Data Protection Risks Arising from Insecure APIs (https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-16/ (opens in new tab)).

Should organisations encounter cyber incidents, they can lodge a report to CSA's SingCERT via Cyber Aid (https://www.csa.gov.sg/resources/singcert/cyber-aid/ (opens in new tab)) or contact the Cyber Incident Helpline set up by the Cyber Resilience Centre at 6890 9555 for initial incident triage, advisory support and referrals to relevant service providers and resources.