Ransomware: how Singapore businesses can prevent it, and what to do if hit
Ransomware is the cyber attack that worries business owners most, and with reason. It locks you out of your own systems and demands payment to restore them, and it has hit Singapore businesses of every size and sector. But it is far from unstoppable. With the right preparation most attacks can be prevented, and even a successful attack is usually survivable if you have done the groundwork. This guide explains how ransomware works, how to keep it out, and what your options really are if you are hit, without the scare tactics.
How ransomware works, and why it has got nastier
Ransomware is malicious software that encrypts your files so you cannot use them, then demands a ransom, usually in cryptocurrency, for the key. It usually gets in through something ordinary: a staff member clicking a link in a convincing phishing email, a weak or reused password, or an unpatched system with a known weakness. From there it can spread across your network quickly.
What has changed in recent years is double extortion. Modern attackers often steal a copy of your data before they encrypt it, then threaten to publish it unless you pay, even if you can restore everything yourself. This matters for how you defend, because it means two separate problems: being locked out, and the threat of your confidential data being leaked. Good backups solve the first. Only stopping the attack in the first place solves the second, which is why prevention matters as much as recovery.
How to keep ransomware out
Strong defence is layered. No single measure stops everything, but together these make you a hard target:
- Email and phishing protection. Most ransomware arrives by email, so good filtering plus staff who can spot a phishing attempt stops a large share of attacks at the door.
- Patch everything, promptly. Attackers exploit known weaknesses in unpatched software. Regular managed patching closes those gaps, as in our SecurePatch service.
- Multi-factor authentication and tight access. MFA on email and key systems stops a stolen password becoming a full breach, and limiting administrator access limits how far any attack can spread.
- Endpoint protection and active monitoring. Modern security tools recognise ransomware behaviour and can stop it mid-attack, and active security monitoring means the warning signs get noticed early rather than overnight.
- Staff awareness. Your people are the front line. A team that knows not to click suspicious links or approve unexpected login prompts prevents a real share of attacks.
- Backups you can actually recover from. Backups are what let you restore and carry on instead of being at an attacker's mercy, provided they are recent, tested, and kept where ransomware cannot reach and encrypt them too. Our backup and disaster recovery service is built around exactly this.
What to do if you have been hit
If you are dealing with an attack right now, act calmly and in this order:
- Isolate it. Disconnect affected machines from the network immediately, unplug network cables and turn off Wi-Fi, to stop the ransomware spreading to other systems and your backups. Try not to power machines off entirely, as that can destroy useful evidence, but get them off the network.
- Get expert help quickly. Ransomware response is not a do-it-yourself job. Experienced help early makes the difference between a contained incident and a spreading disaster.
- Report it. Ransomware is a crime. Report it to the Singapore Police and, through SingCERT, the Cyber Security Agency. If personal data has been affected, you may have obligations under the PDPA to notify the authorities and the people affected.
- Recover from clean backups where you can. If you have sound, uninfected backups, recovery usually means restoring from a clean copy rather than dealing with the attackers at all. This is why the preparation pays off.
Should you ever pay the ransom?
Our advice, and that of the Cyber Security Agency, is not to pay. Paying does not guarantee you get your data back, it marks you as a business that pays and invites repeat attacks, and it funds further crime. For most businesses with sound backups, paying is simply not necessary. Payment should only ever be considered as a genuine last resort, when there is no other realistic way to recover, for example when there are no usable backups, the backups themselves were encrypted, and data recovery cannot retrieve the files.
If a business does reach that point, the practical reality is that most have no idea how to proceed, how to even contact the attackers, who typically operate through anonymous channels on the dark web. This is where we can help. As a genuine last measure, CARE can help you make contact with the attackers, negotiate to bring the demand down, and assist with the practical mechanics of converting funds to cryptocurrency and making the transfer. We are upfront that this route carries real risk: there is no guarantee the attackers will honour their side, and it is possible to pay and recover nothing, so we will always exhaust prevention and recovery first. You can read more on our ransomware protection and consult service.
How CARE helps
We help Singapore businesses across the whole picture. Before anything happens, we build the layered defences that keep ransomware out and the backups that make you recoverable, as part of our cybersecurity and managed IT, and as a CSA-licensed cybersecurity provider this is core to what we do. If you are hit, we help you respond, contain it and recover, ideally from clean backups. And in the genuine last resort, we can help you navigate the difficult payment decision honestly rather than leaving you to face it alone. The best time to act, by far, is before an attack, when sensible protection costs a small fraction of an incident.
Worried about ransomware, or dealing with an attack right now? Talk to CARE and we will help you get protected, or get through it.
Frequently asked questions
Can ransomware be completely prevented?
No defence is ever one hundred percent, which is why preparation matters on two fronts: strong layered security to prevent the large majority of attacks, and sound backups so that even if one gets through, you can recover. The aim is to be both hard to hit and quick to recover.
Should we pay the ransom?
We advise against it, as does the Cyber Security Agency, and with sound backups you should not need to. Payment should only ever be a genuine last resort when there is no other way to recover. If a business reaches that point, we can help navigate it, including making contact and negotiating, while being clear there are no guarantees.
If our backups are good, are we safe from the data-leak threat too?
Not entirely, and this is an important point. Backups let you recover from the encryption and downtime, but they do not undo the theft of data in a double-extortion attack. The only real protection against the leak threat is stopping the attack happening in the first place, which is why prevention matters as much as recovery.
How does ransomware usually get in?
Most often through phishing emails, weak or stolen passwords, and unpatched software. That is why email protection, multi-factor authentication, managed patching and staff awareness together stop the large majority of attacks before they start.
We have been hit. Can you help right now?
Yes. Contact us as soon as possible. We can help contain the attack, assess the damage, and work to recover your systems, ideally from clean backups, and advise honestly on every option. Talk to CARE straight away.
Resources