Reports of Ransomware Incidents by Singapore-based Companies and Legislation on Ban of Ransom Payments
Ministry of Digital Development and InformationSpeakers
Summary
This question concerns ransomware incident statistics among Singapore-based companies and the potential legislation of a ban on ransom payments. MP Gerald Giam Yean Song inquired about incident breakdowns by company size and the Ministry’s assessment of the benefits and impacts of such a ban. Minister for Digital Development and Information Josephine Teo reported that an average of 141 incidents occurred annually from 2022 to 2024, with 60% involving small and medium enterprises. She stated the Government strongly discourages ransom payments, as they provide no guarantee of data recovery and may lead to repeat attacks. Minister for Digital Development and Information Josephine Teo added that the Ministry is currently assessing the effectiveness of a legislative ban while considering risks such as pushing payments underground.
Transcript
39 Mr Gerald Giam Yean Song asked the Minister for Digital Development and Information (a) how many ransomware incidents have been reported by Singapore-based companies in the past three years, with a breakdown by company size; (b) whether the Ministry plans to legislate a ban on ransom payments; and (c) what is the Ministry's assessment of the net benefit of such a ban, balancing reduced criminal funding against business impact.
Mrs Josephine Teo: On average, there were 141 ransomware incidents reported to Government agencies annually between 2022 to 2024. Around 60% of these incidents were reported by small and medium enterprises1. The rest were reported by larger enterprises as well as non-profit organisations.
Singapore strongly discourages the payment of ransoms to ransomware actors. These attackers are criminals. Payment does not guarantee restoration of access to affected systems and data or prevent stolen data from being published. Organisations that have paid up may also be viewed as "soft targets" and prone to repeat attacks. Instead, we encourage everyone to adopt good cyber hygiene practices to better protect their systems and data against ransomware. We have made resources available at the Ransomware Portal to help them better protect themselves.
We are aware that some countries, such as the United Kingdom, are considering legislating a ban on ransom payments. The aim is to disincentivise ransom payments and, in so doing, cut off an important source of criminal funding for the ransomware industry. However, there are also concerns ransom payments may simply be pushed underground. We are therefore continuing engagements with our counterparts to better assess the effectiveness of legislating a ban.