StarLabs Glossary / Cybersecurity & Network Terms

Ransomware

Malware that locks your files and demands payment to unlock them.

Ransomware is malicious software that encrypts a victim’s files and systems so they cannot be used, then demands a ransom, usually in cryptocurrency, for the decryption key. Many attackers also steal copies of the data first and threaten to publish it, so even businesses with good backups face pressure to pay.

How it works

Ransomware is a business for criminals, and small firms are frequent targets because their defences are often thin. According to CSA’s Singapore Cyber Landscape 2024/2025, ransomware cases reported to the authorities rose by more than 20%, from 132 in 2023 to 159 in 2024.

A typical attack follows a pattern:

  • Getting in. Through a phishing email, a stolen password without MFA, an exposed remote desktop port, or an unpatched VPN or firewall.
  • Spreading. The attacker quietly moves across the network, gathers admin passwords and looks for file servers, NAS boxes and backups.
  • Stealing. Customer records, contracts and finance files are copied out.
  • Encrypting. Often at night or over a weekend, files are locked and a ransom note appears. Connected backups are deleted or encrypted too.

What to do in the first hour

  • Disconnect affected computers from the network (pull the cable, turn off Wi-Fi). Do not wipe or switch them off unless advised, as evidence may be lost.
  • Do not reconnect backup drives until you know the attack is contained.
  • Call your IT provider and change passwords for email and admin accounts from a clean device.
  • Report the incident to SingCERT through CSA’s Cyber Aid tool, and to the police if money is demanded.
  • If personal data may have been accessed or stolen, assess whether you must notify the PDPC and affected people under the mandatory data breach notification rules.

What it means for your business

Recovery depends on preparation. Keep at least one backup copy that ransomware cannot reach, following the 3-2-1 backup rule with an immutable or offline copy. Patch internet-facing systems quickly, turn on MFA everywhere, and consider EDR on every device. Remember that a ransomware attack that exposes customer data is also a PDPA matter. StarLabs can set up protected backups, patching and endpoint protection, and help you restore systems if the worst happens.

Common questions

Should we pay the ransom?

Paying does not guarantee you get your data back or that stolen data is deleted, and it funds further attacks. Talk to the authorities and your IT provider first. Good backups are what give you a real choice.

Can ransomware encrypt our cloud files and backups?

Yes. Synced folders such as OneDrive or Dropbox can sync encrypted files, and backups stored on a connected drive or NAS are often hit. An offline or immutable copy is the safeguard.

Where do we report a ransomware attack in Singapore?

Report it to SingCERT using CSA’s Cyber Aid tool at go.gov.sg/csa-cyber-aid, and make a police report. If personal data is involved, check your PDPA notification duties.

Could you recover if your files were locked tomorrow?

StarLabs can test your backups and close the usual entry points.

Cybersecurity for SMEs →

Sources: CSA press release on Singapore Cyber Landscape 2024/2025, CSA: Report an incident

Reviewed by the StarLabs technical team · Last checked 18 October 2026

← Cybersecurity & Network Terms · ← All terms · Common questions