Singapore Is Winning the Cybersecurity Race. So Why Are So Many SMEs Still Paying Ransom? 

Singapore has long been recognised as one of the world’s leaders in cybersecurity. Yet despite sustained government investment and support programmes, many local small and medium-sized enterprises (SMEs) continue to negotiate with ransomware attackers instead of relying on preventative cybersecurity measures.

Across the Asia-Pacific, 85% of organisations choose to pay ransom demands following an attack. More strikingly, Singapore ranks among the countries with the highest rates of ransomware payments, with many SMEs choosing negotiation—either directly or through third-party specialists—to restore operations as quickly as possible.

Why are businesses in one of the world’s most digitally advanced economies still choosing to pay cybercriminals rather than invest in long-term resilience?

Industry experts say the answer lies in a combination of financial pressure, operational urgency, and an increasingly sophisticated ransomware landscape.

When Survival Takes Priority Over Prevention

For many SMEs, cybersecurity is often viewed through the lens of immediate business survival rather than long-term resilience.

With limited financial resources, even a few days of operational downtime can have serious consequences.

For SMEs, downtime can translate directly into lost revenue, strained client relationships, and potential contractual penalties, said James Yip Gheng-Ho, Senior Product Manager, ICT Core Skills at NTUC LearningHub.

Operating on thin margins, many businesses simply cannot afford prolonged disruptions. As a result, paying a ransom may appear to be the fastest route to restoring operations.

This same short-term mindset also contributes to the underutilisation of many government cybersecurity initiatives available to SMEs.

According to Goutama Bachtiar, Research Fellow at Cloud Security Alliance, many businesses continue to see cybersecurity resilience as an expense rather than a business survival strategy.

The declining average ransom payment reinforces that perception.

Median ransom payments reportedly fell from more than S$978,000 in 2024 to just over S$470,000 in 2025. For some businesses, this creates the impression that paying is a manageable, one-off cost.

By comparison, investments in endpoint detection, continuous monitoring, employee awareness training, and regular security assessments require ongoing funding, with benefits that may not be immediately visible.

As Charmian Aw, Partner at Hogan Lovells Cadwalader, noted, these long-term investments are often perceived as expensive and difficult to justify.

The Ransomware Cycle Becomes Harder to Escape

Unfortunately, paying a ransom rarely marks the end of the problem.

Modern ransomware has evolved well beyond encrypting data. Attackers increasingly combine encryption with stolen data, public exposure threats, and regulatory pressure in what cybersecurity professionals describe as “double extortion.”

According to the Semperis 2025 Global Ransomware Risk Report, 66% of Singapore organisations experienced attackers threatening to report them to regulators—the highest reported rate globally.

James explained that combining data encryption with regulatory threats creates both psychological and legal pressure, making it significantly harder for SMEs to make clear decisions during an attack.

Ciara O’Leary, Associate at Hogan Lovells Cadwalader, added that many SMEs still lack mature cybersecurity frameworks and tested incident response plans, leaving them less prepared to respond confidently during a crisis.

At the same time, successful ransom payments continue to incentivise cybercriminals.

“Cybercriminals are financially motivated. If extortion appears effective, this only encourages them further,” she said.

Even then, paying does not eliminate regulatory exposure.

Charmian noted that organisations may still face enforcement action or legal liability if investigations determine they failed to implement adequate cybersecurity measures.

According to Goutama, the consequences often emerge gradually rather than immediately, making the long-term damage easy to underestimate.

Paying Doesn’t Guarantee a Fast Recovery

Many organisations assume paying a ransom will quickly restore operations.

However, the data suggests otherwise.

The Sophos State of Ransomware 2025 report found that although around half of affected Singapore organisations paid the ransom, only 53% recovered within a week—down from 77% the previous year.

Recovery costs also remain substantial.

Excluding the ransom itself, the average recovery cost for Singapore organisations reached US$1.54 million in 2025, according to Sophos.

Beyond the financial impact, businesses also face reputational damage, weakened customer trust, and increased scrutiny from partners and regulators, James said.

The broader implications extend beyond individual companies.

James pointed to incidents such as the Toppan Next Tech ransomware attack, where a single compromised supplier affected multiple regulated sectors, illustrating how supply-chain vulnerabilities can undermine confidence across industries.

“If 85% of APAC organisations pay ransoms, and Singapore ranks among the highest globally for ransomware risk, it sends a warning signal to international investors and business partners,” he said.

If ransom payments become normalised as simply another cost of doing business, Singapore’s reputation as one of Asia’s most trusted digital economies could gradually be weakened.

Building Resilience Instead of Paying Ransoms

Experts agree that breaking the ransomware cycle requires organisations to shift from reactive recovery to proactive resilience.

Charmian believes cybersecurity should be treated as a governance issue rather than solely an IT responsibility.

This includes clear executive accountability, regularly tested incident response plans, and tabletop exercises involving legal, operational, and business leaders—not just cybersecurity teams.

Goutama recommends several foundational principles before organisations develop their cybersecurity roadmap:

• Assume an attack will happen rather than asking if it will.
• Treat resilience as part of business architecture, not an insurance policy.
• Build security on Zero Trust principles from the outset.
• Invest across detection, response, recovery, and restoration—not prevention alone.

James also emphasised that people remain one of the most important investments organisations can make.

He recommends that SMEs:

• Invest in employee cybersecurity awareness and ongoing skills development.
• Strengthen supply-chain cyber governance through vendor risk assessments and contractual cybersecurity requirements.
• Take greater advantage of government-supported cybersecurity training and certification programmes.
• Foster a culture where paying a ransom is considered the last resort rather than the default response.

Although these investments require sustained commitment, Ciara believes they ultimately protect organisations from far greater financial and operational consequences over time.

Final Thoughts: Rethinking Singapore’s Fight Against Ransomware

As Singapore continues building a more connected digital economy, ransomware has evolved from an IT problem into a broader business and governance challenge.

For SMEs, the real question is no longer how quickly operations can be restored after an attack, but how effectively they can prepare before one occurs.

Breaking the ransomware cycle will require organisations to move beyond short-term survival decisions and invest in resilience that protects their customers, supply chains, and long-term competitiveness.

In an increasingly hostile cyber landscape, resilience—not ransom payments—may prove to be the strongest defence.

Editor’s Note:

This article was contributed by NewInAsia Senior Editorial Fellow Le Ha Phuong (Nora), a freelance podcaster and former radio producer who creates current affairs content by blending expert insights with engaging storytelling.

In this piece, she explores why many Singapore SMEs continue to pay ransomware demands despite growing cybersecurity support, examining the financial pressures, evolving cyber threats, and resilience strategies that could help businesses break the ransomware cycle.

To pitch your story or share your perspectives on AI, fintech, digital transformation, or innovation across Asia, contact the NewInAsia editorial team.

Read the Chinese article here.

Related posts:

The Real AI Advantage Isn’t Smarter Models — It’s Who Governs the Data Behind Them After Scaling 100+ AI Products in High-Stakes Industries, Trust Became the Real Bottleneck How Paul Lim Is Bridging the Tech Gap for Singapore’s Elderly The Rise of “Paper-Tiger” Cybersecurity: Why Compliance No Longer Guarantees Resilience