Why data breaches are surging in Singapore, and why firms owe victims more than an apology

SINGAPORE – “We are writing to inform you of a data breach that involved some of your personal information…”

So begins the standard notification sent to some victims of recent data breaches.

Over the past month, these alerts have flooded inboxes following an unprecedented spate of data breaches in Singapore.

From telemedicine provider Doctor Anywhere and Fullerton Health to telco M1, SPH Media, global aviation tech vendor Amadeus (which compromised Singapore Airlines’ passenger records), Agency for Integrated Care, and possibly Dementia Singapore’s digital platform, many high-profile organisations in Singapore have had their sensitive customer data exposed.

Even though direct payment card and banking details were uncompromised in nearly all of the recent cases, the exposure of personal data – including NRIC numbers, full names, dates of birth and phone numbers – hands criminals the key details for targeted impersonation scams and social engineering.

The recent wave in Singapore coincides with cyberstrikes across Europe that crippled cold-chain infrastructure of supermarkets and blood banks, spotlighting an increasingly brazen wave of digital threats that carry real-world consequences.

With data leaks surfacing continuously since late October, many are asking: Why so many now, why in such quick succession, and what are companies doing to protect customers like me beyond sending us those check-the-box, compliance-driven notices?

Why attacks are outpacing defences

Singapore’s incidents stemmed from a mix of opportunistic scanning of system misconfigurations and flaws, vendor supply-chain vulnerabilities and coordinated threat campaigns.

What has changed in recent times to trigger this new wave of attacks? A primary contributor is artificial intelligence, which has sped up the discovery of system vulnerabilities.

In its latest report, the Google Threat Intelligence Group noted that the number of disclosed vulnerabilities more than doubled in 2026, jumping from 5,045 in January to 10,477 in July, before climbing further to 10,740 in August.

Active exploitation has surged in tandem, rising from an average of 10.5 vulnerabilities exploited per month in 2025 to 18 per month between January and August.

Mandiant’s M-Trends 2026 report – drawn from over 500,000 hours of global incident investigations in 2025 – reveals that the mean time to exploit a vulnerability has reached negative seven days.

This means threat actors are routinely exploiting software flaws a full week before the vulnerabilities are publicly disclosed or vendor fixes are released.

SPH Media said the breach it experienced involved AI, highlighting the emerging threat of AI-enabled reconnaissance, which allows attackers to probe multiple system misconfigurations at lightning speed.

Even before the incident, the writing was already on the wall. A Cyber Security Agency of Singapore’s (CSA) report published in June described a threat landscape defined by AI-driven speed, scale, and sophistication. It noted that malware-infected systems in Singapore more than doubled from 117,300 in 2024 to over 284,300 in 2025.

These figures shatter a longstanding assumption that businesses have a buffer of time to test and roll out security patches. Historically, this belief led many organisations to delay software upgrades and defer fixes, especially non-critical ones, to save money and avoid operational downtime.

“These practices were accepted in the past as defence relied heavily on ‘security through obscurity’,” said Vignesa Moorthy, founder and CEO of managed internet and security services provider ViewQwest, referring to the assumption.

“Deferring an upgrade often means running unsupported software that receives no fixes at all. In an environment where flaw discovery is automated, faster and cheaper, that old gamble no longer holds,” he added.

Increasingly, cyberdefenders are making containment decisions under extreme time pressure – frequently with incomplete forensic data – to gauge the full blast radius of an attack across both the organisation and its supply chain. Their response has to be automated to match the speed of incoming attacks.

Fight AI with AI 

Government leaders in Singapore and major cybersecurity firms have issued urgent calls for organisations to “fight AI with AI” to counter the surge in AI-accelerated cyberattacks.

In the weeks leading up to the late-October 2026 breach wave, Coordinating Minister for National Security K. Shanmugam made adopting AI for defence a central pillar of Singapore’s refreshed Cybersecurity Strategy 2026.

Speaking at the opening of Singapore International Cyber Week in October, Shanmugam said: “Singapore will seek to act earlier, act at national scale and act at the speed of the threat.”

At the same conference, Minister for Digital Development and Information Josephine Teo also urged cyberdefenders to counter automated threats at scale using AI, but cautioned that human oversight and accountability cannot be outsourced to machines.

Even before this, CSA has been backing those calls with funding. Through its annual CyberCall innovation challenge, the agency recently awarded $5.6 million to 13 local projects from its 2025 cohort to build AI-powered threat-hunting tools.

The newly opened CyberCall 2026 goes further, seeking solutions that can automatically detect and respond to fast-moving intrusions, spot fake aircraft tracking signals that disrupt aviation operations, and help small businesses manage cybersecurity on their own.

Businesses must heed these warnings.

For instance, AI can be used to safely test the cyberdefences of an organisation by autonomously hacking to find vulnerabilities before hackers do, and verifying fixes for those vulnerabilities.

If the recent wave of breaches proves anything, waiting for attackers to strike before upgrading defences is no longer viable.

What businesses owe consumers 

Stronger technical defence is only half the solution. Businesses and regulators have much to do to protect consumers.

When breaches do occur, customers in many cases are forced to shoulder the burden of identity and fraud defence on their own.

Businesses must move beyond sending out boilerplate compliance notices and start offering customers effective remediation. That would require a major shift, but it is only fair that they do so.

Organisations have far greater resources than individuals to shoulder the financial fallout of a breach caused through no fault of the consumer’s. 

Possible remedies include providing affected customers with paid access to monitoring tools that alert them if their leaked NRIC, e-mail address or phone number surface in illicit data dumps.

This will help to mitigate the immediate threat of fraudulent loan applications, impersonations or account takeovers as one’s NRIC, full name and date of birth cannot be cancelled or reissued like a credit card.

Instead of asking users to stay vigilant and figure out security settings on their own, breached companies should also roll out extra default safeguards to protect customer accounts.

These safeguards include mandating password changes or the use of Singpass when customers log in after a data breach.

Regulators, too, can do their part to require baseline post-breach restitution, in addition to the mandatory notifications, to ensure service providers are directly accountable when that trust is broken.

For instance, regulators could mandate paid access to identity monitoring tools that alert affected victims of the extent of their personal data exposure.

Another post-breach restitution could be the creation of a priority, toll-free helpline staffed by trained fraud specialists to help victims freeze compromised accounts and liaise with law enforcement to crack down on impersonation attempts.

While the recent spate of data breaches is less about a sci-fi rogue AI breaking encryption and more about systemic cyber-hygiene failures, the lesson is clear: Firms need to step up their cyber defences now before it is too late. And they cannot simply wish victims “all the best” when their hygiene standards slip.