Ransomware Attack on Your Company: What to Do in the First 72 Hours

If ransomware hits your company, disconnect the affected machines from the network, do not wipe or rebuild anything yet, and do not reply to the attackers. Within the first hours, call your cyber insurer’s incident hotline if you have one, lodge a police report (which also alerts SingCERT), and start a written log. Then work out whether personal data was taken: once you determine a breach is notifiable, the PDPC must be told within 3 calendar days. Decisions about customers, contracts and any ransom demand should be made by the board, recorded, and taken with legal and insurer input.

What should the company do in the first hour?

The first hour is about stopping the spread without destroying the evidence that investigators, the insurer and the PDPC will later need.

1. Isolate, do not erase. The Singapore Police Force advises disconnecting infected computers from all network access, storage devices and Bluetooth. Unplug network cables and disable Wi-Fi, but do not reformat machines or restore over them. Ask your IT provider or forensic firm before powering anything off, because memory can hold useful evidence.
2. Protect your backups. Disconnect backup drives and suspend backup synchronisation so encrypted files do not overwrite clean copies.
3. Do not contact the attackers. Do not click links in the ransom note or open a chat with the group. Photograph the note and record the time it was found.
4. Switch to a clean channel. Assume company email and messaging may be monitored. Use phone calls or personal devices for the response team until the network is checked.
5. Call the insurer’s hotline. Most cyber policies require prompt notice and may only pay for forensic or legal firms the insurer approves. Read the notification and consent conditions now, not later. Our guide to cyber insurance for Singapore SMEs explains these conditions.
6. Name a decision-maker. One director should lead, with a small team covering IT, operations, HR, finance and communications.

Who must the company report to, and by when?

Several reporting duties can run at once. Meeting one does not satisfy the others: the PDPC’s own guide states that notifying another regulator or law enforcement agency does not fulfil the PDPA notification duty.

The general PDPA notification framework, including what counts as significant harm, is explained in our guide to mandatory data breach notification under the PDPA. This article focuses on the decisions that are specific to a ransomware attack.

Hours 1 to 24: contain, preserve and keep the business running

• Bring in forensics. The investigators should identify the entry point (often a VPN account without multi-factor authentication, an unpatched firewall or a phishing email), whether data was copied out before encryption, and whether the attacker still has access.
• Reset credentials in the right order. Administrator, VPN, email and cloud accounts first, from a clean device. Revoke the access of any outsourced IT accounts until they are verified.
• Preserve logs. Firewall, VPN, email and endpoint logs may be overwritten within days. Ask vendors to retain them in writing.
• Plan manual operations. Decide how to take orders, pay staff and pay suppliers while systems are down. Ransomware periods are a favourite time for fake “change of bank details” emails, so verify every payment request by phone using numbers already on file.
• Brief staff. Tell employees what happened in plain terms, ask them not to discuss it on social media, and route all customer and media questions to one person.

Hours 24 to 72: assess the data and decide who to tell

By the second and third day, the company needs a working view of what data was on the encrypted systems and whether any was exfiltrated. Many ransomware groups now steal data before encrypting it and threaten to publish it; a leak-site posting or “proof” sample sent by the attackers is strong evidence of exfiltration.

1. Map the data. List the systems hit and the categories of personal data on them: customers, employees, job applicants, next-of-kin. Payroll and HR files often contain NRIC numbers, bank details and medical information; our guide to PDPA obligations for HR and payroll data lists what is typically held.
2. Record the assessment. Write down when the company had credible grounds to suspect a breach, what was checked, who decided and why. The PDPC can ask for this.
3. Check contracts. Pull customer, outsourcing and financing agreements for notice clauses, audit rights and security warranties. Missing a contractual deadline can create a separate claim.
4. Prepare consistent messages. Notices to the PDPC, individuals, customers and staff should tell the same factual story. Do not speculate or admit legal liability; the insurer’s consent may be needed before any admission or offer of compensation.
5. Restore from clean backups. Only after forensics confirm the attacker is out and the entry point is closed. Restoring too early can mean being encrypted twice.

Should the company pay the ransom?

Singapore’s official position is that paying ransoms is strongly discouraged. The police advisory notes that payment does not guarantee decryption or that the data will not be published, and the Government’s Counter Ransomware Task Force report (CSA, November 2022) adds that a company which has paid may be seen as a soft target and attacked again.

The same report notes that, depending on the facts, paying a ransom could contravene the Terrorism (Suppression of Financing) Act 2002, and recommends that government agencies and CII owners notify CSA and the police before any payment is made. Other risks to weigh:

• Insurance consent. Extortion cover, where it exists, normally requires the insurer’s prior written consent. Paying without it may forfeit cover.
• Sanctions. Payments to sanctioned persons or groups may be unlawful in Singapore or in other countries where the company, its bank or its insurer operates.
• No real assurance. A “deletion promise” from criminals is not evidence that the data has been destroyed, so the PDPA notification assessment does not go away.

If the board is considering payment at all, it should obtain legal advice first and minute the reasons. Our article on directors’ duties and personal exposure for cyber risk explains why the record matters.

What should the board minutes record?

A ransomware attack is a board-level event. Directors must act with reasonable diligence under the Companies Act, as explained in our guide to directors’ duties under section 157. A short written record made at the time protects the company and the directors later.

• When and how the incident was discovered, and who was told.
• Containment steps and the forensic firm appointed.
• Notifications made (police, SingCERT, PDPC, insurer, customers) with dates and times.
• The PDPA notifiability assessment and who made it.
• Any ransom demand, the advice received and the decision taken.
• Authority given to named persons to deal with the insurer, regulators and lawyers.
• Next review date for the board.

Example: a distributor locked out on a Friday night

Example: A 40-person electronics distributor finds every file on its shared drive renamed with a strange extension, and a ransom note asking for payment in cryptocurrency within 72 hours. The attackers attach a sample of payslips to prove they hold HR data.

The finance director, who chairs the response, disconnects the server and backup drive, calls the insurer’s hotline from her mobile, and lodges an online police report. The insurer’s panel forensic firm finds the attacker logged in through the IT vendor’s remote access account, which had no multi-factor authentication. Because payslips contain NRIC and bank account numbers, the company determines on day two that the breach is notifiable, and notifies the PDPC and the affected employees within the 3-day window. The board minutes that it will not pay, restores from an offline backup taken five days earlier, and sends notices to two customers whose contracts require incident notification within 48 hours. The vendor’s role is a separate question, covered in our guide on who is liable when your IT vendor is hacked.

What happened when ransomware hit Singapore companies?

CH Offshore (PDPC decision, 2024). In its published decision, the PDPC recorded that CH Offshore Ltd., an offshore support vessel operator, discovered on 29 March 2023 that its shared drives had been encrypted by the ransomware-as-a-service threat the decision names as “Alpha aka Blackcat”. The company disconnected the servers, engaged IT forensics and notified the PDPC on 3 April 2023. Investigators found the attacker likely entered through VPN accounts belonging to an employee and the outsourced IT vendor; the firewall had not been patched since December 2021 and multi-factor authentication was not used for remote VPN access. Data of 5,906 employees, former employees, next-of-kin, directors and others was affected, including health and financial information of 1,425 seamen. The PDPC first proposed a S$27,000 penalty and, after accepting some of the company’s representations, imposed S$18,000, with directions to improve patching, network segmentation and logging.

Genki Sushi (PDPC decision, 2019). As reported by Vulcan Post and others in August 2019, the PDPC fined Genki Sushi S$16,000 after a ransomware attack in 2018 on a server running its payroll and attendance software. Names, NRIC numbers, bank account and salary details of about 360 current and former employees were affected. The PDPC found weaknesses including a firewall that did not filter external threats, no penetration testing in the preceding 12 months and no evidence of patching.

Both cases show the pattern regulators look at after a ransomware attack: remote access controls, patching and periodic security reviews. Prompt notification and cooperation are treated as mitigating, but the penalty reflects what was in place before the attack. Our article on PDPC penalties and real cases compares more decisions.

Frequently asked questions

Should we switch off the infected computers?

Disconnect them from the network first. Whether to power down is a forensic judgement, because shutting down can erase evidence held in memory. Ask your forensic firm or IT provider before switching off servers.

Do we need to report to the PDPC if only our own files were encrypted?

Only if personal data was affected and the breach meets the significant harm or 500-person threshold. Encrypted files that contain personal data still count as unauthorised access; the PDPC made this point in the CH Offshore decision. Document the assessment either way.

Does a police report count as notifying the PDPC?

No. The police report also alerts SingCERT, but the PDPA notification is a separate duty with its own deadline and must be made to the PDPC directly.

Can we tell affected customers before we notify the PDPC?

The PDPC’s guide says individuals should be notified at the same time as or after the PDPC. Where a breach is likely to attract widespread public attention, organisations are strongly encouraged to notify and seek advice from the PDPC before notifying individuals.

If we pay, will the attackers delete our data?

There is no guarantee. Authorities warn that paying does not ensure decryption or prevent publication, and data may already have been sold or copied.

Official sources: Singapore Police Force, ransomware advisory; SingCERT incident reporting form; PDPC, Guide on Managing and Notifying Data Breaches; CSA, Counter Ransomware Task Force report; CSA, Cybersecurity Act reporting forms; PDPC decision, CH Offshore Ltd. [2024] SGPDPC 2.

Cyber insurance itself should be arranged through a licensed insurer or insurance broker.

Need help after a ransomware attack?

If your company, or you as a director or shareholder, is dealing with a ransomware attack, a data extortion demand or the claims that can follow, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if a claim is made against your company or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection, cybersecurity and regulatory matters. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.

The Raffles Corporate Services Editorial Team, Raffles Corporate Services