Why data breaches are surging in Singapore, and why firms owe victims more than an apology

In Singapore, a surge of data breaches has recently occurred, leaving many organisations vulnerable. Victims have received notifications following these breaches, which spanned various sectors including telemedicine, healthcare, telco, media, aviation tech, and even potential digital platforms. Personal data such as NRIC numbers, names, dates of birth, and phone numbers were exposed in most cases, though payment card details remained secure.

This wave of data breaches has raised questions about why there has been such an increase in frequency and speed. The root cause is a mix of opportunistic scanning for system misconfigurations and flaws, vendor supply-chain vulnerabilities, and coordinated threat campaigns. A significant contributor is artificial intelligence, which has expedited the discovery of system vulnerabilities.

Google's Threat Intelligence Group reported that the number of disclosed vulnerabilities nearly doubled in 2026, with exploitation rates rising from an average of 10.5 per month in 2025 to 18 per month between January and August. The mean time to exploit a vulnerability has become as short as negative seven days, meaning hackers can exploit flaws before patches are released.

The Singapore Cyber Security Agency (CSA) highlighted this AI-driven threat landscape in a report, noting that malware-infected systems in Singapore more than doubled from 117,300 in 2024 to over 284,300 in 2025. This rapid acceleration of cyberattacks has left many organizations scrambling to protect their customers, with minimal beyond the standard compliance-driven notices.

Experts argue that waiting for attacks to happen before upgrading defenses is no longer a feasible strategy. To combat this surge in AI-accelerated cyberattacks, government leaders and cybersecurity firms in Singapore are advocating for organizations to "fight AI with AI," urging for faster, AI-driven responses to cyber threats.