Three in every five Singapore organisations targeted by ransomware in the past 12 months said the attackers used AI, compared with 40% globally, according to Semperis.
In total, 98% said AI was involved in the attack in some way, whether on the attacker’s side, the defender’s side, or both.
In the first half of 2026, global organizations across the United States, United Kingdom, France, Germany, Italy, Spain, Singapore, Canada and Australia participated in a detailed survey on their experience with ransomware.
To conduct this study, Semperis partnered with experts at Censuswide, an international market research consultancy headquartered in London. Censuswide surveyed 1,200 IT and security professionals across multiple industries, including finance, critical infrastructure, federal government, healthcare, IT and telecommunications, manufacturing, transportation, and state and local government and education (SLED).
There were 100 respondents each from Singapore and Australia, all representing organisations with 500+ employees. Respondents include CISOs, CIOs, CTOs, IT directors, and cyber directors.
Findings from Singapore respondents show that attackers are using AI at 1.5 times the global rate, and 42% also said attackers manipulated or exploited an AI agent or system inside their own organisation.
Attackers increasingly threaten to victimise companies’ staff and their families. Among organisations that were threatened, 56% reported threatening texts, letters or packages sent to home or office, and 41% reported threats against family members or friends.
AI defences help, but not consistently as 49% successfully used AI to detect or respond to the attack and 28% had AI tools in place that failed or only partly worked.
Identity systems were targeted in more than nine in 10 attacks — 92% said attackers exploited or targeted identity infrastructure, including Active Directory (52%), Entra ID (48%) and Okta (37%). The global figure is 87%.
Further, business costs are high as 52% reported business disruption or revenue loss, and 47% had cyber insurance cancelled or premiums raised. 26% paid a ransom.
Looking ahead, evolving threats, including AI-based threats, were named the biggest challenge to operational resilience over the next 12 months (50%).
“Attackers are using AI against Singapore organisations more often than the global average. And the fact that attackers manipulate internal AI agents shows that the risk is not limited to AI in the attackers’ hands,” said Gerry Sillars, Semperis VP in Asia-Pacific and Japan.
“Organisations need to treat their own AI agents as part of the attack surface, with the same identity controls, permissions and monitoring as any privileged account,” said Sillars.
Last year, 66% of Singapore organisations said hackers threatened to file regulatory complaints against them if incidents went unreported.
This year, the most common threats were blackmail, extortion or public shaming (47%) and data erasure, destruction or release (45%), followed by system lockouts or operational sabotage (37%).
Attackers also went after staff directly. Among organisations whose attackers used threats, 14% also reported threats of abduction.
“The bad guys are always evolving their tactics,” said Mickey Bresman, Semperis CEO.
“When the initial wave of ransomware attacks began, most focused on data encryption,” said Bresman. “Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw the double extortion: encryption coupled with data theft and threats to expose or sell that data. So, it makes sense that we’ll continue to see attackers trying to find more ways to make victims pay.”
Even though identity infrastructure is a prime target for threat actors, identity continues to be at risk in most organisations. Ninety-two percent of ransomware attacks targeted or exploited the identity system. Only 54% of companies maintain dedicated identity backup systems; and less than half automate identity system recovery.
Singapore organisations cited cross-team communication gaps (49%), too many disparate tools (38%), and outdated response plans (37%) as the biggest blockers to effective crisis management and response.
“Organisations should back up and rehearse recovery of the identity layer as well as data and applications, and build staff safety and law-enforcement contact into their crisis plans,” Sillars added. “Regular tabletop exercises are the quickest way to find out whether the plan works and whether the teams involved can communicate under pressure.”
Click Here For The Original Source.
——————————————————–
