Cyberattack response for companies in Singapore
Evidence, reports, counsel, insurance and public communications after a cyberattack in Singapore.
El cuerpo del artículo no está disponible en este idioma; se muestra el inglés.
Use this checklist when a company operating in Singapore suspects an attack. Choose the jurisdiction from the legal entity, affected information and operations; the reading language does not determine which law applies. Sources checked on 20 October 2026. This is a Mithril editorial workflow, not an official filing form. Confirm applicable duties with qualified counsel.
## 1. Establish the response team and preserve facts
Name an incident commander, technical lead, legal reviewer, communications owner and finance contact. Choose a trusted contact channel if the corporate account or email system may be compromised. Authorize the technical scope before collection or changes. Preserve supplied originals, acquisition times, time zones and hashes; keep summaries and translations as separate versions.
Prepare a minimum factual packet: discovery and awareness times, affected services, confirmed impact, suspected impact, evidence references, open questions and current owners. Unknown leakage or an uncertain person count stays unknown. Run technical response, counsel, reporting, communications and insurance in parallel; an unfinished investigation must not silently consume another task’s deadline.
## 2. Check local reporting routes and deadlines
Assess whether the PDPA significant-harm or significant-scale criteria make the breach notifiable. Once a notifiable breach is determined, notify the PDPC as soon as practicable and no later than three calendar days. Assess notice to affected individuals separately. [PDPC — Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf)
SingCERT’s Cyber Aid accepts Singapore-based cybersecurity incident reports. Its technical incident route is separate from a PDPC notice and a police complaint. [CSA SingCERT — Cyber Aid](https://www.csa.gov.sg/resources/singcert/cyber-aid/)
Record when the notifiability determination was made; do not turn the three-day notification rule into permission to postpone assessment. Check sector and Cybersecurity Act obligations for the relevant organization.
## 3. Brief counsel and review insurance early
Give counsel a restricted brief with the factual timeline, source inventory, known gaps and jurisdiction questions. Verify professional identity, conflicts, engagement scope and fees. Ask the policyholder’s insurer or broker about notice timing, panel providers and any preapproval before commissioning work. Separate notification from a later claim, coverage decision or payment. Record evidenced costs and uncertain losses without promising reimbursement.
## 4. Prepare public communications and direct notices
Prepare one approved factual version for each audience. A public statement should cover confirmed service impact, actions being taken, what remains under investigation, protective steps, a verified contact route and the next update. Do not invent attribution, promise a recovery date or describe unobserved exfiltration as “no data lost”. A press release does not automatically replace direct notices required by law or contract.
Draft structure: “We identified [confirmed event] on [time and zone]. [Confirmed impact]. We are taking [approved actions]. We are investigating [unknowns]. Affected people can [reviewed protective steps]. Contact [verified route]. The next update is planned for [approved time].” Replace every placeholder, review the exact version and record approval before publication.
## 5. Use the Agent preparation plan
The proposed Mithril Agent/Registry integration defines 12 preparation and tracking capabilities: evidence inventory, source-linked timeline, next actions, obligation review, recipient-specific drafts, counsel briefs, communications, loss schedules and receipt reconciliation. This enterprise workflow is planned. Publishing this guide does not make it an available executor or an official reporting connector. Authorized people submit and publish through the appropriate channels; any future delegated connector needs separate qualification.
## 6. Download the country process
The BPMN 2.0 file is an authored, non-executable reference with five concurrent workstreams, human decisions, review escalation and accepted handoffs. It includes this country’s source context, not an official authority process. The current Mithril execution subset does not implement every element in this model.
- [Download BPMN for Singapore (English)](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/sg/en.bpmn)
- [Read the planned capability contract](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/capabilities.json)
- [View artifact hashes and versions](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/manifest.json)
## 7. Keep an action and receipt ledger
For each action, record the recipient and purpose, accountable owner, source and trigger for a candidate deadline, confirmed review time, approved payload/version, dispatch record, official receipt and next step. Submission, receipt, acceptance, coverage and recovery are different outcomes. Reconcile an unknown result before retrying. Close operational response only after recovery approval and accepted ownership of continuing legal, regulatory and insurer work.
## Official sources for this country
- [PDPC — Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf)
- [CSA SingCERT — Cyber Aid](https://www.csa.gov.sg/resources/singcert/cyber-aid/)
[Compare the other country guides](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en)