iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware is a serious and growing threat across Southeast Asia, but there is no single reliable count of victims. INTERPOL’s 2025/2026 assessment reports more than 135,000 ransomware-related attacks in the Asia and South Pacific region in 2024, while Kaspersky recorded 135,274 ransomware attempts in Southeast Asia that year. Those figures describe different things: neither is a census of people or organisations successfully victimised. Vendor detections put Indonesia highest, followed by Vietnam, the Philippines and Malaysia; Singapore’s official reports show that lower vendor detection counts do not mean no risk.
How bad is ransomware in Southeast Asia?
The evidence points to substantial ransomware activity, with a major caveat: the available figures use different measurement methods. INTERPOL’s assessment, covering January 2024 to March 2025, says the Asia and South Pacific region recorded more than 135,000 ransomware-related attacks in 2024. Kaspersky’s separate count, reported by Singapore Business Review, is 135,274 ransomware attempts detected in Southeast Asia in 2024.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Smart Keeper USB-C Port Locks with Key, 4 Blockers 1 Key | $34.82 | Buy on Amazon |
The counts should not be added together or described as 270,000 victims. INTERPOL’s regional attack figure and Kaspersky’s vendor detections are not the same measure; detections can include attempts that were blocked, while official case totals depend on victims reporting incidents. The figures are best read as indicators of scale and exposure, not a unified victim count.
Which Southeast Asian countries had the most detected attempts?
Kaspersky’s 2024 dataset, as reported by Singapore Business Review in 2025, shows the following country pattern. These are vendor detections of attempts, not confirmed successful compromises.
#1 Best Overall
- Bundle: 4 locks + 1 key.
- Easy to Use: It can be installed by hand.
- All-Purpose Key: A common key can be used to unlock 9 different products within the Essential series.
| Country | Kaspersky ransomware attempts detected in 2024 | What the figure means |
|---|---|---|
| Indonesia | 57,554 | Highest count in this dataset; a count of detected attempts, not confirmed victims. |
| Vietnam | 29,282 | Second-highest count in this dataset; a count of detected attempts, not confirmed victims. |
| Philippines | 21,629 | Third-highest count in this dataset; a count of detected attempts, not confirmed victims. |
| Malaysia | 12,643 | Detections rose 153% year over year in Kaspersky’s 2024 data. |
| Singapore | 208 | A vendor-detection count; it is not comparable to Singapore’s separately reported official case total. |
This dataset covers the five countries listed; it does not provide a comparable figure for every Southeast Asian nation. The relatively small Singapore vendor count should not be read as proof that ransomware is rare there: Singapore’s Cyber Security Agency (CSA) says victims do not always report incidents, so its official case count is also an underestimate.
What do Singapore’s official figures add?
CSA reported 159 ransomware cases in Singapore in 2024, up from 132 in 2023, and 165 in 2025. These are reports to authorities, not vendor detections, so they cannot be directly compared with Kaspersky’s country totals. CSA says small and medium-sized enterprises (SMEs) were disproportionately affected, particularly in wholesale and retail, manufacturing, and construction. Its ransomware portal is the official Singapore starting point for incident information.
CSA also reported 284,300 infected systems in Singapore in 2025, a 142% increase from 2024. That is a separate measure from ransomware cases: it should not be treated as a ransomware victim count. CSA describes a continuing threat from malware-as-a-service and internet-connected devices with unpatched firmware or default passwords. Its 2025 initiatives announcement also describes support for SMEs through a Cyber Resilience Centre, health checks and recovery assistance.
Why are ransomware gangs targeting the region?
Ransomware has become an industrial service
INTERPOL identifies digitalisation, organised criminal networks and ransomware-as-a-service as drivers of the escalating regional threat. In this model, affiliates can use rented infrastructure and tools rather than build every capability themselves. That can make attacks easier to scale, while uneven cybersecurity maturity leaves some organisations more exposed. This is a business model and an exposure problem; it does not establish that one gang controls ransomware activity across Southeast Asia.
INTERPOL Cybercrime Director Neal Jetton said the region’s cyber threat landscape is evolving rapidly, with criminals using “artificial intelligence, ransomware-as-a-service models and sophisticated social engineering techniques on an industrial scale.” The statement appears in INTERPOL’s 17 June 2026 announcement.
Everyday weaknesses can create openings
CSA’s Singapore assessment points to a practical route into organisations: malware-as-a-service and poorly secured connected devices. Unpatched firmware and default passwords on IoT devices can leave avoidable entry points. This helps explain how a business may be exposed, but the regional figures do not show that any one vulnerability caused the incidents counted.
What is at stake beyond encrypted business files?
Ransomware can interrupt public services as well as disrupt private companies. INTERPOL’s 2026 assessment says the ransomware incident at Indonesia’s National Data Centre disrupted more than 280 essential services. The case illustrates the possible operational consequences when systems that support public functions are affected.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →That risk should be kept distinct from state-linked cyber espionage. Singapore’s cyber-landscape reporting says Southeast Asian advanced persistent threat activity primarily targeted governments, critical infrastructure and telecommunications for espionage. Such targets can overlap with those affected by financially motivated crime, but espionage and ransomware are different threat categories; the source does not make them interchangeable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a Southeast Asian SME do after a ransomware attack?
Prioritise containment, preserving evidence and a controlled recovery rather than rushing to restore systems that may still be compromised. The steps below are a practical incident-response sequence; reporting channels and formal requirements vary by country. Singapore-based organisations can start with the CSA ransomware portal.
- Limit spread. Isolate affected computers and servers from networks where feasible, including shared drives and remote connections. Avoid wiping or rebuilding affected systems before the incident has been assessed.
- Protect evidence and make a record. Note when the problem began, which systems are affected, what messages or demands appeared, and what actions have already been taken. Preserve relevant logs and ransom notes for responders.
- Bring in qualified help and notify the right authorities. Contact your incident-response provider, IT team or a qualified cybersecurity professional. Report the incident to the appropriate national authority and follow local requirements; Singapore organisations can consult CSA’s portal.
- Secure unaffected accounts and systems. From a known-clean device, review administrative and remote-access accounts, change credentials that may be exposed, and enforce strong authentication. Patch internet-facing and IoT systems once it is safe to do so.
- Recover from known-good backups. Check that backups are not connected to the compromised environment and validate them before restoring. Restore in a controlled order, confirm systems are clean, and monitor closely for signs of renewed access.
- Assess the data and business impact. Determine which information and services were affected, whether operations or customers are at risk, and what notifications may be required under local law or contract. Keep communications and decisions documented.
How can organisations reduce the risk before an incident?
- Maintain backups that are offline or otherwise resilient to compromise, and test restoration rather than assuming backups work.
- Patch internet-facing software and IoT devices, and replace default passwords with strong, unique credentials.
- Use strong authentication for important accounts, especially administrator and remote-access accounts.
- Prepare an incident plan that identifies who can isolate systems, who approves recovery, and which national reporting channel to use.
- Make sure staff know how to report suspicious messages and unexpected system changes quickly.
What the available figures cannot tell you
The cited regional measures do not establish a comparable victim count for every Southeast Asian country, a total of ransom payments across the region, or a single dominant ransomware gang operating throughout it. They show detected activity, reported cases and documented disruption from different perspectives. Country comparisons should therefore account for how each number was collected, what it counts and whether victims may not have reported an incident.
