Should S'pore compel insurers to report ransomware incidents?

Move would help to increase visibility and understanding of full scale of cyber threats

- Krist Boo Senior Business Correspondent

Singapore companies are increasingly being targeted by state-sponsored hackers, yet recent reports show that firms are more likely to pay the ransom and stay silent, hindering the authorities from understanding the full scale of cyber threats.

The Cyber Security Agency of Singapore (CSA) currently does not mandate ransomware reporting for noncritical infrastructure firms owing to enforcement complexities and privacy concerns, CSA chief executive David Koh told The Straits Times in an earlier interview.

One potential solution to that is to require insurers to report cyber incidents linked to claims on an aggregated, anonymised basis.

Currently, organisations with noncritical infrastructure affected by ransomware are encouraged to report incidents to the Singapore Cyber Emergency Response Team and the police.

Mandatory notification of the Personal Data Protection Commission applies only if a data breach involves personal data and is likely to cause significant harm or affects 500 or more individuals.

The onus remains on organisations to inform the authorities, but many victims see no immediate gain from volunteering the information.

A review is timely, given the Government's latest push to help small and medium-sized enterprises (SMEs) bolster their cyber resilience. Close to 50,000 SMEs will, from November, receive one year of free cyber-protection tools.