68% of Singapore Organisations Say AI Made Ransomware Attacks More Effective: Proofpoint

Ransomware is getting a second wind from artificial intelligence, and Singapore is feeling the effects more acutely than most markets. Proofpoint's 2026 AI-Era Ransomware Report, surveying 953 security professionals across 12 countries, found that 68 percent of affected organisations in Singapore said AI made ransomware attacks more effective. Only 3 percent of Singapore respondents reported no evidence of AI being used in the incidents they faced.

The report, published July 29, reveals that modern ransomware attacks rely less on encryption and more on social engineering amplified by AI. In Singapore, 45 percent of respondents said employees did not suspect the attack because it appeared authentic, while 48 percent said the incident occurred because users interacted with malicious content. Email remained a common entry point, with 28 percent of incidents beginning with phishing or email-based social engineering. Malicious links were the most frequent threat vector at 53 percent, followed by malicious attachments and conversation hijacking, both at 38 percent.

Data theft is increasingly central to the ransomware business model. Three-quarters of Singapore organisations affected by ransomware reported that data was stolen during the attack, suggesting that extortion is now as much about sensitive information as it is about system disruption. The numbers on ransom payments paint an even starker picture: half of affected organisations in Singapore paid a ransom, yet 45 percent of those that paid were then hit with a second extortion demand. Attackers are stealing credentials and data first, then using those assets to press repeated demands.

Globally, 65 percent of affected organisations said AI increased ransomware effectiveness. Proofpoint's Chief Strategy Officer Ryan Kalember described AI as an amplifier rather than a wholly new category of attack, noting that attackers are using AI to create highly convincing phishing emails, malware scripts, and credential theft campaigns that exploit human trust at scale. George Lee, the company's SVP for Asia Pacific and Japan, said organisations need to shift from reactive recovery to proactively defending the people and communications attackers are targeting.

Why it matters for Singapore: These findings arrive just as MAS and ABS have formed the AI-Driven Cyber and Technology Risk Taskforce (ACT) to address frontier AI threats to the financial sector. The Proofpoint data underscores why such coordination is urgent. Singapore's high rates of AI-enhanced attack effectiveness, ransom payment, and user-interaction-driven breaches suggest that technical controls alone are insufficient. For Singaporean businesses, the message is clear: ransomware defences must account for the human layer, because attackers are using AI to target it with unprecedented precision.