Digital forensics Singapore: what happened, how, and what was taken
We provide digital forensics. Singapore organisations call us after ransomware, a hacked mailbox or a suspected leak, to answer three questions: what happened, how the attacker got in and what data was taken. We preserve the evidence, find the root cause and give you a report for the regulator and your insurer.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Regulators“How did the breach happen and how many were affected?”Evidence lets the notification state how the breach happened and how many people were affected, as PDPC requires.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Management“Can we use this evidence later, including in court?”PDPC notes that evidence serves both incident resolution and legal proceedings. Forensic copies and logs support both.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Board and shareholders“What actually went wrong?”Root-cause findings, such as an unpatched firewall and attackers moving across servers over remote desktop, show what to fix.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Management“Should the police be told?”PDPC advises alerting the police where crime is suspected, so that evidence is preserved.Personal Data Protection Commission (PDPC), read 12 Oct 2026
PDPC requires a breach notification to state when and how the organisation found out, how the breach occurred, the number affected and the data involved. Without an investigation, these cannot be stated reliably.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- Evidence preserved before logs and files are overwritten
- How the attacker got in, and when
- What data was reached or taken, and whose
- A report you can use with the PDPC and insurers
- The fixes that close the way in
- A forensic report: timeline, cause, impact and fixes
- Preserved copies of the evidence
Ransomware was 62% of the cyber incidents behind PDPC enforcement in 2023–2024. PDPC, Apr 2025.
How it works
- You
Call 6222 1000, disconnect affected devices from the network, and do not wipe them.
- Us
We collect and analyse logs, disk images and accounts, keeping the chain of custody.
- Result
You know what happened, what was taken and what to notify.
Latest on this topic
Common questions
What does a digital forensics investigation find?
The way in, the timeline, the accounts and systems used, and what data was reached or copied. The findings tell you whether a breach is notifiable and how many people to tell.
Why does forensics matter for breach notification?
You must assess a suspected breach within 30 calendar days and, if it is notifiable, tell the Personal Data Protection Commission (PDPC) within 3 calendar days. Forensics gives you the facts for both decisions, and a record of how you reached them.
Who carries out the investigation?
Qualified forensic examiners, under our lead. You see their credentials before work starts.
Will our insurer accept the report?
The report sets out the timeline, cause, impact and fixes, which is what insurers and regulators usually ask for. Tell us your insurer’s requirements at the start and we match them.
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)