PwC Malaysia: Cyber Threats 2024, A Year in Retrospect

PwC’s threat intelligence team confirmed that ransomware has become one of the most significant threats to Malaysian firms, with notorious operators including RansomHub, Qilin, and Lynx actively targeting Malaysian organisations across multiple sectors.

PwC noted that Malaysian CEOs now rank cyber risk above macroeconomic volatility and inflation as their foremost business concern, a sentiment echoed by corporate directors in PwC’s own board survey.

Source: PwC Malaysia: Charting Cyber Threats 2025

Sophos: State of Ransomware Report 2025

Sophos surveyed 3,400 IT professionals across 17 countries and found:

• • Over two-thirds of ransomware attacks between 2024 and 2025 targeted businesses with fewer than 500 employees
  • Average ransomware recovery cost in 2025 is USD$1.53 million, not including the ransom payment itself
  • Average business downtime after a ransomware attack is 24 days before full operational restoration
  • 69% of organisations that paid a ransom were attacked again within 12 months

The Sophos finding is direct: paying the ransom solves very little. Recovery capability and advance preparation are what determine whether a business survives.

Source: Sophos State of Ransomware 2025

Cybersecurity Ventures: 2025 Ransomware Damage Cost Report

Global ransomware damage costs are projected to reach USD$57 billion in 2025, equivalent to USD$2,400 every single second. By 2031, a new ransomware attack is forecast to occur every 2 seconds globally, up from every 11 seconds in 2021.

Ransomware-as-a-Service (RaaS) is a major driver of this growth. Criminal groups now rent out their ransomware tools to anyone willing to share the proceeds. This model allows technically inexperienced attackers to launch sophisticated campaigns at scale, and SMEs are their preferred volume targets.

Source: Cybersecurity Ventures: Ransomware Report 2025

CyberSecurity Malaysia Annual Report 2025 and MyCERT Q3 2025 Incident Report

CyberSecurity Malaysia’s Annual Report 2025 confirmed ransomware attacks on Malaysian businesses rose 42% year-over-year. A separate Starlight Intelligence analysis found ransomware activity targeting Malaysia more than doubled from 2023 to 2025. MyCERT’s Q3 2025 Cyber Incident Report recorded 17 ransomware incidents in Q3 alone, a 19% increase over Q2. Most frequently observed attack patterns:

• Active Directory (AD) server exploitation, enabling ransomware to propagate across entire networks simultaneously
• Virtualisation platform attacks targeting VMware and ESXi servers to compromise multiple systems at once
• Phishing, brute force attacks, and stolen credentials as the primary initial entry points

MyCERT’s conclusion for 2025 and beyond: ransomware incidents will continue to grow, impacting businesses and critical national infrastructure across Malaysia.

Sources: MyCERT Q3 2025 Incident Report  |  SimplyData Malaysia Cybersecurity Threat Report 2025

The Full Cost of a Ransomware Attack on a Malaysian Business

💰  The Ransom Demand
Ransomware groups targeting Malaysian SMEs in 2025 demand between RM500,000 and RM5 million. Larger organisations face demands running into tens of millions. Paying is no guarantee of recovery. 69% of businesses that paid were attacked again within 12 months, and Sophos confirms only 97% of data is typically recovered even by those who do pay.

⏱  Operational Downtime
The average business is offline for 24 days after a ransomware attack. For a company generating RM100,000 monthly, that is over RM80,000 in lost revenue, before a single cent of recovery cost is counted.

🔧  Recovery and Restoration
Rebuilding encrypted systems, restoring data, forensic investigation, and emergency IT support typically costs between RM80,000 and RM400,000 for a mid-sized Malaysian business, even with good backups in place.

⚖  Legal and Regulatory Exposure
Under Malaysia’s PDPA 2024, if customer or employee personal data was accessed during the attack, you must notify the authorities within 72 hours. Failure to notify, or to demonstrate adequate prior security measures, risks fines of up to RM1 million per offence.

📉  Customer and Reputational Loss
Research indicates that 58% of small businesses that suffered a serious ransomware event in 2024 were forced to close within months. Even businesses that recover technically can take years to restore the trust of customers, suppliers, and partners.

The ransom is what makes the headlines. The recovery cost is what determines whether your business survives.

Ransomware-as-a-Service (RaaS) Criminal groups now rent out ransomware tools to anyone willing to share a portion of the proceeds. Even technically inexperienced attackers can now launch sophisticated campaigns. SMEs are targeted at volume because there are many of them, and their defences are typically lighter.

Valuable Data, Lighter Defences SMEs process payments, store customer personal data, hold supplier contracts, and manage payroll. That data has significant value to attackers. The security protecting it is often less structured than at larger organisations, creating an attractive imbalance.

No Dedicated Security Team Malaysia faces a shortage of 12,000 cybersecurity professionals. Most SMEs rely on generalist IT support rather than dedicated security specialists. When an attack occurs at 2 AM on a Sunday, who is monitoring your systems?

Supply Chain Targeting Attackers increasingly target SMEs not only for their own data but as an entry point into the larger corporations they serve. A smaller business with lighter defences can become the access route into a major client’s network. Many large Malaysian corporates are now beginning to require cybersecurity standards from their suppliers and vendors.