Website Hacked: What a Singapore Business Should Do First

Short answer: in the first 24 hours, contain the breach, preserve evidence, and start the PDPA assessment. Change every password, take the site offline, copy the infected files and server logs, and notify your host and developer. Decide within 30 days whether personal data was exposed; if 500 or more people are affected or significant harm is likely, the PDPC must be told within 3 calendar days of that decision. Cleaning costs from a few hundred dollars; the Google warning lifts after a review you request in Search Console.

This is a business-owner sequence, not a plugin fix guide. Sources are linked and were checked 17 October 2026.

How do I know my website has been hacked?

Most owners find out from someone else. The usual signals:

• Google's listing shows "This site may be hacked" or "This site may harm your computer" under your result. Google explains the label as a sign that pages were changed or spam pages were added.
• Browsers show a full-page red warning before your site loads.
• Search Console emails a Security issues alert. If you have never set it up, do so now; it is the only direct channel to Google.
• Visitors are redirected to gambling, pharmacy or crypto pages, often only on phones or only from Google.
• New pages appear in search for products you do not sell, in languages you do not use.
• Your host suspends the account for sending spam or for malware.
• Admin accounts you did not create, or a login that no longer works.
• Ad accounts reject your destination URL.

Scale in Singapore: the Cyber Security Agency's Singapore Cyber Landscape 2025/2026, released 30 June 2026, reports around 4,800 phishing attempts and 284,300 infected systems detected in 2025, the latter up 142% on 2024, per Baker McKenzie's summary. ## What should I do in the first 24 hours?

Work in this order. Each step protects the next.

1. Contain. Change the passwords for hosting, domain registrar, CMS admin, database, FTP and the email accounts tied to them. Revoke API keys. Log out all sessions.
2. Take the site offline or replace it with a plain holding page. Google's hacked-site guide calls this quarantine.
3. Preserve evidence. Before anyone cleans anything, download a full copy of the files and database as they are, and export the server access logs. The PDPA assessment needs to know what was accessed and when.
4. Tell your host. They can see server-level logs you cannot and may already have isolated the account.
5. Tell your developer or a security firm. Agree in writing who is cleaning, what they will deliver, and that they will keep the evidence copy.
6. Check payments. If the site takes cards, tell your payment provider the same day.
7. Start the PDPA log. Write down the date and time you became aware. The 30-day assessment clock starts here.
8. Report it. File a police report through the Singapore Police Force e-services and report the incident to SingCERT at csa.gov.sg. Insurers usually require both.

Do not restore from backup yet. A backup taken after the intrusion restores the intrusion. Find the entry point first.

Do I need to notify the PDPC?

Only if personal data is involved, and the test is specific. The PDPC's Guide on Managing and Notifying Data Breaches sets out the obligation that took effect on 1 February 2021:

Three points owners get wrong:

• A defacement is not automatically a data breach. If the attacker changed the home page but the site stores no personal data, document that conclusion and move on.
• A contact form database is personal data. Names, phone numbers and emails count. If the database was reachable, assume it was read unless the logs show otherwise.
• Calendar days, not working days. A breach confirmed on a Friday is due to the PDPC by Monday.

The maximum financial penalty since 1 October 2022 is S$1 million, or 10% of annual Singapore turnover for organisations above S$10 million turnover. Failing to notify is itself a breach of the Act. The wider obligations are in the PDPA checklist for a business website.

How much does it cost to clean a hacked site in Singapore?

Published prices, checked 17 October 2026:

These cover removal. They do not cover the costs that usually exceed them:

• Rebuilding pages when there is no clean backup. Innomedia's page lists this at S$500 or more.
• Lost enquiries while the site is down or flagged. A site that takes 10 enquiries a week and is flagged for 3 weeks has lost 30.
• Ad spend paused while the destination is rejected.
• PDPA assessment and notification time, and legal review if the breach is notifiable.
• Repeat infections. A clean-up that does not close the entry point is paid for twice.

Get the quote to state what is included: the entry point found and closed, all files and the database scanned, admin users audited, and a written report you can attach to the PDPA record.

How do I remove the Google hacked warning?

Google removes the label only after it verifies the site is clean. The process is documented in the Security issues report help:

1. Verify the site in Search Console if it is not already.
2. Open Security issues. It lists the category, hacked content, malware or social engineering, with sample URLs.
3. Clean the whole site, not only the sample URLs. Google states that requesting a review while the problem still exists prolongs the time the site is flagged.
4. Select Request Review. Google asks for a note that explains the issue, the steps taken to fix it and the outcome.
5. Wait. Google states most reviews take several days or weeks. Do not resubmit before the decision; Google warns this can lengthen the next review.

Spam pages that Google indexed drop out of results as they return 404 or 410.

How do I stop it happening again?

Most business-site hacks enter through one of four doors: an outdated plugin or theme, a weak or reused password, a shared hosting neighbour, or a third-party script. Close them in this order:

• Update everything, then set updates to automatic where the platform allows.
• Delete every plugin, theme and admin account not in active use.
• Two-factor login on the CMS, hosting and registrar.
• Off-site backups daily, kept for at least 30 days, tested by restoring one.
• A firewall in front of the site, from the host or a service such as Sucuri or Cloudflare.
• Monitoring. Search Console alerts on, uptime check on, and a monthly look at admin users and file changes.
• A maintenance owner. One named person or vendor. See website maintenance in Singapore for what that covers and costs.

The structural fix is to remove the plugin surface altogether. A site built as code on a managed platform with HTTPS and security headers has fewer doors to begin with.

What cense does

cense builds sites in Next.js on Vercel or Google Cloud with HTTPS, security headers and no plugins, and the client owns the domain, code, hosting and data. Monthly maintenance is S$0. See website infrastructure.