Semperis tied AI to ransomware. Singapore firms are exposed

The booking calendar is useless when the door stays locked

Semperis put artificial intelligence inside the ransomware conversation when its new report was released. That sounds remote until the same threat reaches the places where customers expect an answer: your booking calendar, your inbox, and the records that tell you who is due to arrive. A ransomware event doesn't have to look technical to turn into a day of silence. It can leave a small team deciding which customer they can still serve, and whether they can even see the next booking. That is the human part of a report about artificial intelligence.

The clock isn’t visible.

Semperis put AI inside the ransomware story

Asian Business Review reported Thursday that cyber resilience firm Semperis released its 2026 Ransomware Risk Report, which said artificial intelligence is playing a major role in cyberattacks. The publication reported that 60% of Singapore companies were targeted by ransomware, and you can read its report on the Singapore findings.

CBS News reported Wednesday that more than 80% of ransomware victims said cybercriminals used artificial intelligence to carry out attacks, citing the same report. Its coverage of the Semperis findings puts the point plainly: the technology being sold to help people write, reply, and organise is also part of the criminal toolkit.

Those are not identical measures. One describes companies targeted in Singapore. The other describes what victims said about how attacks were carried out. But both move the conversation away from a distant technical concern and toward customer access.

CBS News and Asian Business Review point to the same threat

This one does not change what you do this week, here is why it is still worth knowing. It changes the question behind the work you already do: if access disappears, can customers still find you and can you still honour what they have booked?

We think the percentage contest is the part to ignore. A large number can create urgency, but it can also become an excuse for doing nothing because the problem feels too large for a small team. You don’t need to settle whether one figure is more alarming than another before checking the few places where a lockout would be visible to customers.

The unknown is whether artificial intelligence is making attacks more frequent, more convincing, or simply easier for victims to identify after the fact. The digest does not answer that. It also does not tell us which customer-facing systems fail first for a restaurant, studio, shop, or service team.

What it does offer is a reason to stop treating access as an internal detail. A booking page is a promise. An inbox is a front desk. A customer list is not merely administration when it is the only route back to people expecting you.

For a wider view of the routines worth protecting before you add more automation, read Is Your Business Ready for Automation? 5 Signs You Can't Ignore.

The number to ignore is not the headline percentage

The industry story becomes real on an ordinary afternoon. A customer can’t confirm a booking. A staff member can’t find the next appointment. A message goes unanswered because the usual place to answer it is unavailable.

That is the turn.

The useful response is not panic, and it isn’t a grand security project. It is making sure the customer journey has a fallback route before you need one.

Your WhatsApp and booking page need a lockout plan this week

Start with the surfaces customers actually touch. You won’t want to spend an afternoon on this because nothing appears broken, and because checking old logins and recovery details is boring work. That is precisely why it slips.

Use one short working session to map the route from a customer’s first message to a confirmed booking. Keep it practical, and make each check visible to the person who would cover the task if the usual owner is away.

• On your booking page, write down who can change the availability, where the confirmation messages go, and what alternate contact route a customer sees if bookings cannot be confirmed. If you skip it, a customer may reach a page that looks open while nobody can see or respond to the enquiry. This is the first place to test because AI ransomware attacks matter to customers only when access to a real service disappears.

• In your customer inbox, check which team members can sign in, which recovery address receives account notices, and whether the password is stored somewhere only one person can reach. If you skip it, one unavailable login can turn a simple customer question into a missed sale or a missed appointment. Write the fallback route in plain language, not in a document nobody opens.

• In your customer list and booking system, create a current export that the person handling tomorrow’s shift can locate without using the same account. If you skip it, you may know you have customers due to arrive but have no usable way to contact them. That is when a technical interruption becomes a reputation problem.

Don’t make this a technology shopping exercise. The immediate goal is to see where a customer gets stranded, then give your team one alternative way to reply or confirm. If your follow-up process is unclear even on a normal day, Automated Lead Follow Up for Small Business: A Practical System is useful reading before adding another automated layer.

And test one path on a Friday afternoon. Send a booking enquiry through the page, find the reply, and confirm that another person could complete the same task if the normal route were unavailable.

Watch whether ransomware moves from disruption to customer impersonation

Watch for a specific signal: whether the next coverage describes customers receiving convincing messages that appear to come from a familiar booking, payment, or support channel. That would show the threat has moved beyond locking teams out and into redirecting customers while trust is still intact.

Also watch whether the stories begin naming the customer-facing systems that were unavailable, rather than treating an attack as an abstract technology outage. That detail matters because it reveals where continuity planning has failed.

We should pay attention to the first customer complaint, not the loudest percentage.