Data will become the top target for cyberattacks in 2025.

A 2025 cybersecurity research and survey report on Vietnam's government and business sector, conducted by the Technology Committee of the National Cybersecurity Association, shows that data has become the top target of cybercrime attacks.

According to statistics from the National Cybersecurity Association, in 2025, information systems in Vietnam will face approximately 552,000 cyberattacks, a decrease of 19.38% compared to 2024.

This development shows that the efforts of agencies and organizations to invest in cybersecurity have begun to yield results, making attacks less easy than before.

However, the decrease in number does not necessarily mean a reduction in risk. The survey shows that 52.30% of organizations and businesses reported experiencing damage from cyberattacks during the year, a significant increase from 46.15% in 2024. This indicates that hackers are shifting to a more selective attack strategy, focusing on specific targets with thorough preparation and deeper exploitation capabilities, increasing the risk even though the total number of attacks has decreased.

The five most common types of cyberattacks in 2025 are: Denial-of-service attacks; Gambling and betting advertising link injection (backlinks); Advanced Persistent Threats (APTs); Data theft attacks; and Ransomware. Notably, these attacks appear to be combined and interwoven by hackers according to carefully calculated scenarios.

Surface attacks like DDoS attacks quickly disrupt operations, attract attention, and disperse the resources of cybersecurity teams. While organizations focus on incident response, deeper layers of defense may be neglected for a period. Taking advantage of these gaps, hackers silently launch targeted attacks, penetrating deep into systems, planting malware, and maintaining a presence for extended periods without detection.

According to the National Cybersecurity Association, in 2024 ransomware attacks emerged as the primary threat, severely disrupting the operations of many agencies and businesses. However, in 2025, the most impactful incidents will focus on data breaches and theft. This shift indicates that hackers are no longer solely focused on paralyzing systems to demand ransom, but are increasingly viewing data as a highly valuable asset for long-term exploitation.

Stolen data can be bought, sold, or used for various purposes on underground markets, increasing long-term risks for affected organizations. Even if systems are restored, the consequences of data loss can persist for a long time, directly impacting reputation, legal liability, and customer and partner trust.

Mr. Vu Ngoc Son, Head of the Technology Department of the National Cybersecurity Association, stated: "Hackers tend to employ a dual-attack strategy, not immediately encrypting data upon intrusion but instead lying low for an extended period. Their goal is to steal important data for sale, exchange, or exploitation on black markets. Only when there is no more data to exploit do they proceed to encrypt the data to extort money from the victims."

The year 2025 saw positive changes in cybersecurity awareness. The percentage of agencies and businesses organizing cybersecurity awareness training reached 75.93%, indicating that cybersecurity has received more attention.

Approximately 51.45% of organizations have conducted cybersecurity drills, proactively developing scenarios and incident response procedures. 51.65% of agencies and businesses reported having deployed or operating a Security Operations Center (SOC), reflecting a trend towards investing in centralized monitoring and early response.

In particular, the percentage of businesses with data backup systems has reached 76.35%, indicating that organizations are better prepared for disaster recovery scenarios.

However, behind these positive figures, there are still many worrying gaps. Nearly half of organizations and businesses, equivalent to 47.72%, are still experiencing a shortage of cybersecurity personnel, a situation that has been warned since 2024.

Not only is there a shortage of personnel, but many units also lack a systematic cybersecurity management framework, with as many as 27.80% not having implemented any cybersecurity standards internally.

Notably, more than half (51.87%) of the organizations still lack centralized malware prevention software, while 8.71% do not use any antivirus software at all. At the "internet gateway," 9.38% of agencies and businesses reported having no form of internet access control such as firewalls, leaving their systems constantly vulnerable to external intrusion.

According to the report, overall compared to 2024, cybersecurity in 2025 shows significant progress in awareness, but the level of investment in technical solutions and human resources is still not commensurate with the speed and sophistication of attacks.

The continued increase in the rate of cyberattacks on organizations and businesses is a clear warning that cybersecurity is no longer a purely technical issue, but has become a management, strategic, and sustainable development challenge in the digital age.

Forecasting trends for 2026, representatives of the National Cybersecurity Association stated that data security will become a central "front" for agencies, organizations, and businesses. In the context of Vietnam's accelerated digital transformation, data centers and personal information will be the most valuable assets targeted by hackers.

Cyberattacks are predicted to become increasingly sophisticated and highly automated thanks to artificial intelligence (AI). Hackers can use AI to quickly create automated tools for scanning and exploiting vulnerabilities, as well as generating new malware variants that constantly change to evade traditional defense systems. In addition, ransomware attacks still pose a risk of resurgence with greater danger, especially targeting critical infrastructure.

Compliance with the Cybersecurity Law and the Personal Data Protection Law will no longer be an option but a matter of survival. Businesses need to shift from reactive measures to systematic investment, adopting international cybersecurity standards and treating data as the most valuable asset to be strictly protected.

Source: