Many organizations and businesses will be targeted by cyberattacks in 2025.

This report was compiled by the Technology Committee of the National Cybersecurity Association in December 2025, based on a survey of more than 5,300 organizations and entities in Vietnam.

Specifically, in 2025, information systems in Vietnam will face approximately 552,000 cyberattacks, a decrease of 19.38% compared to 2024. This development shows that the efforts of agencies and organizations to invest in cybersecurity have begun to yield results, making attacks less easy than before.

However, the decrease in number does not necessarily mean a decrease in risk. The survey shows that 52.30% of organizations and businesses reported experiencing damage from cyberattacks during the year, a significant increase from 46.15% in 2024. This indicates that hackers are shifting to a more selective attack strategy, focusing on specific targets with thorough preparation and deeper exploitation capabilities, increasing the risk even though the total number of attacks has decreased.

There are five most common types of cyberattacks in 2025: denial-of-service attacks; backlinking for gambling and betting; advanced persistent threat (APT) attacks; data theft attacks; and ransomware. Notably, these attacks appear to be combined and interwoven by hackers, following carefully calculated scenarios.

Surface attacks like DDoS attacks quickly disrupt operations, attract attention, and disperse the resources of cybersecurity teams. While organizations focus on incident response, deeper layers of defense may be neglected for a period. Taking advantage of these gaps, hackers silently launch targeted attacks, penetrating deep into systems, planting malware, and maintaining a presence for extended periods without detection.

According to the National Cybersecurity Association, in 2025, the most impactful incidents will focus on data breaches and theft. This indicates that hackers are no longer just aiming to cripple systems for ransom, but are increasingly viewing data as a highly valuable asset for long-term exploitation.

Stolen data can be bought, sold, or used for various purposes on underground markets, increasing long-term risks for affected organizations. Even if systems are restored, the consequences of data loss can persist for a long time, directly impacting reputation, legal liability, and customer and partner trust.

According to Mr. Vu Ngoc Son, Head of the Technology Department of the National Cybersecurity Association, hackers tend to employ a dual-attack strategy, not immediately encrypting data upon intrusion but instead lying low for an extended period. Their goal is to steal important data for sale, exchange, or exploitation on black markets. Only when there is no more data to exploit do they proceed to encrypt the data to extort money from the victims.

According to the report, 2025 also saw positive changes in cybersecurity awareness. The percentage of agencies and businesses organizing cybersecurity awareness training reached 75.93%. Approximately 51.45% of units conducted cybersecurity drills and proactively developed scenarios and procedures for incident response.

51.65% of organizations and businesses reported having deployed or operating a Security Operations Center (SOC), reflecting a trend of investment in centralized monitoring and early response. Notably, the percentage of businesses with data backup systems reached 76.35%, indicating that organizations are better prepared for disaster recovery scenarios.

However, behind these positive figures, there are still many worrying gaps. Nearly half of the agencies and businesses, equivalent to 47.72%, are still experiencing a shortage of cybersecurity personnel, a situation that has been warned since 2024. Not only is there a shortage of personnel, but many organizations also lack a systematic cybersecurity management framework, with as many as 27.80% not having implemented any internal cybersecurity standards.

Notably, more than half (51.87%) of the organizations still lack centralized malware prevention software, while 8.71% do not use any antivirus software at all. At the internet gateway, 9.38% of agencies and businesses reported having no form of internet access control such as firewalls, leaving their systems constantly vulnerable to external intrusion.

Overall, compared to 2024, cybersecurity in 2025 shows significant progress in awareness, but the level of investment in technical solutions and human resources is still not commensurate with the speed and sophistication of attacks. The continued increase in the rate of attacks on agencies and businesses is a clear warning that cybersecurity is no longer a purely technical issue, but has become a management, strategic, and sustainable development challenge in the digital age.

Forecasting trends for 2026, the National Cybersecurity Association predicts that data security will become a central "front" for agencies, organizations, and businesses. In the context of Vietnam's accelerated digital transformation, data and information centers will be the most valuable assets targeted by hackers.

Cyberattacks are predicted to become increasingly sophisticated and highly automated thanks to artificial intelligence (AI). Hackers can use AI to quickly create automated tools for scanning and exploiting vulnerabilities, as well as generating new malware variants that constantly change to evade traditional defense systems.

In addition, ransomware attacks still pose a risk of resurgence with greater severity, especially targeting critical infrastructure.

Cybersecurity experts warn that compliance with the Cybersecurity Law and the Personal Data Protection Law will no longer be an option but a survival requirement. Businesses need to shift from reactive measures to systematic investment, adopting international cybersecurity standards and treating data as the most valuable asset to protect rigorously.

Source: