South Africa — Cyber Threat Profile
South Africa faces a severe and escalating cyber threat landscape while enforcement capacity remains critically underfunded. In the first half of 2025, over 6 million online attack attempts and 10.3 million malware incidents were recorded, with banking trojans surging 136% and backdoor attacks up 123% compared to 2024. In 2024, cybercriminals drained ZAR 1.8 billion from bank accounts, yet South African Police recorded only 544 cyber-related fraud cases. Cell C suffered a 2-terabyte data breach in early 2024, and the National Credit Regulator was hacked in January 2026.- National CERT/CSIRT: CSHUB-CSIRT
- Data protection authority: The Information Regulator (South Africa) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.58 / 100, #14 worldwide
- Secure Internet servers per 1M people (2024): 16,658.2 (source: World Bank)
- Internet users (2024): 78.4% of population (source: World Bank)
Threat actors targeting South Africa
- APT41 APT
- LockBit Ransomware · 10 incident(s)
- INC Ransom Ransomware · 7 incident(s)
- DragonForce Ransomware · 5 incident(s)
- RansomHub Ransomware · 5 incident(s)
- Krybit Ransomware · 4 incident(s)
- The Gentlemen Ransomware · 4 incident(s)
- NightSpire Ransomware · 3 incident(s)
- Qilin Ransomware · 3 incident(s)
- Sarcoma Ransomware · 3 incident(s)
- KillSec Ransomware · 2 incident(s)
- RansomHouse Ransomware · 2 incident(s)
- Akira Ransomware · 1 incident(s)
- Arcus Media Ransomware · 1 incident(s)
- BianLian Ransomware · 1 incident(s)
- Black Basta Ransomware · 1 incident(s)
- Black X Ransomware · 1 incident(s)
- BlackSuit Ransomware · 1 incident(s)
- Cactus Ransomware · 1 incident(s)
- Cl0p Ransomware · 1 incident(s)
- Deadlock Ransomware · 1 incident(s)
- Dire Wolf Ransomware · 1 incident(s)
- Hunters International Ransomware · 1 incident(s)
- Lynx Ransomware Ransomware · 1 incident(s)
- M3rx Ransomware · 1 incident(s)
- MedusaLocker Ransomware · 1 incident(s)
- Payload Ransomware · 1 incident(s)
- Prinz Eugen Ransomware · 1 incident(s)
- Stormous Hacktivist · 1 incident(s)
- APT1 APT
- APT10 APT
- APT40 APT
- FIN8 Ransomware
- RedNovember APT
Most targeted sectors
- Business & Professional Services 11 incident(s)
- Financial Services 9 incident(s)
- Government & Public Sector 9 incident(s)
- Manufacturing 6 incident(s)
- Transportation & Logistics 6 incident(s)
- Energy & Utilities 4 incident(s)
- Healthcare 3 incident(s)
- Hospitality & Tourism 3 incident(s)
- Technology 3 incident(s)
- Construction 2 incident(s)
- Retail & Consumer 2 incident(s)
- Agriculture & Food 1 incident(s)
Recent claimed incidents
- VSB Attorneys Inc 2026-09-07 · Professional Services
- Hollard Insurance Group 2026-09-07 · Financial Services
- Cartrack Holdings 2026-09-02 · Transportation
- Rohloff Group 2026-08-27 · Manufacturing
- FBC 2026-08-24
- Trends And Concepts 2026-08-20 · Other
- Babcock 2026-08-19 · Government & Defense
- Thecourierguy 2026-08-16 · Transportation
- Serengeti Estates (Serengeti Golf and Wildlife Estate) 2026-08-07
- www.buzztrading104.co.za 2026-08-02 · Financial Services
- DC Partner (Pty) Ltd 2026-08-02 · Professional Services
- CKR Consulting Engineers 2026-07-19 · Business Services
- Reatile Group 2026-07-18
- suppcentersa.com 2026-07-17 · Business Services
- Isegen South Africa (Pty) Ltd 2026-07-15 · Energy