South Africa — Cyber Threat Profile
South Africa faces a severe and escalating cyber threat landscape while enforcement capacity remains critically underfunded. In the first half of 2025, over 6 million online attack attempts and 10.3 million malware incidents were recorded, with banking trojans surging 136% and backdoor attacks up 123% compared to 2024. In 2024, cybercriminals drained ZAR 1.8 billion from bank accounts, yet South African Police recorded only 544 cyber-related fraud cases. Cell C suffered a 2-terabyte data breach in early 2024, and the National Credit Regulator was hacked in January 2026.- National CERT/CSIRT: CSHUB-CSIRT
- Data protection authority: The Information Regulator (South Africa) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.58 / 100, #14 worldwide
- Secure Internet servers per 1M people (2024): 16,658.2 (source: World Bank)
- Internet users (2024): 78.4% of population (source: World Bank)
Latest South Africa coverage
- South Africa's BCX tops a busy week of extortion claims 2026-10-02 · Cyber Incidents
Threat actors targeting South Africa
- APT41 APT
- LockBit Ransomware · 10 incident(s)
- INC Ransom Ransomware · 8 incident(s)
- The Gentlemen Ransomware · 8 incident(s)
- DragonForce Ransomware · 5 incident(s)
- Krybit Ransomware · 5 incident(s)
- RansomHub Ransomware · 5 incident(s)
- NightSpire Ransomware · 3 incident(s)
- Qilin Ransomware · 3 incident(s)
- Sarcoma Ransomware · 3 incident(s)
- Black Locks Ransomware · 2 incident(s)
- Deadlock Ransomware · 2 incident(s)
- KillSec Ransomware · 2 incident(s)
- RansomHouse Ransomware · 2 incident(s)
- Akira Ransomware · 1 incident(s)
- Arcus Media Ransomware · 1 incident(s)
- BianLian Ransomware · 1 incident(s)
- Black Basta Ransomware · 1 incident(s)
- Black X Ransomware · 1 incident(s)
- BlackSuit Ransomware · 1 incident(s)
- Cactus Ransomware · 1 incident(s)
- Cl0p Ransomware · 1 incident(s)
- Dire Wolf Ransomware · 1 incident(s)
- Everest Ransomware · 1 incident(s)
- Hunters International Ransomware · 1 incident(s)
- Lynx Ransomware Ransomware · 1 incident(s)
- M3rx Ransomware · 1 incident(s)
- MedusaLocker Ransomware · 1 incident(s)
- Payload Ransomware · 1 incident(s)
- Prinz Eugen Ransomware · 1 incident(s)
- Stormous Hacktivist · 1 incident(s)
- UmBra Ransomware · 1 incident(s)
- APT1 APT
- APT10 APT
- APT40 APT
- FIN8 Ransomware
- RedNovember APT
Most targeted sectors
- Business & Professional Services 13 incident(s)
- Financial Services 11 incident(s)
- Government & Public Sector 9 incident(s)
- Manufacturing 9 incident(s)
- Transportation & Logistics 8 incident(s)
- Energy & Utilities 4 incident(s)
- Healthcare 4 incident(s)
- Technology 4 incident(s)
- Hospitality & Tourism 3 incident(s)
- Construction 2 incident(s)
- Retail & Consumer 2 incident(s)
- Agriculture & Food 1 incident(s)
Recent claimed incidents
- Europ Assistance South Africa 2026-10-16 · Financial Services
- Aeroklas Duys / Duys Engineering Group 2026-10-12 · Manufacturing
- Tharisa 2026-10-07 · Manufacturing
- Edcon 2026-09-30 · Manufacturing
- LegalWise 2026-09-30 · Professional Services
- bcx.co.za 2026-09-29 · Technology
- Apollo 21 – Quality Truck, Bus & Trailer Spare Parts South Africa 2026-09-26 · Transportation
- Guardrisk 2026-09-26 · Financial Services
- ARCA UNLIMITED Architects 2026-09-26 · Professional Services
- Morula IVF 2026-09-25 · Healthcare
- Capricorn Logistics Pvt. Ltd. 2026-09-12 · Transportation
- Hollard Insurance Group 2026-09-07 · Financial Services
- VSB Attorneys Inc 2026-09-07 · Professional Services
- Cartrack Holdings 2026-09-02 · Transportation
- Rohloff Group 2026-08-27 · Manufacturing