South African organisations continue to fall victim to ransomware, with compromised credentials the most common technical root cause of attacks, a lack of protection the leading operational cause and user devices the most common entry point.
This is according to the latest State of Ransomware in South Africa 2026 report from cyber security firm Sophos, whose South African business was officially established in June 2026.
The report is based on responses from 135 IT and cyber security leaders at South African organisations that experienced ransomware in the previous 12 months.
Almost two-thirds (63%) of ransomware incidents resulted in data being encrypted over the past year, above the global average of 56% and up from 60% among South African respondents in the 2025 report.
The research found that 58% of South African organisations paid the ransom and recovered their data, down from 71% in 2025.
The median ransom demand was R6.9 million. The average cost of recovering from a ransomware attack was more than R17 million, excluding ransom payments. This was down from R21 million in the 2025 report.
The figure includes downtime, staff time, replacing or repairing devices, restoring networks and lost business opportunities.
Pieter Nel, regional head for SADC at Sophos in South Africa, said: “These figures show the extent of the disruption ransomware continues to cause in South Africa. Once attackers are able to encrypt data, the organisation faces the immediate challenge of restoring systems, maintaining operations and managing the financial and human impact of the incident. The most effective response begins before the attack, by closing the gaps that allow criminals to enter the environment.”
Why organisations fall victim
Compromised credentials were the most common technical root cause of ransomware attacks, accounting for 27% of incidents. Exploited vulnerabilities followed at 25%, down from 28% in 2025, while malicious e-mails were responsible for 22%.
A lack of adequate protection was identified as the most common operational root cause by 47% of South African respondents, the highest proportion recorded in any country surveyed.
A lack of people or cyber security capacity was cited by 43%, while 42% said attackers exploited a known security gap.
For attacks that did not originate through e-mail or phishing, user devices were the most common entry point, accounting for 43% of incidents. Exposed applications and systems accounted for 38%, followed by firewalls at 13%.
The link between ransomware and identity-based attacks was also pronounced. Among the South African organisations surveyed, 85% said their ransomware incident was the same event as their most significant identity attack during the year, compared with a global average of 67%.
“Ransomware attacks frequently begin with an identity, device or security weakness that the organisation already knows exists,” said Nel. “Compromised credentials allow criminals to appear as legitimate users, while unpatched vulnerabilities and exposed systems provide additional routes into the business. Addressing these risks requires strong identity controls, properly configured security technologies and enough skilled capacity to monitor and respond to threats.”
Sophos also highlighted the growing role of AI agents in both cyber attacks and defence.
The company said there are now attacks orchestrated and executed entirely by AI, which can use its speed and sophistication to achieve objectives without human involvement.
Greater use of backups
Of the organisations whose data was encrypted, 99% were able to recover it. The proportion using backups to restore encrypted data increased from 35% in 2025 to 54% this year, while the percentage paying a ransom and recovering their data fell from 71% to 58%.
Data theft also declined. Information was stolen in 27% of attacks where data was encrypted, compared with 39% in the 2025 report.
The median ransom demand fell by 57%, from R16 million last year to R6.9 million. The median ransom payment fell by 28% to almost R5 million.
South African organisations typically paid 71% of the original ransom demand. This was the lowest proportion among countries surveyed with a base of more than 30 respondents, but was higher than the 64% recorded in 2025.
“The increase in backup use and decline in ransom payments are positive developments,” said Nel. “Backups must, however, be properly protected, regularly tested and supported by a recovery plan that teams can follow under pressure. An organisation only discovers whether its recovery process works when it is tested or when a real incident occurs.”
Recovery remains lengthy
Only 40% of South African organisations recovered from their ransomware attack within one week, the lowest rate among countries surveyed and down from 47% in the 2025 report.
A further 13% took between one and six months to recover, compared with 19% in the previous report. This suggests that while fewer organisations experienced very long recovery periods, many were still unable to return to normal operations quickly.
The impact also extended to the IT and cyber security professionals managing the incidents.
Among organisations where data was encrypted, 52% reported increased pressure from senior leaders, while 42% said their teams received greater recognition from leadership.
Another 39% experienced changes to their team or organisational structure, 36% reported greater anxiety or stress about future attacks, and 24% said the team’s leadership had been replaced.
Strengthening ransomware resilience
Sophos advises organisations to strengthen identity security by implementing identity threat detection and response, enforcing multi-factor authentication across all access points, and regularly auditing human and non-human credentials.
Organisations should also maintain strong endpoint protection, promptly address known vulnerabilities and improve e-mail security through advanced filtering, appropriate e-mail authentication protocols and regular phishing-awareness training.
Backup systems should be tested regularly, stored offline or in immutable formats, and incorporated into a documented incident-response plan.
Share
