South Africa becomes Africa’s top cyber target as AI-driven attacks surge

SOUTH AFRICA – South Africa has become the most targeted economy on the African continent for cyberattacks, with criminals increasingly leveraging artificial intelligence to exploit vulnerabilities at unprecedented speed, according to a new threat intelligence report.

Bloemfontein-based cybersecurity firm Tanosec released its 2026 Annual Threat Intelligence Report today, revealing alarming trends in the country’s cyber threat landscape. The report, compiled from six months of live threat intelligence data, identifies three critical risk areas facing South African organisations.

The most significant threat stems from what researchers term “the identity crisis”, with 54% of breaches involving compromised identities. The report warns that multi-factor authentication alone is no longer sufficient defence against sophisticated attackers.

AI-driven attacks

Perhaps most concerning is the emergence of AI-driven attacks, with cybercriminals now deploying autonomous reconnaissance tools and machine-speed exploitation as standard practice. This development is outpacing most organisations’ ability to respond effectively.

A second major vulnerability lies in peripheral devices, with 38% of breaches originating from peripheral and IoT devices — printers, routers, and point-of-sale systems — that are routinely overlooked in security audits.These “peripheral blindspots” provide attackers with entry points into corporate networks.

“The data tells a clear story: South Africa is no longer a peripheral target—it is the target,” said Lawrence Lackey from Tanosec. “Organisations that continue to treat cybersecurity as an afterthought will face severe consequences in 2026,” says Lackey.

ALSO READ: Secure your car against hijacking

South Africa is the most targeted country in Africa for cyberattacks, accounting for over 40% of the continent’s ransomware attacks and roughly 35% of info stealer incidents. Ranked as the third most targeted nation globally by some reports, it faces 577 attacks per hour, driven by a highly digitalized economy with inadequate cyber resilience, costing over R5.8 billion annually. (according to global cybersecurity company ESET)

Key findings on South African cyberattacks

• Top Target in Africa: South Africa holds the top spot for cyberattacks in Africa. Recent data indicates a surge in ransomware, info-stealing, and phishing attacks, often targeting critical sectors like logistics, health, and government.
• Highest Ransomware Volume: Over 40% of all ransomware incidents in Africa occur within South Africa, targeting both government and private organizations.
• Financial Impact: Cybercrime costs the country billions of Rand annually, with an average data breach costing around R49 million (roughly $3 million).
• Major Incidents: High-profile targets include the National Health Laboratory Service, South African Weather Service, Transnet, and various financial institutions. (According to global cybersecurity company ESET)

Why South Africa is a target

• Economic Sophistication: As a developed economy in Africa, South Africa offers high-value targets, attracting financially motivated cybercriminals.
• Vulnerability: A significant lack of cyber security awareness and skills, coupled with limited investment in defense, makes it an easier target than many other nations.
• Remote Work Risks: The rapid adoption of remote work has increased the attack surface for organizations.
• Inadequate Defense: Experts note a shortage of skilled professionals and slow adaptation to sophisticated, fast-changing cyber threats. (According to Dotcom Security)

Main cyber threat actors

Several threat actors are active in the region, with Devman alone accounting for nearly 29% of ransomware activities. Other prominent groups include Warlock, Incransom, and Arkana, alongside dozens of smaller groups involved in phishing and info-stealing. (According to cyfirma).