Organisations worldwide experienced an average of 2 336 cyberattacks per week – a 3% increase month on month and a 16% increase year on year – according to Check Point’s Global Threat Intelligence insights for July.
African organisations recorded 3 237 attacks per week, topped by Latin America at 3 561 weekly attacks per organisation, and APAC at 3 316. In the African region, Angola was particularly hard hit with 5 714 weekly attacks per organisation, followed by Nigeria at 4 975, Kenya at 2 915 and South Africa at 2 195.
July’s cyberthreat landscape was shaped by pressure across multiple fronts.
Financial Services, Government and Energy & Utility sectors continued to take a pummeling, being the top three most attacked industries on the continent.
Global attack volumes continued to climb, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise.
“July’s data shows that cyber risk is accumulating across multiple fronts at once,” says Lorna Hardie, regional director: Africa at Check Point Research. “Attack volumes continue to rise, ransomware has accelerated sharply, and GenAI exposure is now part of daily business activity. Organisations need prevention-first, AI-driven security that protects networks, users, data and AI workflows before attacks can cause impact.”
Education still most targeted
In July, Education remained the most targeted sector globally, averaging 4 848 weekly attacks per organisation, up 14% year on year. Government followed with 3 044 attacks, Telecommunications with 2 927, while Energy and Utilities rose 20% to 2 759, and Hospitality, Travel and Recreation entered the top five with 2 614 attacks – up 28%.
GenAI risk now a daily reality
GenAI-related exposure became a daily business issue in July: one in every 36 enterprise prompts carried a high risk of sensitive data leakage; 88% of regular GenAI-using organisations were affected by high-risk prompt activity; and 22% of prompts contained potentially sensitive information.
Organisations used an average of eight GenAI tools, with users generating 95 prompts on average. Personal data was the most common sensitive category exposed, appearing in 70% of organisations, followed by financial data and network and IT infrastructure at 68% each.
Email still a key entry point
Email also remained a high-volume risk channel: one in every 128 emails, or 0,78%, was classified as phishing, while a further 20% fell into unwanted or risky categories such as graymail, spam and suspicious messages. Africa recorded the highest phishing rate, at one in every 106 emails, followed by North America at one in every 117, reinforcing email’s role as a common starting point for credential theft, malware delivery, and business email compromise.
Ransomware surges
The clearest shift in July came from ransomware. Reported attacks reached 964 – up 49% from June and 87% compared with July 2025. This marked a decisive break from the first half of 2026, when monthly ransomware activity averaged around 672 incidents. Business Services remained the most affected sector, accounting for 32,5% of reported victims, followed by Industrial Manufacturing at 14,4% and Consumer Goods and Services at 13,4%.
North America remained the most affected region, accounting for 45% of reported ransomware incidents. Europe followed at 28%, while APAC accounted for 17%. At country level, the US continued to dominate the victim count with 39,4% of reported attacks, followed by Germany, Canada, the UK and Italy.
Ransomware leaders
The Gentlemen and Qilin were the most prevalent ransomware groups in July, each responsible for 14% of published attacks. DeadLock ranked third with 10% and 97 reported victims, highlighting continued shifts in the ransomware ecosystem.