Almost two-thirds (63%) of ransomware incidents in South Africa resulted in data being encrypted over the past year, according to the new State of Ransomware in South Africa 2026 report from Sophos. This is above the global average of 56% and an increase from the 60% reported by South African respondents in 2025.
The average cost of recovering from a ransomware attack in South Africa was over R17-million ($1,08-million), excluding any ransom payments. While this was down from R21-million ($1,31-million) in the 2025 report, it remains a considerable financial burden. The figure includes the cost of downtime, staff time, replacing or repairing devices, restoring networks and lost business opportunities.
The report is based on responses from 135 IT and cybersecurity leaders working at South African organisations that experienced ransomware during the previous 12 months.
“These figures show the extent of the disruption ransomware continues to cause in South Africa,” says Pieter Nel, regional head: SADC for Sophos in South Africa. “Once attackers are able to encrypt data, the organisation faces the immediate challenge of restoring systems, maintaining operations and managing the financial and human impact of the incident. The most effective response begins before the attack, by closing the gaps that allow criminals to enter the environment.”
Why SA organisations fall victim
Compromised credentials were the most common technical root cause of ransomware attacks in South Africa, accounting for 27% of incidents. Exploited vulnerabilities followed at 25%, down from 28% in the 2025 report, while malicious emails were responsible for 22% of attacks.
The findings also highlight the role of operational security weaknesses. A lack of adequate protection was identified as the most common operational root cause by 47% of South African respondents. This was the highest proportion recorded in any country surveyed. A lack of people or cybersecurity capacity was cited by 43%, while 42% said attackers exploited a known security gap.
For attacks that did not originate through email or phishing, user devices were the most common entry point, accounting for 43% of incidents. Exposed applications and systems were used in 38% of attacks, followed by firewalls at 13%.
The connection between ransomware and identity-based attacks was particularly pronounced in South Africa. Of the local organisations surveyed, 85% said their ransomware incident was the same event as their most significant identity attack during the year. This was significantly higher than the global average of 67%.
“Ransomware attacks frequently begin with an identity, device or security weakness that the organisation already knows exists,” says Nel. “Compromised credentials allow criminals to appear as legitimate users, while unpatched vulnerabilities and exposed systems provide additional routes into the business. Addressing these risks requires strong identity controls, properly configured security technologies and enough skilled capacity to monitor and respond to threats.”
More organisations turn to backups
Although the proportion of incidents resulting in encryption increased, South African organisations showed signs of improving their ability to recover.
Of the organisations whose data was encrypted, 99% were able to recover it. The proportion using backups to restore encrypted data increased from 35% in the 2025 report to 54% this year. At the same time, fewer organisations relied on ransom payments. The percentage that paid a ransom and recovered its data fell from 71% in the previous report to 58%.
Data theft also declined. Information was stolen in 27% of attacks where data was encrypted, compared with 39% in the 2025 report.
The median ransom demand made against South African organisations fell by 57%, from R16-million ($1-million) last year to R6,8-million ($427 000). The median ransom payment decreased by 28%, from $425 241 to almost R5-million ($305 000).
South African organisations typically paid 71% of the original ransom demand. Although this was the lowest proportion of any country surveyed with a base of more than 30 respondents, it was higher than the 64% recorded in the 2025 report.
“The increase in backup use and decline in ransom payments are positive developments,” says Nel. “Backups must, however, be properly protected, regularly tested and supported by a recovery plan that teams can follow under pressure. An organisation only discovers whether its recovery process works when it is tested or when a real incident occurs.”
Recovery remains a lengthy process
Only 40% of South African organisations recovered from their ransomware attack within one week. This was the lowest rate of any country surveyed and down from 47% in the 2025 report. A further 13% took between one and six months to recover, compared with 19% in the previous report. This indicates that while fewer organisations experienced very long recovery periods, many were still unable to return to normal operations quickly.
The impact also extended to the IT and cybersecurity professionals responsible for managing the incidents. Among organisations where data was encrypted, 52% reported increased pressure from senior leaders, while 42% said their teams received greater recognition from leadership.
Another 39% experienced changes to their team or organisational structure, 36% reported greater anxiety or stress about future attacks, and 24% said the team’s leadership had been replaced.
Strengthening ransomware resilience
Sophos recommends that organisations strengthen identity security by implementing identity threat detection and response (ITDR), enforcing multi-factor authentication across all access points and regularly auditing both human and non-human credentials.
Organisations should also maintain strong endpoint protection, address known vulnerabilities promptly and improve email security through advanced filtering, appropriate email authentication protocols and regular phishing awareness training.
Backup systems should be tested regularly, stored offline or in immutable formats, and incorporated into a documented incident response plan. Organisations that do not have sufficient internal capacity should consider specialist support that provides continuous monitoring, detection and response.