SA organisations under pressure to protect against ransomware onslaught

South African companies continue to be targeted by ransomware attacks, according to the State of Ransomware in South Africa 2026 report from cybersecurity firm Sophos. The report, based on feedback from 135 IT and cybersecurity leaders at South African organizations, indicates compromised credentials as the primary cause of attacks (27%), followed by exploited vulnerabilities (25%) and malicious emails (22%).

A lack of proper protection was the leading operational issue (47%), followed by insufficient people or cybersecurity capacity (43%). User devices were the most common entry point for attacks, accounting for 43% of incidents, while exposed applications and systems followed at 38%.

Of the organizations surveyed, 85% reported that their ransomware incident was also the most significant identity attack they experienced that year, compared to a global average of 67%. Almost all (99%) of the organizations whose data was encrypted were able to recover it, but the cost of recovery averaged over R17 million, excluding ransom payments. The median ransom demand decreased by 57%, from R16 million in 2025 to R6.9 million in 2026. The median ransom payment also fell by 28%, to nearly R5 million.

The use of backups to restore encrypted data increased from 35% in 2025 to 54% in 2026, while the percentage of organizations paying a ransom and recovering their data decreased from 71% to 58%. Only 40% of South African organizations recovered from a ransomware attack within one week, the lowest rate among countries surveyed. The impact on IT and cybersecurity professionals was significant, with many experiencing increased pressure from senior leaders, greater recognition, changes to their team or organizational structure, heightened anxiety or stress about future attacks, and even leadership replacements.