Ransomware in South Africa: Response & Protection Guide 2026

## Executive summary Ransomware is a pervasive and rapidly growing criminal industry in South Africa in 2026: confirmed attacks rose 140% in H1 2026 with organisations facing thousands of attempted attacks weekly, widespread RaaS operations and double-extortion extortion models are driving large ransom demands (median ~R17M) and high recovery costs (~R23M). The report documents recent breaches (including XP95 and government targets), common entry vectors (phishing, stolen credentials, unpatched internet-facing systems, third-party compromise), recommended mitigations (immutable backups, aggressive patching, MFA, least privilege, monitoring, IR plans) and legal/incident-response obligations under POPIA and the Cybercrimes Act.