South Africa

South Africa ranks #32 globally for ransomware attacks, with 93 confirmed victims in this database — representing 0.4% of the worldwide total. The most active ransomware groups targeting South Africa include Incransom, Thegentlemen, Lockbit3.

The most frequently targeted industries in South Africa are Business Services, Financial Services, Public Sector. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.

South Africa's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.

Organisations in South Africa should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.