Bad news for local companies who might come under cyberattack, as the new State of Ransomware in South Africa 2026 report from cybersecurity company, Sophos, found that almost two-thirds (63%) of ransomware incidents in South Africa over the past year resulted in data being encrypted. This is above the global average of 56% and an increase from the 60% reported by South African respondents in 2025.

Sophos notes although the proportion of incidents resulting in encryption increased, South African organisations showed signs of improving their ability to recover. Indeed, of the organisations whose data was encrypted, 99% were able to recover it.

The proportion using backups to restore encrypted data increased from 35% in the 2025 report to 54% this year. At the same time, fewer organisations relied on ransom payments. The percentage that paid a ransom and recovered its data fell from 71% in the previous report to 58%.

The report further states the average cost of recovering from a ransomware attack in South Africa was over R17 million ($1.08 million), excluding any ransom payments. While this was down from R21 million ($1.31 million) in the 2025 report, it remains a considerable financial burden. Sophos  notes the figure includes the cost of downtime, staff time, replacing or repairing devices, restoring networks and lost business opportunities.

“These figures show the extent of the disruption ransomware continues to cause in South Africa,” says Pieter Nel, regional head SADC for Sophos in South Africa. “Once attackers are able to encrypt data, the organisation faces the immediate challenge of restoring systems, maintaining operations and managing the financial and human impact of the incident.” It is for this reason Nel believes the most effective response begins before the attack, by closing the gaps that allow criminals to enter the environment.

The State of Ransomware in South Africa 2026 report is based on responses from 135 IT and cybersecurity leaders working at South African organisations that experienced ransomware during the previous 12 months.

Why South African organisations fall victim

According to the report, compromised credentials were the most common technical root cause of ransomware attacks in South Africa, accounting for 27% of incidents. Exploited vulnerabilities followed at 25%, down from 28% in the 2025 report, while malicious emails were responsible for 22% of attacks.

The findings also highlight the role of operational security weaknesses. A lack of adequate protection was identified as the most common operational root cause by 47% of South African respondents. This was the highest proportion recorded in any country surveyed. A lack of people or cybersecurity capacity was cited by 43%, while 42% said attackers exploited a known security gap.

For attacks that did not originate through email or phishing, user devices were the most common entry point, accounting for 43% of incidents. Exposed applications and systems were used in 38% of attacks, followed by firewalls at 13%.

The connection between ransomware and identity-based attacks was particularly pronounced in South Africa. Of the local organisations surveyed, 85% said their ransomware incident was the same event as their most significant identity attack during the year. This was significantly higher than the global average of 67%.

“Ransomware attacks frequently begin with an identity, device or security weakness that the organisation already knows exists,” says Nel. “Compromised credentials allow criminals to appear as legitimate users, while unpatched vulnerabilities and exposed systems provide additional routes into the business. Addressing these risks requires strong identity controls, properly configured security technologies and enough skilled capacity to monitor and respond to threats.”

More organisations turn to backups

As far as improvements are concerned, the report states data theft declined, with information stolen in 27% of attacks where data was encrypted, compared with 39% in the 2025 report.

The median ransom demand made against South African organisations fell by 57%, from R16 million ($1 million) last year to R6,8 million ($427,000). The median ransom payment decreased by 28%, from $425,241 to almost R5 million ($305,000).

South African organisations typically paid 71% of the original ransom demand. Although this was the lowest proportion of any country surveyed with a base of more than 30 respondents, it was higher than the 64% recorded in the 2025 report.

“The increase in backup use and decline in ransom payments are positive developments,” says Nel. “Backups must, however, be properly protected, regularly tested and supported by a recovery plan that teams can follow under pressure. An organisation only discovers whether its recovery process works when it is tested or when a real incident occurs.”

Recovery remains a lengthy process

As far as recovery is concerned, only 40% of South African organisations where back to fully operational from their ransomware attack within one week. This was the lowest rate of any country surveyed and down from 47% in the 2025 report. A further 13% took between one and six months to recover, compared with 19% in the previous report. Sophos believes this indicates that while fewer organisations experienced very long recovery periods, many were still unable to return to normal operations quickly.

The impact also extended to the IT and cybersecurity professionals responsible for managing the incidents. Among organisations where data was encrypted, 52% reported increased pressure from senior leaders, while 42% said their teams received greater recognition from leadership.

Another 39% experienced changes to their team or organisational structure, 36% reported greater anxiety or stress about future attacks, with close to a quarter of respondents (24%) noting the team’s leadership had been replaced.

Strengthening ransomware resilience

Sophos recommends that organisations strengthen identity security by implementing identity threat detection and response (ITDR), enforcing multi-factor authentication across all access points and regularly auditing both human and non-human credentials.

Organisations should also maintain strong endpoint protection, address known vulnerabilities promptly and improve email security through advanced filtering, appropriate email authentication protocols and regular phishing awareness training.

Backup systems should be tested regularly, stored offline or in immutable formats, and incorporated into a documented incident response plan. Organisations that do not have sufficient internal capacity should consider specialist support that provides continuous monitoring, detection and response.

Research methodology

The report forms part of Sophos’ seventh annual global State of Ransomware research. The independent, vendor-agnostic study surveyed 2,158 IT and cybersecurity leaders at organisations that experienced ransomware during the previous year, including 135 respondents from South Africa. The survey was conducted between January and March 2026. Respondents worked at organisations employing between 100 and 5,000 people. All financial figures are reported in US dollars, and ransom amounts of $40 million or more were excluded as outliers.