Check Point Research has released its Global Threat Intelligence Report for September 2025, showing once again Africa as being the most targeted region for cyber attacks. These number an average of 2902 attacks per organisation per week, according to the report, with telecommunications, government and consumer goods and services being the industries most targeted on the continent.

Angola was the most attacked in September with 3045 weekly attacks per organisation (-54% YoY), followed by Kenya with 3,000 (-21% YoY), Nigeria with 2,749 (-32% YoY) and South Africa with 2054 (+26% YoY).

These attacks are high, seeing the report mentioned that organisations worldwide each faced an average of 1900 cyberattacks per week. Indeed, regionally, Africa reported the highest average number of weekly cyberattacks per organisation, but no continent was spared. Latin America had an average of 2826 per organisation per week (+7% YoY), APAC 2668 (–10% YoY) with Europe registering 1577 weekly attacks (–1% YoY), while North America stood out with a 17% year-over-year surge to 1468 weekly attacks, driven in part by a sharp increase in ransomware incidents.

"As Africans, we are deeply concerned about the continent's vulnerability to cyber attacks. Especially as many of the attacks in September were prompted by the use of Generative AI," says Lorna Hardie, regional director: Africa at Check Point Software Technologies.

"The only sustainable defence is a prevention-first strategy powered by real-time AI, ensuring protection across the network, cloud, endpoints and identities. Only through this approach can organisations stay ahead and protect critical operations from relentless adversaries,” she adds.

GenAI introduces new data exposure risks

With the rising use of Generative AI (GenAI) across all sectors, Check Point Research identified emerging risk from GenAI adoption. This is that one in every 54 GenAI prompts from enterprise environments posed a high risk of sensitive data leakage, impacting 91% of organisations that use GenAI tools regularly. 

An additional 15% of prompts contained potentially sensitive information, such as customer details, proprietary code or internal communications, underscoring the growing need for AI governance and data protection measures.

Looking at impact on the sectors, the education sector once again was the most targeted globally, experiencing an average of 4175 weekly attacks per organisation in September (–3% YoY). Check Point notes this consistent targeting reflects both the sector’s rapid digital transformation (which expands its attack surface), and its typically underfunded cyber security defences, which make it a frequent and easy target for cybercriminals.

The telecommunications industry, vital to business continuity and consumer connectivity, suffered 2703 weekly attacks per organisation (+6% YoY), highlighting its dual role as critical infrastructure and an access point to downstream targets. Government institutions, a long-standing focus for both criminal and nation-state actors, recorded 2,512 weekly attacks (–6% YoY).

Ransomware threat landscape

Ransomware remained one of the most disruptive and financially damaging cyber threats, with 562 publicly reported incidents globally in September, up 46% year-over-year. North America was the most affected region, accounting for 54% of reported cases, followed by Europe (19%). 

By industry, the Construction & Engineering sector was the most impacted sector by ransomware, representing 11.4% of reported victims, closely followed by Business Services (11%) and Industrial Manufacturing (10.1%). Other sectors, including Financial Services, Healthcare, and Consumer Goods, were also significantly affected, illustrating ransomware’s broadening scope according to Check Point.

Leading ransomware groups included Qilin (14.1% of attacks), Play (9.3%), and Akira (7.3%). Qilin, one of the most established RaaS (Ransomware-as-a-Service) groups, continues to expand aggressively, while Play and Akira are increasingly targeting critical sectors like manufacturing and business services using Rust-based encryptors and advanced runtime controls.

Omer Dembinsky, Data Research Manager at Check Point Research, says “September’s threat data shows that while the overall volume of attacks has eased slightly, the impact and sophistication of cyber threats are intensifying. Ransomware remains the most destructive force, while the emergence of GenAI-related data leakage adds a new dimension of risk for organisations. Cybercriminals will likely seek to exploit every innovation faster than users can adapt."