Only 40% of the 135 South African organisations that experienced ransomware incidents in the past year recovered from their ransomware attack within one week, down from 47% in the year before.

Further, 13% of organisations took one to six months to recover, down from 19% in the prior year.

While fewer organisations experienced very long recovery periods, many were still unable to return to normal operations quickly, cybersecurity company Sophos notes in its 'State of Ransomware in South Africa 2026' report.

The recovery rate was the lowest rate of any country surveyed.

The report found that 63% of ransomware incidents in South Africa resulted in data being encrypted. This is above the global average of 56% and is an increase from the 60% reported by South African respondents in 2025, Sophos says.

The report is based on a global survey of 2 158 responses from IT and cybersecurity leaders working at organisations with 100 to 5 000 employees that experienced ransomware attacks during the previous 12 months, including 135 respondents from organisations in South Africa.

The impact also extended to the IT and cybersecurity professionals responsible for managing the incidents, with 52% of respondents in organisations in South Africa that had data encrypted in a ransomware attack reporting increased pressure from senior leaders, while 42% said their teams received greater recognition from leadership.

Additionally, 39% experienced changes to their team or organisational structure, 36% of respondents reported greater anxiety or stress about future attacks and 24% said the team’s leadership had been replaced.

Further, while the average cost of recovering from a ransomware attack in South Africa declined to R17-million, excluding any ransom payments, from R21-million in the 2025 report, it remains a considerable financial burden.

The recovery cost includes the cost of downtime, staff time, replacing or repairing devices, restoring networks and lost business opportunities.

“These figures show the extent of the disruption ransomware continues to cause in South Africa,” says Sophos in South Africa Southern African Development Community regional head Pieter Nel.

“Once attackers are able to encrypt data, the organisation faces the immediate challenge of restoring systems, maintaining operations and managing the financial and human impact of the incident. The most effective response begins before the attack, by closing the gaps that allow criminals to enter the environment.”

While the proportion of incidents resulting in encryption increased, South African organisations showed signs of improving their ability to recover, Sophos says.

Of the organisations whose data was encrypted, 99% were able to recover it. The proportion using backups to restore encrypted data increased to 54% this year from 35% in the 2025 report.

Simultaneously, fewer organisations relied on ransom payments. The percentage that paid a ransom and recovered its data fell to 58% from 71% in the previous report.

Data theft also declined, as information was stolen in 27% of attacks where data was encrypted, compared with 39% in the 2025 report.

Meanwhile, the median ransom demand made against South African organisations fell by 57%, to R6.8-million from R16-million in the 2025 report. The median ransom payment decreased by 28%, to almost R5-million from R6.9-million in the prior year.

South African organisations typically paid 71% of the original ransom demand. Although this was the lowest proportion of any country surveyed with a base of more than 30 respondents, it was higher than the 64% recorded in the 2025 report, Sophos notes.

“The increase in backup use and decline in ransom payments are positive developments,” says Nel.

“Backups must be properly protected, regularly tested and supported by a recovery plan that teams can follow under pressure. An organisation only discovers whether its recovery process works when it is tested or when a real incident occurs,” he adds.

VECTORS
Compromised credentials were the most common technical root cause of ransomware attacks in South Africa, accounting for 27% of incidents. Exploited vulnerabilities followed at 25%, down from 28% in the 2025 report, while malicious emails were responsible for 22% of attacks.

The findings also highlight the role of operational security weaknesses. A lack of adequate protection was identified as the most common operational root cause by 47% of South African respondents. This was the highest proportion recorded in any country surveyed.

Additionally, a lack of people or cybersecurity capacity was cited by 43% of respondents, while 42% said attackers exploited a known security gap.

For attacks that did not originate through email or phishing, user devices were the most common entry point, accounting for 43% of incidents. Exposed applications and systems were used in 38% of attacks, followed by firewalls at 13%, Sophos says.

Further, the connection between ransomware and identity-based attacks was particularly pronounced in South Africa.

Of the local organisations surveyed, 85% said their ransomware incident was the same event as their most significant identity attack during the year. This was significantly higher than the global average of 67%.

“Ransomware attacks frequently begin with an identity, device or security weakness that the organisation already knows exists. Compromised credentials allow criminals to appear as legitimate users, while unpatched vulnerabilities and exposed systems provide additional routes into the business.

“Addressing these risks requires strong identity controls, properly configured security technologies and enough skilled capacity to monitor and respond to threats,” says Nel.

Sophos recommends that organisations strengthen identity security by implementing identity threat detection and response, enforcing multi-factor authentication across all access points and regularly auditing both human and non-human credentials.

Organisations should also maintain strong endpoint protection, address known vulnerabilities promptly and improve email security through advanced filtering, appropriate email authentication protocols and regular phishing awareness training.

Backup systems should be tested regularly, stored offline or in immutable formats and incorporated into a documented incident response plan.

Organisations that do not have sufficient internal capacity should consider specialist support that provides continuous monitoring, detection and response, the company recommends.