25 Sep South Africa faces escalating cyber threat landscape in 2025

South Africa’s cyber threat environment has reached alarming heights in 2025, cementing its status as Africa’s most digitally connected economy and a target for cybercriminals.

According to CYFIRMA research, ransomware remains the predominant threat, with the notorious group Devman accounting for 28.6 per cent of attacks, while others like Warlock and Incransom contribute significantly to the escalating crisis.

As hackers increasingly gain access to South African data, the risks extend far beyond financial loss. For example, ideologically driven hacktivists have been launching defacement campaigns against government and corporate websites, breaking down public trust and ruining essential services.

This use of ransomware, paired with extensive data leaks and motivated cyber activism, presents a complex challenge for organisations in South Africa to defend themselves against.

Vulnerabilities in tools such as WordPress and Apache are also leaving businesses exposed, as recent reports indicate significant data leaks, including the unauthorised release of consumer information and election-related data.

What do the experts say?
Industry experts are urging immediate investment in cyber resilience and workforce training to safeguard against the growing threat or risk of facing operational and reputational damage that will be costly.