South Africa accounted for 92% of all ransomware detections across Africa in 2025, meaning nine in every ten detected ransomware incidents on the continent occurred in a single country.
This is based on data obtained from TrendAI via a 2026 INTERPOL report.
The visualization above shows the distribution of ransomware detections across African countries.
It shows where Africa has the cybersecurity infrastructure to detect ransomware attacks, not necessarily where these attacks.
TL;DR
- South Africa accounted for 92% of all ransomware detections across Africa in 2025, with the remaining 54 African countries combined accounting for just 8%.
- The figure reflects where Africa has cybersecurity infrastructure to detect attacks (not necessarily where attacks are most concentrated), meaning most of the continent’s ransomware activity is going undetected.
- Cabo Verde, a small island nation of approximately 590,000 people, recorded the second-highest detection share on the continent at 4%.
ALSO READ: Ranked: Cybersecurity Investment Priority for Companies in 2026
Detection Not the Same as Attack
| wdt_ID | wdt_created_by | wdt_created_at | wdt_last_edited_by | wdt_last_edited_at | Country | Share of Detections (%) |
|---|---|---|---|---|---|---|
| 1 | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | South Africa | 92 |
| 2 | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | Cabo Verde | 4 |
| 3 | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | Kenya | 2 |
| 4 | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | Nigeria | 1 |
| 5 | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | emmanuel-ashemiriogwa | 08/08/2026 03:46 PM | Others | 1 |
Ransomware detections occur when security software identifies malicious code or suspicious behavior on a protected system.
A country without enterprise-grade cybersecurity tools does not detect ransomware; it simply experiences it without knowing.
South Africa’s 92% share of African detections is not primarily a record of where ransomware attacks are concentrated.
It is a record of where Africa has the infrastructure to see them coming.
South Africa has the continent’s:
- Most developed banking sector
- Highest concentration of multinational corporations with global cybersecurity standards
- Most widespread deployment of enterprise security software in Africa.
It has more valuable digital targets (and more tools to detect attacks on those targets) than any other African country by a significant margin.
The Nigeria gap
The detection shortfall becomes most visible when Nigeria is placed against its own economic profile.
Nigeria is Africa’s largest economy by GDP, with over 220 million people and one of the continent’s most active technology and fintech ecosystems.
Lagos has more tech startups than almost any other African city.
Yet Nigeria accounts for just 1% of African ransomware detections in 2025.
ALSO READ: Countries With The Most Data Breaches In 2026
What the 1% actually means
The combined 1% attributed to all other African countries covers approximately 50 nations (including Ethiopia (population: approximately 120 million), DR Congo (approximately 100 million), Egypt (approximately 105 million), and Tanzania (approximately 65 million)
This is not because ransomware is absent from those countries.
Global ransomware groups (including known operators such as LockBit and ALPHV) do not filter their targets by continent.
They target vulnerabilities, payment capacity, and attack surface.
African organizations in all 54 countries are exposed to the same threat actors operating globally. The attacks are happening. The detections are not.
The 1% is a measurement of cybersecurity infrastructure capacity.
Countries without enterprise security software, institutionalized incident reporting, or dedicated cybersecurity agencies are structurally invisible to a list like this one.
The most significant finding in this report may be the scale of what it cannot see.
ELI5
Ransomware is a type of cyberattack that locks computer systems until a ransom is paid.
In Africa in 2025, 92% of all detected ransomware attacks were found in South Africa (not because other countries are safe, but because most African countries lack the cybersecurity tools to even detect an attack).
A tiny island called Cabo Verde had the second-highest detection rate, while Nigeria, Africa’s biggest economy, barely registered in the data.
Source:
