SA has 92% of Africa's ransomware. How to keep hackers out of your accounts
Interpol says South Africa accounts for 92% of ransomware detections in Africa. How attackers get in and the government's advice to protect your accounts and money.
South Africa accounts for 92% of ransomware detections in Africa, according to Interpol's 2026 African Cyberthreat Assessment Report (The Citizen). The Department of Communications and Digital Technologies (DCDT) and the Film and Publication Board (FPB) have warned that the threat didn't end with Cybersecurity Awareness Month in October (The Citizen).
Ransomware locks or steals your files and demands payment to release them. It hits businesses hardest, but the way in is often an ordinary person's password or phone.
How do hackers get in?
Experts say most attacks start well before any ransom demand. Criminals get access through stolen passwords, infostealer malware, or devices that haven't been updated, such as home and office routers and VPNs (The Citizen).
Cybersecurity firm Fortinet reported a sharp rise in infostealers, which quietly copy saved passwords, banking details and login sessions from infected devices (The Citizen).
South Africa also had 43.6% of the exploitable software flaws found across Africa in 2025, and criminals now use new flaws within 24 to 48 hours of them being made public (The Citizen). That's why delayed updates are risky.
What does the government say you should do?
The DCDT says criminals mostly exploit human error, not technical weaknesses (The Citizen). Its advice:
- Never share a one-time PIN (OTP) with anyone, including someone claiming to be from your bank.
- Use a strong, different password for each account.
- Switch on two-factor authentication wherever it's offered.
- Check a message is genuine before you click a link or send money.
- Keep your phone, computer and router software up to date.
For work accounts, experts also advise against saving work logins on shared devices (The Citizen).
"Something as simple as not sharing your OTP, using a strong password, verifying information before sending money or thinking twice before clicking a link can prevent serious financial and personal harm," the department said (The Citizen).
What if you've already been hit?
If money or banking details are involved, call your bank's fraud line straight away using the number on the back of your card or on its official website, and ask for your cards and online banking to be blocked. Report the crime at your nearest police station or through SAPS, and keep screenshots of messages and transaction details as evidence.
FAQ
What share of Africa's ransomware hits South Africa?
Interpol's 2026 African Cyberthreat Assessment Report says South Africa accounts for 92% of ransomware detections in Africa.
How do ransomware attacks usually start?
Usually through stolen passwords, infostealer malware that copies saved logins, or devices such as routers and VPNs that haven't been updated.
Should I share an OTP if my bank asks?
No. The DCDT says never share a one-time PIN with anyone. Banks don't ask for it.