Sophos: South African organizations under pressure from ransomware

Sophos published its State of Ransomware in South Africa 2026 report: 63% of incidents resulted in data encryption, 58% of organizations paid a ransom, the median demand was 6.9 million rand, and the average recovery cost exceeded 17 million rand.

• 63% of incidents led to data encryption, above the global average of 56%
• 58% of organizations paid a ransom and restored data, down from 71% in 2025
• Median ransom demand was 6.9 million rand, average recovery cost 17 million
• 85% of ransomware attacks coincided with the year's largest identity attack