Country
Ransomware attacks in South Africa
Ransomware groups have listed 133 organisations from South Africa on their leak sites since June 2022; the latest post is from 16 October 2026. Most active groups: Lockbit3, Thegentlemen and Incransom. Most affected sector: Professional Services.
Total posts
133
First seen
2022-06-04
Latest post
2026-10-16
Groups
53
Most active groups
- Lockbit3 18
- Thegentlemen 12
- Incransom 8
- Devman 6
- Dragonforce 5
- Krybit 5
- Ransomhub 5
- Clop 4
- Alphv 3
- Arcusmedia 3
Most targeted sectors
- Professional Services 23
- Financial Services 16
- Government & Defense 16
- Manufacturing 15
- Technology 12
- Retail & E-Commerce 10
- Transportation 9
- Healthcare 8
- Energy & Utilities 7
- Agriculture and Food Production 5