Country
Ransomware attacks in South Africa
Ransomware groups have listed 122 organisations from South Africa on their leak sites since June 2022; the latest post is from 7 September 2026. Most active groups: Lockbit3, Thegentlemen and Incransom. Most affected sector: Professional Services.
Total posts
122
First seen
2022-06-04
Latest post
2026-09-07
Groups
51
Most active groups
- Lockbit3 18
- Thegentlemen 8
- Incransom 7
- Devman 6
- Dragonforce 5
- Ransomhub 5
- Clop 4
- Krybit 4
- Alphv 3
- Arcusmedia 3
Most targeted sectors
- Professional Services 21
- Government & Defense 16
- Financial Services 14
- Manufacturing 12
- Technology 11
- Retail & E-Commerce 10
- Energy & Utilities 7
- Healthcare 7
- Transportation 7
- Agriculture and Food Production 5