According to the Microsoft Digital Defense Report 2026, covering the period from July 2025 to June 2026, the number of ransomware attacks on South African organizations increased from seven to seventeen. This growth was the third largest percentage increase among twelve countries highlighted by the company in its latest global threat analysis.
The full report notes that the increase in South Africa amounted to 143%, which is surpassed only by Germany (276%) and Italy (181%); Switzerland ranked third with a growth of 103%. South Africa is the only African country represented in this table.
The United States remains the most affected country, registering 1087 cases. Furthermore, 5798 out of the total 8521 cases counted by Microsoft worldwide could not be attributed to any country. This unexplained pool decreased by 18% compared to the previous year, which may indicate improved attribution rather than an increase in attacks.
The global overall figure decreased by 3%, despite Microsoft's statement that its Defender platform 'recorded a 15.8% year-on-year increase in ransomware incidents against enterprises.'
Impact of the MIP Holdings incident
The period covered in the report includes the security breach incident at MIP Holdings. During this incident, attackers inside the MIP support platform disclosed data from approximately 45 local insurance companies from late May to mid-June. A group known as The Gentlemen published the client data of Hollard after it refused to meet ransom demands. MIP subsequently confirmed that it paid this group. According to TechCentral, the group has since posted more South African companies on its leak site, which TechCentral could not verify. Since the Microsoft report does not name the organizations behind the country data, it is unknown whether MIP is included in the 17 affected cases.
The country's largest water utility, Rand Water, was subjected to a cyberattack in recent weeks, but it did not specify whether ransomware was involved.
Data on leak sites collected by Microsoft shows that The Gentlemen, being a newcomer to the top 10, ranks fourth among the most active ransomware families, responsible for 6% of victims posted on public leak sites. They trail Qilin (16%), Akira (8%), and Play (7%).
Potentially skewed representation?
Nevertheless, Microsoft warned that leak sites may present a distorted picture. The report states: 'Since new families, such as Gentlemen and Sinobi, constituted a significantly smaller share of events in our telemetry, this may suggest that activity on leak sites was heavily focused on drawing attention to these new offerings.'
In addition to ransomware, Microsoft reported growing cybercrime activity affecting Latin America, Africa, and Southeast Asia—regions 'where defenses may be less mature concurrently with accelerating digital transformation.'
Africa also features in Microsoft's RedVDS report, a subscription service that provided cheap, temporary virtual servers to fraudsters. Between 2023 and 2026, RedVDS provided access to up to 8,000 virtual desktops per month to over 10,000 users. These users were 'particularly heavily concentrated in Africa and the United States.'
RedVDS operated publicly since 2019. Microsoft shut it down in January through civil lawsuits in the US and UK, while German authorities confiscated a key server, and Europol assisted in targeting a wider network.
In Microsoft's regional selection regarding nation-state activity, South Africa ranks fifth in the top 10 of the Middle East and Africa, registering 14 incidents, trailing Israel (210), UAE (50), Egypt (30), and Saudi Arabia (24). Ethiopia, with three cases, is the only other sub-Saharan African country mentioned.
Microsoft noted that the median time from discovering a wild vulnerability to its exploitation 'has decreased to well under 24 hours,' and that 2026 is on track to achieve a record of around 72,000 cataloged vulnerabilities. The company also pointed to JadePuffer, which Microsoft describes as the first documented automated ransomware attack. It occurred in early July and was named by researchers from Sysdig.
Many intrusions still begin with basic methods. According to Microsoft's incident response work, the most common methods this year were exploiting public applications (24%, up from 15%) and phishing (23%, up from 7%).
MIP CEO Richard Firth called for a ban on ransom payments. Microsoft 'strongly advises against paying ransoms,' but warns that 'universal bans risk re-exposing organizations by suppressing reporting and weakening cooperation.'