South Africa

This page covers cyber threats to South Africa. It brings together official South African texts (the Information Regulator, the South African Government site, the Parliament record kept by the Parliamentary Monitoring Group, and the Government Gazette) and Brandefense research. Where an official source describes an incident or a rule, the page says who said it and when.

Threat groups that official sources link to South Africa

None of the official sources we opened names South Africa as a target of a group that has a profile in our threat group library. The official texts name a ransomware variant instead. A ministerial reply to Parliament on 11 November 2025 says the 2021 attack on the Department of Justice was attributed to the Mespinoza ransomware variant deployed by an unknown threat actor. Transnet told Parliament in October 2021 that its attack was ransomware and that a criminal investigation was in progress.

Incidents on record

The incidents listed below are major ones that South African authorities or the organizations themselves described, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

How attackers target South Africa: Brandefense research

Few of our own posts name South Africa. State-linked. Our post European Focused Threat Actors says the APT15 group, thought to be China-based, targets organizations in a number of European countries, the USA and South Africa. Brandefense also met South African technology and security teams at the iWeb Summit in Johannesburg on 3 June 2025, as recorded in our events archive.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Cybercrimes Act 19 of 2020 was published in the Government Gazette on 1 June 2021. The Minister of Justice said in October 2022 that it was being implemented in phases. Section 54 requires electronic communications service providers and financial institutions to report prescribed offenses to the police without undue delay and, where feasible, within 72 hours of becoming aware. A Hawks officer said on 3 October 2025 that cybercrime is enforced under the Cybercrimes Act, while cybersecurity matters are guided by the forthcoming Cybersecurity Bill. The Deputy Minister of Communications and Digital Technologies said in November 2025 that institutions are often under-resourced, skills pipelines are narrow and legislation is slow to keep pace.

How incident response is organized

The National Cybersecurity Hub is a Computer Security Incident Response Team hosted by the Department of Communications and Digital Technologies. It works closely with the South African Police Service on cybercrime investigations. The Hawks have a cybercrime investigation section, and the Hawks named phishing, ransomware, malware, identity theft and personal data theft as key threats. In the two incidents on record, departments and state companies reported to Parliament through written replies and committee meetings, and the Information Regulator took formal action on personal data.

Personal data

The Information Regulator was established in 2016 and enforces the Protection of Personal Information Act (POPIA). Its fact sheet says all security compromises must be reported, whatever the level of risk, through its eServices portal. POPIA gave responsible parties until 1 July 2021 to conform. An enforcement notice that is ignored can lead to an administrative fine of up to R10 million, and the notice itself warns of prison terms of up to ten years. In July 2023 the Regulator fined the Department of Justice R5 million for not complying with its notice. In August 2020 it said it had recorded 25 data breaches in four months.

The official South African sources opened give no national attack counts. Figures for South Africa will come from Brandefense Atlas.