The number of ransomware attacks on South African organisations recorded by Microsoft rose from seven to 17 in the year to June. That was the third-steepest percentage rise among the 12 countries the company singles out in its latest global threat assessment.

The Microsoft Digital Defense Report 2026, published this week, covers the period from July 2025 to June 2026. According to the full report, South Africa’s 143% increase was exceeded only by Germany (276%) and Italy (181%), with Switzerland next at 103%. South Africa is the only African country in the table.

The US remains by far the most affected country, with 1 087 cases, while 5 798 of the 8 521 cases Microsoft counted globally could not be tied to a country at all. That unattributed pool shrank by 18% from a year earlier, so some country-level increases may reflect better attribution rather than more attacks. The global total dipped by 3%, even as Microsoft said its Defender platform “observed a 15.8% increase year-on-year in ransom detonations against enterprises”.

The report’s period includes the MIP Holdings breach, in which attackers inside an MIP support platform from late May to mid-June exposed the customers of about 45 local insurers. The attackers, The Gentlemen, went on to publish Hollard client data after Hollard refused its own ransom demand. MIP had paid the gang, as it later confirmed to TechCentral. The group has since listed more South African companies on its leak site, claims TechCentral has not been able to verify. Microsoft’s report does not name the organisations behind its country figures, so it is not known whether MIP is among the 17 cases.

Rand Water, the country’s biggest water utility, was hit by a cyberattack in recent weeks, but it has not said whether ransomware was involved.

Leak-site data compiled by Microsoft puts The Gentlemen, a newcomer to the top 10, fourth among the most prolific ransomware families, with 6% of victims posted on public leak sites. It sits behind Qilin (16%), Akira (8%) and Play (7%).

A distorted view?

Microsoft cautioned, however, that leak sites may present a distorted view. “Since new families like Gentlemen and Sinobi accounted for a significantly smaller proportion of events in our telemetry, this may suggest that leak site activity was heavily pushed to attract attention to these new offerings,” the report said.

Beyond ransomware, Microsoft said it “has observed growing cybercriminal activity impacting Latin America, Africa and Southeast Asia”, regions “where defences may be less mature at the same time that digital transformation is accelerating”.

Africa also features in Microsoft’s account of RedVDS, a subscription service that rented cheap, disposable virtual servers to fraudsters. Between 2023 and 2026, RedVDS gave more than 10 000 users access to up to 8 000 virtual desktops a month. Those users were “particularly heavily concentrated in Africa and the United States”, the report said.

RedVDS had been operating publicly since 2019. Microsoft took it down in January through civil lawsuits in the US and UK, while German authorities seized a key server and Europol helped target the wider network.

In Microsoft’s regional sample of nation-state activity, South Africa ranks fifth in the Middle East and Africa top 10, with 14 observed events, behind Israel (210), the UAE (50), Egypt (30) and Saudi Arabia (24). Ethiopia, with three, is the only other sub-Saharan country listed.

Microsoft said the median time from a vulnerability being discovered in the wild to it being weaponised has “collapsed to well below 24 hours”, and that 2026 is on track for a record of about 72 000 catalogued vulnerabilities. It also pointed to JadePuffer, which Microsoft describes as the first documented automated ransomware extortion attack. It took place in early July and was named by researchers at Sysdig.

Many intrusions still begin with the basics. In Microsoft’s incident response work, exploiting public-facing applications (24%, up from 15%) and phishing (23%, up from 7%) were the most common ways in this year.

MIP CEO Richard Firth has called for a ban on ransomware payments. Microsoft “strongly discourages ransom payments” but warns that “blanket bans risk revictimising organisations, suppressing reporting and weakening cooperation”. – © 2026 NewsCentral Media