South Africa Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, South Africa
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for South Africa, checked 7 Nov 2026. South Africa publishes no cyber threat level; the Information Regulator signals risk through enforcement notices and fines under POPIA.
Source: Information Regulator
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
| South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Data breach notifications received by the Information Regulator | 788 | January to March 2026 | ITWeb, quoting the Information Regulator |
Who is targeting it
Laws and rules this year
Full stories
- MIP Holdings breach exposes clients of about 45 insurers South Africa · 7 Sep 2026
Official statements
- 26 Oct 2026The Information Regulator fined FNB R1 million and Central Johannesburg TVET College R500,000 for POPIA contraventions. Information Regulator
- 29 Apr 2026The Information Regulator said the Polokwane High Court confirmed a POPIA fine on Blouberg Local Municipality, reduced to R250,000, for publishing a staff member's personal information online. Information Regulator
Incidents
8 of 8 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedFirst National Bank (FNB) | 26 Oct 2026 | Finance | Data leak | None | Confirmed. The Information Regulator said FNB filed a security compromise notification after customer account numbers were exposed through its digital home loan application platform, and fined the bank R1 million for weak safeguards. | Information Regulator✓ 7 Nov |
 ✅ ConfirmedHollardVia a vendorFull story | 7 Sep 2026 | Finance | Data leak | Confirmed. MIP linked the Hollard material to its June breach. Hollard refused to pay and says its own systems were not compromised. Claimed. The Gentlemen listed Hollard and published funeral policyholders' details. | TechCentral · ransomware.live✓ 8 Nov | |
 ✅ ConfirmedRand Water | 3 Sep 2026 | Energy | Intrusion | None | Confirmed. Rand Water told debt holders it was responding to an incident affecting some IT systems. It said water treatment and supply were unaffected and treasury ran from a disaster recovery environment. | TechCentral✓ 8 Nov |
 ✅ ConfirmedMIP HoldingsFull story | 26 Jun 2026 | Other | Data leak | Confirmed. Insurance software supplier MIP confirmed attackers used reused staff credentials to reach a support platform and took about 400,000 records tied to some 45 insurers. MIP paid a ransom, and data was published anyway. | TechCentral✓ 8 Nov | |
 ✅ ConfirmedAVBOB | 8 Jun 2026 | Finance | Intrusion | None | Confirmed. The funeral insurer confirmed that external attackers disrupted its digital platforms. Branches stayed open and worked manually. | IOL✓ 8 Nov |
 ✅ ConfirmedStatistics South Africa | 30 Mar 2026 | Government | Ransomware | Confirmed. Stats SA confirmed a breach of the HR database used by job applicants and said it would not pay and would notify the Information Regulator. Claimed. XP95 claimed 154GB from Stats SA and demanded about R1.7 million. | ITWeb✓ 8 Nov | |
 ✅ ConfirmedStandard Bank | 23 Mar 2026 | Finance | Data leak | Confirmed. Standard Bank disclosed unauthorised access to internal administrative and filing systems, and on 14 April said client data had been published online. Subsidiary Liberty disclosed its own breach a day after the first notice. Claimed. An actor called Rootboy claimed 1.2TB of data on a dark web forum. | Connecting Africa · TimesLIVE✓ 8 Nov | |
| ✅ ConfirmedLand Bank | 9 Mar 2026 | Finance | Ransomware | None | Confirmed. Finance Minister Enoch Godongwana told Parliament that attackers entered through an internet-facing server on 12 January and encrypted part of the server environment. The bank refused a five Bitcoin ransom and said farmer data was not compromised. | Briefly News✓ 8 Nov |
FAQ
Does South Africa have a national cyber threat level?
No published national cyber threat level was found for South Africa (checked 7 Nov 2026). South Africa publishes no cyber threat level; the Information Regulator signals risk through enforcement notices and fines under POPIA.
Which organisations in South Africa confirmed cyber incidents recently?
8 incidents confirmed since January 2026: First National Bank (FNB), Hollard, Rand Water, MIP Holdings, AVBOB, Statistics South Africa, Standard Bank and Land Bank.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.