Uganda electricity transmission (August 2025)
A suspected ransomware attack compromised systems used to monitor the national grid. Power grids are now digital targets for cyber-attackers.
LoadingLoadingLoading
Mobile money, fintech, digital identity and cloud services reshaping financial inclusion, trade and public services.
Market view
Africa’s digital economy has more than 1.1 billion mobile subscribers in 2025 with mobile money, fintech, digital identity and cloud services reshaping financial inclusion, trade and public services. Utilities, ports, telecoms and government agencies are digitising quickly, often connecting legacy systems to new platforms.
Security capability has not always kept pace. Under-resourced security teams, legacy systems and limited real-time data sharing among key entities such as banks, telecoms and law enforcement create openings that criminals usually exploit at scale. Generative AI has lowered the cost of convincing social engineering scams, and cybercrime-as-a-service platforms have lowered barriers to entry. Institutions require fraud controls, resilient operations, and local skills that can be sustained to support digitalisation growth.
Africa is the region that advanced most in the ITU’s Global Cybersecurity Index 2024 (the latest published edition) compared with 2021, and seven African countries reached Tier 1, the “role-modelling” tier that 46 countries worldwide achieved. Most countries in the region sit in the “establishing” and “evolving” tiers, where digital services and connectivity have expanded but cybersecurity measures still need to be integrated. The Bureau’s analysis highlights persistent gaps in capacity, skills, national incident response and technical measures, as well as capacity to mitigate emerging AI-based risks.
Threat landscape
INTERPOL’s 2026 assessment, drawing on data from 36 African member countries, describes cybercrime as an industrialised, borderless ecosystem. Reported losses rose from $192 million to $484 million and identified victims rose from 35,000 to 87,000. AI was involved in 55% of reported cases. Online scams were the most reported crime, using mobile money, social media and AI-generated voices, images, and messages, and scam centres were reported in 72% of surveyed countries.
The picture varies by region. East Africa is a hub for mobile-money fraud and ransomware against infrastructure. West Africa recorded the most business email compromise cases. Southern Africa experienced the heaviest concentration of ransomware, phishing and DDoS attacks. Ransomware groups are targeting the healthcare, power utility and education sectors, and attackers increasingly use ransomware to disrupt public services because disruption gives them leverage. Because cybercriminals operating from the region also target firms in Europe and North America, global organisations with African partners, subsidiaries or payment flows share this exposure. Recent incidents (publicly published) illustrate the shift from theft to disruption:
Sector exposure: Financial services face SIM-swap fraud, business email compromise and credential theft, all increasingly AI-enabled. Telecoms face DDoS, data exposure and network disruption. Energy and utilities face ransomware that disrupts operations and grid monitoring, and public-sector and trade bodies such as ports, customs and weather services face disruption of essential services. Our analysis reveals that healthcare and education institutions are targeted by ransomware groups because they are under-resourced with respect to cybersecurity investments.
A suspected ransomware attack compromised systems used to monitor the national grid. Power grids are now digital targets for cyber-attackers.
Ransomware disrupted cargo clearance at major ports, with significant demurrage charges and import delays affecting thousands of traders. This disruption of trade infrastructure created economic damage far beyond the victim organisation.
Hunters International ransomware compromised Telecom Namibia’s systems, exposing over 619,000 client records, including personal and financial data belonging to government ministries, regional councils, airlines and private companies. The operator refused to pay the ransom demand, and the stolen data was subsequently published online. Weeks later, a separate cyberattack disrupted the voice services and cloud-hosted environments of a second operator, Paratus Namibia.
A suspected ransomware attack corrupted meteorological data systems, with knock-on effects for aviation and maritime services. Data integrity attacks on public-service systems ripple into transport safety, including air transport.
INTERPOL uncovered an attempt to divert $7.9 million from a petroleum company using business email compromise, and the destination account was frozen. Fraud networks in the region target international businesses, which makes payment-verification controls essential.
A cyberattack disrupted the airline’s website, mobile application and several internal operational systems. Systems were restored on the same day, and the airline notified national security agencies and the Information Regulator. A forensic investigation was launched to determine whether passenger and employee data was exposed. The incident shows that national carriers are high-value targets and that rapid containment, not just prevention, is now a board-level expectation.
Regulation
Regulation is expanding quickly and unevenly. The common trend is a shift from enacting laws to enforcing them.
Multi-country organisations should therefore design to the strictest applicable regime and maintain a single register of registrations, officer appointments, impact assessments and transfer mechanisms across every jurisdiction in which they operate.
Continental framework
The African Union’s Convention on Cyber Security and Personal Data Protection (Malabo Convention) entered into force on 8 June 2023 and sets common principles for data protection, cybersecurity and electronic transactions. Ratification is incomplete, with several large economies yet to ratify, and some governments are now moving to accede.
National data protection laws with independent authorities
A growing number of countries have enacted data protection laws and established regulatory bodies. Some regulators have moved from registration drives to compliance audits, formal notices and financial penalties.
Extraterritorial reach and data transfers
Newer rules apply to foreign organisations that target local residents. They impose transfer impact assessments, approvals or equivalence tests for cross-border transfers.
Cybersecurity Authorities
A growing number of African countries are establishing dedicated agencies responsible for cybersecurity. These agencies are increasingly empowered by law to regulate cybersecurity activities, including licensing of cybersecurity service providers.
Cybercrime and fraud legislation
Governments are updating cybercrime laws to address SIM-swap fraud, scam calls, online scams and the misuse of AI and are tightening obligations for telecoms and financial institutions.
Critical infrastructure and incident reporting
National strategies, sector regulators and computer emergency response teams are formalising expectations for critical sectors, although capacity and reporting quality vary widely.
Fragmentation
Our regional assessments highlight jurisdictional obstacles, divergent data protection rules and limited law-enforcement capacity as barriers to cross-border response.
Looking ahead
We expect a rise in AI-enabled voice and video impersonation against mobile-money and banking channels, and continued ransomware pressure on utilities, telecoms, government, health and the extractive sector. Regulators are likely to move further towards audits and penalties. In addition, governments are likely to accede to continental and relevant international frameworks.
How we help
We support our clients in Africa in focusing on the controls that most reduce loss and in building capacity against current and emerging threats. Engagements typically begin with gap assessment and fraud and ransomware exposure review for highly exposed client, and produce a risk-ranked 90-day action plan that supports:
Contact our Africa team to assess your cyber risks and compliance exposure.
Risk-based roadmaps that prioritise the controls with the greatest effect on fraud and ransomware losses.
AI inventories, risk classification and control design to support security-guided AI adoption.
Programmes across multiple national regimes, including officer support, impact assessments, registration and implementation of compliance frameworks to meet regulatory mandates.
design and implement programmes to support threat monitoring, incident response, business continuity and cyber resilience to support business operations.
Attack-surface discovery, vulnerability assessment and prioritisation and secure configuration reviews.
Training and capacity development as well as professional mentoring for in-house security teams.
Insights ·
Source · INTERPOL
Read more →