Compromised credentials are now South Africa’s most common ransomware entry point

Compromised credentials have overtaken other technical causes as the most common starting point for ransomware incidents reported by South African organisations.

Sophos's 2026 South African ransomware study found compromised credentials accounted for 27% of incidents. The report surveyed 135 local IT and cyber-security leaders whose organisations had experienced ransomware during the previous 12 months.

The finding matters because the attack surface is no longer limited to an unpatched server or exposed service. A valid username, session or credential can allow an attacker to behave like an ordinary user long enough to move through a network.

Encryption is still getting through

Almost two-thirds of the South African incidents in the Sophos study resulted in data being encrypted. The local encryption rate was 63%, compared with a global average of 56% in Sophos's broader research.

That does not mean every incident caused a permanent loss of data. Sophos reported that 99% of organisations whose data was encrypted were ultimately able to recover it. How they recovered is changing.

The proportion restoring from backups increased to 54% from 35% a year earlier, while the percentage that paid a ransom and recovered data fell to 58% from 71%. That is progress, but the recovery bill remains severe.

A 63% encryption rate still says prevention is failing often enough that recovery is the plan. Backups are not a strategy if they are reachable with the same credentials the attacker just stole. Isolated, tested restores are the difference between those improving backup numbers and a second encryption event.

The cost is bigger than the ransom

The median ransom demand reported in South Africa was R6.9 million. Sophos estimated the average recovery cost at more than R17 million, excluding the ransom payment itself. That figure includes downtime, staff effort, network restoration, replacement or repair of systems and lost business.

The distinction matters for boards that still frame ransomware as a simple insurance problem. A company can refuse to pay and still face a multimillion-rand operational recovery. Insurers, when they pay at all, will ask about MFA, logging and backup isolation after the fact.

JSE-listed companies, hospitals, universities and municipalities are not abstract examples. Downtime on billing, claims, student records or rates collection is the recovery cost that never appears in the ransom note. Smaller firms may never see a R6.9 million demand. They can still be destroyed by a week offline.

Paying remains a legal, ethical and practical mess. Improving backup restoration is the cleaner trend in the Sophos numbers. It is also slower than writing a cheque, which is why the paid-and-recovered share is still 58%.

Identity controls need more than MFA

The wider Sophos global study found identity compromise played a dominant role in ransomware, with compromised identities involved in a large share of initial access. That makes multi-factor authentication important, but not sufficient.

Attackers can still exploit poorly enrolled accounts, legacy authentication, stolen sessions, help-desk weaknesses or gaps between identity systems. South African organisations therefore need to look at privilege, session monitoring, device trust and how quickly compromised accounts can be contained.

The most obvious risk is often not the administrator account. It is the ordinary account with enough access to become useful after lateral movement — finance, HR, a shared mailbox, a VPN user who never lost their token.

Help desks that reset passwords on a phone call are a gift. So are service accounts with passwords in scripts, and VPNs that sit in front of Active Directory without device checks. None of that is new. The 27% credential figure says it is still working for attackers.

POPIA incident duties, customer notification and, for some sectors, SARB or FSCA expectations turn a ransomware weekend into a regulatory event. Identity architecture is cheaper than that press cycle.

Why this matters now

South Africa continues to see large volumes of cyber activity — Check Point's August reading was 2,086 weekly attacks per organisation — while local organisations are increasingly exposed through cloud services, remote access and interconnected supply chains. That makes identity the common layer across many systems.

The lesson from the Sophos numbers is not that patching matters less. It is that patching alone no longer closes the most common door.

What remains unresolved is whether local organisations are changing identity architecture quickly enough to match the shift in attacker behaviour. The encryption rate suggests many are not yet doing so. MFA posters in the kitchen will not move that 27%. Conditional access, privileged-access workstations and backup planes that do not trust the same passwords might.

Treat identity as the backup's enemy

Sophos's 27% credential figure and 63% encryption rate say the same thing: attackers walk in as users, then encrypt. MFA stickers will not fix shared mailboxes, help-desk resets and backups on the same password plane.

R17 million average recovery cost is the budget argument. Spend a slice of that on privileged access and offline restores before the median R6.9 million demand becomes a board paper. The paid-ransom share is falling. Encryption is not falling fast enough. If 27% of local incidents start with stolen credentials, tabletop the help desk and the VPN before you tabletop the decryptor. The restore drill should assume the domain admin password is already in the chat log. If backups die in that drill, the R17 million is already earmarked. Pair this study with the Check Point weekly volume and you get the plot: constant knocking, identity as the latch, encryption still too common once someone is inside. Fix the latch.