One cyber event every eight minutes. That is how often attackers targeted African organisations in 2025, according to a new Mastercard whitepaper. The same report says attacks in Africa grew by more than 421% between 2016 and 2025, against 307% worldwide. Africa still sees fewer attacks than other regions. But it is catching up fast, and the reasons are as important as the numbers.
This deep dive covers what the whitepaper says and how to read its headline figure. It shows where the threats are and who is behind them. It ends with what founders, banks and governments can do. We also flag where sources disagree. We note where the data comes from a company with a stake in the answer.
What the whitepaper found
The paper is called “Africa’s Digital Defense Race.” Mastercard published it in October 2026. It covers South Africa, Nigeria, Morocco and Kenya. It draws on Mastercard Cyber Insights, industry research, law enforcement intelligence and expert interviews. The table below shows the main numbers.
| Measure | Finding |
|---|---|
| Growth in cyberattacks, 2016 to 2025 | Africa 421.4%, global 307.3% |
| Observed cyber events against African organisations, 2025 | 69,236 (about one every eight minutes) |
| Share of events hitting Nigeria, South Africa, Morocco and Kenya | 54.7% |
| Share of activity aimed at technology, public sector and financial services | 44% |
| Events linked to hackers and organised criminal groups | More than 60% |
| Unfilled cybersecurity jobs in Africa | About 200,000 (a 23% workforce gap) |
| Cybersecurity spending, share of GDP | Mature markets about 0.25%, South Africa about 0.19%, rest of sub-Saharan Africa about 0.03% |
Ecofin Agency adds that Africa’s share of global cyberattacks rose from about 3.4% to 4.4% over the period. We could not open the full whitepaper, so these figures come from Mastercard’s summary page and news coverage of the report.
How to read “421%”
A growth rate tells you how fast something moved, not how big it is. Africa’s 421% means attacks multiplied by about 5.2. The global 307% means they multiplied by about 4.1. Divide one by the other and Africa’s share of attacks should have risen by roughly 28%. That matches the move from 3.4% to 4.4% that Ecofin reports. This is our own arithmetic.
So the honest reading is this. Africa is not the world’s main target. It receives only a small slice of global attacks. But that slice is growing faster than the global average. The continent started from a low base, then went online very quickly.
Why attacks are growing so fast
The whitepaper calls it a “compressed vulnerability cycle.” Other regions took decades to move from cash to cards to mobile apps. Many African markets did it in under ten years. Between 2016 and 2025, the report says mobile money users grew 5.9 times and digital banking users grew 4.7 times. E-commerce grew about five times, although sources differ on the exact figure, with one giving 5.3 times and another 4.2 times.
More money moving through phones means more targets. Criminals follow money, so they follow the growth. The report also says attacks increasingly hit banks, telecom operators, government systems and logistics networks. They no longer target only consumers through phishing and scams.
Where the threats are
The four countries in the report took more than half of all observed events. The table shows why each one stands out.
| Country | Share of observed events | Why, according to the report |
|---|---|---|
| Nigeria | 24.4% | Large fintech ecosystem |
| South Africa | 12.6% | Concentrated financial sector |
| Morocco | 10.6% | Regional tech hub with fairly formal cyber governance |
| Kenya | 7.1% | Systems that support financial inclusion |
Nigeria alone took nearly a quarter of the events. Note what this does and does not say. These are events Mastercard observed, so the numbers depend on where its sensors and customers are. A country with more Mastercard visibility may look more attacked. Smaller markets may be under-counted.
Who is behind the attacks
More than 60% of attributed events were linked to hackers and organised criminal groups, per the whitepaper. Ecofin adds that politically motivated actors accounted for 13.9% and state-sponsored actors for 9.7%. The main message is that most attacks are for profit. That is good news in one way. Profit-driven criminals tend to go after easy targets, so basic defences can push them elsewhere.
INTERPOL’s 2026 African Cyberthreat Assessment, reported by Nairametrics, adds a sharper picture. It says AI is linked to 55% of reported cybercrimes in Africa. It puts losses at about $484 million in 2025, up from $192 million in 2024. It also points to East Africa as a hub for mobile money fraud. In that survey, 72% of the 36 countries reported scam centres.
Here, sources disagree. Ecofin reports that cybercrime caused “at least $5 billion” in direct losses in 2025, citing INTERPOL estimates. The INTERPOL assessment, as reported by Nairametrics, gives about $484 million. We could not reconcile the two. They may measure different things, so we do not rely on either as a total.
The people problem
The whitepaper argues the defence is weak partly because there are too few people to run it. About 200,000 cybersecurity jobs are empty, equal to 23% of the current workforce. More than 80% of African organisations report shortages of AI and cyber talent, the highest share of any region. And only 11% of tertiary graduates have received formal digital training.
Law enforcement faces the same gap. The report says 92% of African law enforcement agencies cite a lack of technical expertise as the main barrier to using AI tools. And 89% of officers say cross-border cooperation is the biggest barrier to successful investigations. Money moves across borders in seconds. Investigations do not.
Cooperation can work. INTERPOL’s Operation Serengeti 2.0 ran from June to August 2025. It led to 1,209 arrests across 18 African countries. It also recovered $97.4 million, according to the coverage.
The spending gap
Mature cybersecurity markets spend about 0.25% of GDP on defence. South Africa, the best performer in Africa, spends about 0.19%. The rest of sub-Saharan Africa spends about 0.03%, around one eighth of the mature-market level.
Startups feel this too. Ecofin reports that African fintech startups now spend 8% to 12% of operating expenses on cybersecurity, up from 3% to 5% in 2020. That is a large share for a young company, and it is not optional.
What to do about it
The recommendations below mix the whitepaper’s priorities with our own analysis, which we mark as such.
From the whitepaper: coordinate responses among governments, banks and businesses. Share threat intelligence, including through the Africa Cybersecurity Center of Excellence that Mastercard launched in July 2026. Invest in talent. Build readiness through scenario exercises.
Our analysis for founders and small firms:
- Treat security as a product feature from day one. Customers of fintechs and payment apps judge you on trust.
- Turn on multi-factor authentication for every staff account and every admin tool.
- Limit who can see customer data, and review access every quarter.
- Keep a written plan for what you will do in the first hour of a breach, and practise it.
- Train staff on phishing, SIM-swap fraud and fake invoices. Check Point, a security vendor, says SIM-swap fraud alone costs South Africa over R5 billion a year.
- Ask vendors and partners how they protect your data. Their weakness becomes yours.
Our analysis for policymakers: fund training pipelines, harmonise rules across borders, and make real-time data sharing between banks, telecoms and police normal, not exceptional.
How much weight to give this report
Read it with care. The whitepaper was published by Mastercard, which sells security and fraud products. A Times Live article promoting it was labelled as paid for by Mastercard. That does not make the numbers wrong. It does mean the framing leans toward urgency. The core data come from Mastercard’s own Cyber Insights, so independent checks matter. Other vendor reports use different methods. Check Point’s figure of about 3,153 weekly attacks per African organisation is one example. These numbers cannot be compared directly.
The direction, though, matches other sources. INTERPOL also reports rising losses, more AI-enabled crime and weak cross-border response. When independent and commercial sources point the same way, the trend is probably real, even if the exact numbers are not.
Sources: Mastercard, Africa’s Digital Defense Race whitepaper page; Connecting Africa; Ecofin Agency; Times Live (sponsored content paid for by Mastercard); Nairametrics on INTERPOL’s African Cyberthreat Assessment; Check Point’s 2026 Africa trends via Intelligent CIO.
A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.
