Report: Africa Now Faces the World’s Most Cyber Threats

Africa is now the most attacked region in the world for cyber threats, with firms facing an average of 3,834 attacks a week in October 2026. Nigeria sits at the top of the country table, and the rise in AI-powered crime is a big reason why.

The figures come from Check Point Research, a cyber security company, and they cover October. Attacks on African firms rose 38% in a year, and Nigeria’s rose 140%. At the same time, firms across the world are leaking sensitive data into AI tools, and ransomware gangs claimed a record number of victims. This report goes through the numbers. It shows what they prove and what they do not. It also says what they mean for African banks, governments, startups and their users.

Start with the headline number. Check Point counts attacks per firm per week from its own threat data. In October, the average African firm faced 3,834 of them. Latin America came next with 3,483, and Asia-Pacific followed with 3,436. Europe grew fastest, at 39% a year, just ahead of Africa’s 38%. The world average was 2,550 attacks a week, which is 9% lower than September and 32% higher than October 2025. By our sums, Africa’s figure is about 50% above the world average.

Africa did not arrive at the top overnight. Coverage of the report says it is the first time in more than a year that Africa has led. Check Point’s earlier monthly reports show the climb. In August 2026 the continent averaged 3,335 weekly attacks. In September it was 3,701, second behind Latin America’s 3,813. In October it reached 3,834, and Latin America fell back. By our sums, that is a rise of about 15% in two months, even as the global average fell in October.

Now the country table, which tells a sharper story than the regional average.

Three African countries sit in the top four. Yet South Africa, the continent’s most developed economy by many measures, sits below the world average, with 2,191 a week against 2,550. That gap matters. It shows that “Africa” is not one number. A few countries with fast-growing digital sectors, big money flows and thin defences are pulling the average up. By our sums, Nigeria’s October figure is about 2.6 times the world average.

How did each country move over the last three months? The table below uses Check Point’s monthly reports as covered by Nairametrics, Techeconomy and the October release.

Nigeria’s climb is the steepest. By our sums, its weekly figure rose about 36% from August to October. It was Angola that led Africa in August and September, and Nigeria overtook it in October. Look back a year and the picture changes more. Working backwards from the growth rates, Nigeria’s figure in October 2025 was roughly 2,780 a week, about the same as the African average then. Angola’s was roughly 3,250 and Kenya’s roughly 2,950. These year-ago figures are our own sums, not numbers Check Point gave.

Before going further, a warning about what these numbers are. They are not a count of break-ins. Check Point’s figure is an average of attacks seen per firm. The reports we reviewed do not explain how the data was collected. They do not say how many African firms are in the sample, or how an attack is defined. A security company’s customer base can also tilt its picture. Kenya’s own regulator offers a useful parallel. Its Communications Authority logged 2.36 billion threat events in the April to June 2026 quarter. That was down 30% from 3.37 billion in the one before. Reporting on those figures stressed that detections are not successful attacks. Many are automated attempts, so a fall in detections does not mean users faced 30% fewer successful attacks. The same caution applies here: a rising count tells us about exposure and attention from attackers. It does not tell us how many firms were actually breached.

With that said, the direction is hard to ignore. Other independent evidence points the same way. Interpol’s 2025 assessment found that in West and East Africa, cyber crime made up as much as 30% of all reported crime. Its 2026 assessment came out on 3 August. It drew on surveys of 36 African member countries. It found that AI was linked to 55% of reported cyber crimes. Reported losses rose from $192 million to $484 million since 2024. Interpol’s own numbers rely on what countries report, so they are likely to undercount, but they match what Check Point sees.

Why is Africa so exposed? Ian van Rensburg, Check Point’s head of security engineering for Africa, gives the company’s answer. “Africa’s high attack volumes reflect how quickly organisations are expanding their digital operations, often without security keeping pace,” he said. In markets like Nigeria and Angola, he said, more connectivity, investment in digital services and reliance on technology are creating more chances for attackers. Lorna Hardie, the firm’s regional director for Africa, made the same point in August 2025. While Africa rolls out digital plans, she said, its defences lag. Kenya shows the scale of the surface. By June, it had 52.3 million smartphones in use and 64.3 million mobile data subscriptions, according to coverage of the regulator’s figures.

Take Nigeria first. Attacks there rose 140% in a year, and Nigeria has led Africa in several months of 2026. Lanre Ogungbe, chief executive of the security firm Prembly, told Nairametrics that instant payments are easy to abuse. Transfers happen almost at once, so there is little time to spot fraud. Nigeria’s response is still taking shape. In February 2026, the National Information Technology Development Agency (NITDA) said it planned a national cyber security framework. As reported, the plan would set a minimum security spend for firms. It would set deadlines for reporting data breaches. It would also create threat-sharing between government and business, and shared rules for responding to major incidents. NITDA’s head, Kashifu Abdullahi, said it was expected later this year. In April, TechCabal reported that Abdullahi wanted firms to start reporting breaches, or at least to share threat information. “If one organisation is compromised, it can become a launch pad for others,” he said. He added that the fear of a damaged image “has to change.”

The data on fraud losses in Nigeria is confusing. It is worth reading with care. A July 2026 report from the compliance firm Adhere said reported digital payment fraud losses in Nigeria fell by more than half in 2025. TechCabal released it. They went from ₦52.26 billion to ₦25.85 billion. Reported cases fell by about 31%. Yet the authors warned that the drop may hide a rising risk. Attacks are more targeted, and each one costs more. “The fall in reported fraud is welcome, but it is also a warning,” said Gbemisola Osunrinde of Smartcomply. The reporting itself is also patchy. TechCabal’s report noted that in 2023 only 60 of 163 institutions reported fraud to the Nigeria Inter-Bank Settlement System. Nairametrics, citing Bloomberg, reported a 150% rise in AI-driven attacks on Nigeria’s financial sector in 2025. It also cited a UN Office on Drugs and Crime estimate. Nigeria lost about ₦1.1 trillion across banks, telecoms and government agencies between 2017 and 2023. These are different measures from different sources, and they should not be added together. Taken together, they say that the reported losses are falling, the attacks are rising, and the data is incomplete.

Angola was Africa’s most attacked country in August and September. It is second now, with 6,116 weekly attacks, up 88%. Check Point’s Rudi van Rooyen explained its exposure in 2025. He pointed to “weak cyber defenses and limited awareness and enforcement capacity” alongside rich targets. Those targets include oil and gas, banking, telecoms and government services. Angola is the second-largest oil producer in sub-Saharan Africa, after Nigeria. That is a comment on 2025 data, and we found no newer explanation, so it should be read as background.

Kenya shows both sides. It is fourth in the world with 4,302 attacks a week, up 46%. Its regulator also publishes counts of its own. TechCabal reported that Kenya requires first disclosures within 48 hours, while Algeria requires breach reports within five days. Kenya’s national figures cover billions of detections a quarter, and most are system attacks and vulnerabilities. ESET, a security vendor, reported a 145% rise in QR-code phishing in Kenya. It compared the first half of 2026 with the second half of 2025. That is vendor data and is not directly comparable with the regulator’s figures.

South Africa is the counterweight. It ranks 22nd of 42, with 2,191 weekly attacks, up 17%. Lower volume does not mean low harm. A law firm’s summary describes a 2026 breach at Statistics South Africa. A group called XP95 claimed 154 gigabytes of data and demanded $100,000. The agency refused to pay. The same summary cites a Sophos survey. It found that South African firms faced average recovery costs above R17 million, and only 40% recovered within a week. Interpol’s 2025 assessment, citing Trend Micro, gives another view. South Africa had 17,849 ransomware detections in 2024, the most on the continent. Egypt had 12,281, Nigeria 3,459 and Kenya 3,030. Those are detections, and they are a different measure from Check Point’s attacks per week.

Which sectors are in the line of fire? In Africa, Check Point says financial services, government, and energy and utilities were the most targeted in October. The order moves from month to month. In August, energy and utilities came first. In September, government led, followed by financial services and energy. Globally, education was most attacked, at 5,934 a week per firm, up 33%. Agriculture rose the most, up 93% to 3,218 a week, and telecoms ranked third at 3,068, up 19%. All 23 sectors Check Point tracks rose by double digits over the year. The report does not say how much of agriculture’s rise is African. That matters to African food and farming technology firms, but it is a question the data does not answer.

The AI story has two sides, and both are in this month’s report. On the attacker side, van Rensburg said criminals are “using automation and AI to launch attacks at a scale we haven’t seen before.” A new extortion group called n0n shows how. It rose to third place in October with 8% of published ransomware attacks. In September, its first month, it had 2%. Check Point describes n0n as a data theft and extortion group. It leans heavily on AI-assisted tools. It had claimed more than 170 victims by early November. Its way in was often weak or stolen passwords. Interpol’s Neal Jetton put it plainly in August. “AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion,” he said. Interpol also warned of criminals who mix real and made-up data to build AI personas. These slip past biometric checks. Criminals use them to open bank accounts, take loans and register SIM cards. For fintechs that rely on selfies and ID checks, that is a direct threat.

On the defender side, firms are leaking their own data. Check Point found that about 1 in 35 prompts typed into company AI tools, or 2.9%, carried a high risk of leaking sensitive data. That share has risen each month, from 2.3% in August and 2.5% in September. It affected 90% of the firms that use AI tools regularly. Another 12% of prompts contained information that could be sensitive. Financial data appeared at 71% of firms. Legal and regulatory material and network details each appeared at 70%. Employee data was at 67% and personal data at 62%. By industry, business services had the highest rate at 5.4%, then government at 4.6% and financial services at 4.5%. Those last two are also among Africa’s most targeted sectors, which is our own observation. The reports we reviewed did not give an African rate for this measure. Latin America had the highest regional rate at 1 in 26, and North America and Asia-Pacific followed. Van Rensburg sums it up. “AI is making it easier for attackers to operate at scale,” he said. “Businesses are also exposing sensitive data through their own use of AI tools.”

Ransomware, in which criminals lock a victim’s files or steal them and demand money, hit a record in October. Groups publicly claimed 1,063 victims, up 35% on a year ago. These counts come from the gangs’ own leak sites, which Check Point says carry biases. Business services made up 31.5% of victims, then consumer goods and services at 14.9% and industrial manufacturing at 11.6%. North America took 48% of the victims, Europe 22% and Asia-Pacific 18%. The reports we reviewed do not give Africa’s share, so we cannot say how much of this record falls on the continent. Here are the leading groups.

Africa has felt this wave before. A law firm’s summary of Interpol’s work cites a suspected ransomware attack on Uganda’s state power transmission company in August 2025. A group called Qilin claimed it. Check Point’s August report named Qilin the most active group, with 15% of published attacks. Orova entered the top three for the first time.

One piece of the October data is better news. Phishing eased. About 1 in 128 emails, or 0.78%, was malicious, down from 1 in 91, or 1.10%, in September. Of those emails, 79% carried a link and 14% an attachment. A lower rate is not a safe rate. A phishing email still costs one click, and on mobile money a single click can empty a wallet. In Interpol’s 2026 survey, mobile money fraud was reported by almost all responding countries, according to a law firm’s summary of the report. Those scams often start on Facebook, move to WhatsApp and end in a payment through a service like M-Pesa or MTN Mobile Money.

What can governments and police do? Interpol’s reports show gaps. In the 2025 assessment, 90% of countries said their police or prosecutors needed big improvements. Only 19% had a cyber threat intelligence database. And 86% said international cooperation needed to improve. A summary of the 2026 assessment says 94% of responding agencies lacked proper digital forensics tools. And 89% named cross-border work as the main barrier. Yet there is progress. In 2025, 17 countries passed or changed cyber crime laws. Four Interpol operations, including Serengeti 2.0 and Red Card 2.0, led to more than 1,500 arrests and the recovery of over $100 million. The African Union’s Malabo Convention on cyber security and data protection came into force in June 2023. A law firm’s summary says only 20 of 55 states have ratified it. A commentary in African Arguments says the gap is one of readiness, not treaties. Institutions still need practice working together under pressure.

What does this mean for founders and companies? The first lesson is that size is not protection. Nigeria’s rise took it from roughly the African average a year ago to about 2.6 times the world average, by our sums. A fintech, a health startup or a logistics firm does not need to be famous to be targeted. Abdullahi’s warning that one breach can become a launch pad for others applies to any company that connects to banks, telcos or government systems. The second lesson is that cheap steps matter. Check Point says n0n often gets in through weak or stolen passwords, and The Gentlemen are reportedly trading access to firewalls. Strong sign-in checks, fast patching of devices facing the internet and a clear rule on what staff may paste into AI tools would tackle the problems in this report. These are our suggestions, in line with Hardie’s call for a prevention-first approach that combines AI-powered protection, shared threat intelligence and consistent governance. The third lesson is about trust. Investors and partners, including banks, will ask how a startup handles identity checks, data and incidents. Nigeria’s planned reporting rules, if they arrive, will make that question a legal one.

Why it matters: One commentator says Africa’s digital economy is growing faster than its ability to protect it. October’s numbers show how wide that gap has become. The continent now faces more attacks per firm than any other region. Nigeria and Angola lead, and the targets are the sectors that carry money, identity and public services. AI is raising the stakes from both sides: criminals use it to scale scams and extortion, and staff use it in ways that leak the data attackers want. The numbers are imperfect, and they come from a security vendor that sells protection. But they line up with Interpol’s findings, with regulators’ own counts and with what Nigerian officials say. The honest reading is that attack pressure is rising, reporting is thin, and defences, laws and skills are behind.

What to watch next: whether Africa stays on top in November, or Latin America takes back first place. Watch whether Nigeria’s cyber security framework and breach-reporting rules are published, and what deadlines and penalties they carry. Watch how Nigeria’s reported fraud losses move now that attack counts are higher. Watch whether Check Point or others publish the African share of ransomware victims. Watch for the African rate of risky AI prompts too. The reports we reviewed gave neither. Watch how many more countries ratify the Malabo Convention and pass cyber crime laws. Watch the next Interpol operations and whether data sharing between banks, telcos and police improves. And watch whether Kenya’s 48-hour disclosure rule spreads to other countries.

Sources: Check Point Research, October 2026 cyber threat landscape; Techtrends Kenya, “Africa now the most attacked region for cyber threats, Check Point”, 12 November 2026; iTWire on the October findings; Techeconomy on Check Point’s September figures; Nairametrics on Check Point’s August figures for Nigeria; ITWeb Africa on why Angola is a prime target; Interpol on the 2026 African Cyberthreat Assessment; Interpol on the 2025 African Cyberthreat Assessment; Nairametrics on Nigeria’s planned cyber security framework; TechCabal on Nigeria’s move to end silence on cyberattacks; Nairametrics on Nigeria’s digital payment fraud losses; Techtrends Kenya on Kenya’s cyber threat figures; Mishcon de Reya on cyber crime threats to Africa in 2026; African Arguments on Africa’s cyber security readiness gap.

A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.