Cyberattacks on African organisations up more than 421% since 2016, Mastercard-commissioned paper says

Cyberattacks on African organisations rose by more than 421% between 2016 and 2025, compared with 307% globally, according to a whitepaper commissioned by Mastercard and released on 12 October, the Kenyan technology site TechTrends Kenya reported the same day.

The paper, titled Africa's Digital Defense Race, covers the continent and looks in detail at four countries: Kenya, Nigeria, South Africa and Morocco, the Kenyan tech site tech-ish reported on 12 October.

Mastercard Cyber Insights recorded 69,236 cyber events aimed at African organisations in 2025, about one every eight minutes. Over the same ten years, mobile money users in Africa grew 5.9 times, digital banking users 4.7 times and the e-commerce market 5.3 times.

On Kenya, the Kenyan outlet Capital FM reported on 12 October that the paper describes the country's mobile money ecosystem, especially M-Pesa, as critical digital infrastructure that could become an attractive target for cybercriminals. The report also calls for protecting systems that support financial inclusion, such as mobile money and digital lending platforms.

Shabir Ahmed, Mastercard's Senior Vice President, Customer Solutions Center Lead for Africa, said, as quoted by Capital FM on 12 October: "Mobile money has become national infrastructure in Kenya." He also said: "Digital growth is outperforming cyber defenses."

In Kenya, KE-CIRT, the national cyber incident response team run by the Communications Authority of Kenya, detected 2,355,938,192 cyber threats between April and June 2026, about 96% of them in what the authority calls system vulnerabilities.

Nigeria, South Africa, Morocco and Kenya together accounted for 54.7% of the cyber events observed across Africa in 2025. South Africa's financial sector was the target of 12.6% of the continent's attacks.

Capital FM said Nigeria faces elevated risk because of its large population and growing fintech sector, while South Africa's advanced banking and digital payments infrastructure makes it an attractive target for ransomware, data theft and fraud.

Technology firms, the public sector and financial services accounted for 44% of observed attacks. Personal information, financial data and customer-facing services made up 27% of targeted assets. Where the attacker could be identified, more than 60% of events were linked to criminal hackers and organised cybercriminal groups.

Small and medium-sized businesses make up about 95% of registered businesses in Africa and roughly half of the continent's GDP, but typically spend less on cybersecurity than large firms.

Africa has about 200,000 unfilled cybersecurity jobs, equal to 23% of the existing cybersecurity workforce; tech-ish attributed the 200,000 figure to security company Check Point. Artificial intelligence makes cyberattacks easier to automate.

The paper puts Africa's digital payments economy on course to reach US$1.5 trillion by 2030.

Mastercard set up the Africa Cybersecurity Center of Excellence to share threat intelligence and run readiness drills. It was launched in June 2026 and began with South Africa and Nigeria. Ahmed said, as quoted by TechTrends Kenya on 12 October: "As threats become more sophisticated and coordinated, our response has to be just as coordinated."

Interpol's Operation Serengeti 2.0, run from June to August 2025, led to the arrest of 1,209 suspects in Africa and the recovery of US$97.4 million, Interpol said on 22 August 2025. It brought together investigators from 18 African countries and the United Kingdom.