Sophos survey puts South African ransomware recovery costs above R17m

South African organizations that suffered ransomware attacks spent more than R17m on average to recover, excluding ransom payments, cybersecurity firm Sophos found in a new report. That compares with R21m in 2025. The findings come from 135 IT and cybersecurity leaders at organizations attacked during the previous 12 months. Sophos also found that the median ransom demand fell 57%, from R16m to R6.8m. Among the South African organizations surveyed, 85% said their ransomware incident was also their most significant identity attack of the year, pointing to the role of compromised access in recovery costs.