# Sophos survey puts South African ransomware recovery costs above R17m

_Published Sunday, September 27, 2026 at 11:19 PM EDT · Security, Products · Latest · Tier 2 — Notable_

![Ransomware attacks involve hacking a company’s systems, stealing data and threatening to release that data unless a ransom is paid. — Primary](https://www.sundaytimes.timeslive.co.za/resizer/v2/ZYB2EDM4VBISNLUVV32QVZQSP4.jpg?smart=true&auth=af423b3d74090dcf7c9804322cfc51e50693c75bfce937c8a91ccda0778a9ff4&width=1200&height=630)

South African organizations that suffered ransomware attacks spent more than R17m on average to recover, excluding ransom payments, cybersecurity firm Sophos found in a new report. That compares with R21m in 2025. The findings come from 135 IT and cybersecurity leaders at organizations attacked during the previous 12 months.

Sophos also found that the median ransom demand fell 57%, from R16m to R6.8m. Among the South African organizations surveyed, 85% said their ransomware incident was also their most significant identity attack of the year, pointing to the role of compromised access in recovery costs.

## Sources

- [sundaytimes.timeslive.co.za](https://www.sundaytimes.timeslive.co.za/news/2026-09-28-ransomware-recovery-costing-sa-organisations-r17m-on-average-report/)

---
Canonical: https://techandbusiness.org/newswire/Ys-RlK8W5H06NmwosweblH
Published: 2026-09-28T03:19:44.187Z
Story chronology: 2026-09-28T02:30:00.000Z
Retrieved: 2026-09-28T05:50:11.264Z
Publisher: Tech & Business (techandbusiness.org)