Cybersecurity breaches remained a persistent challenge for African organisations in 2025, but the defining shift of the year was not the scale of attacks—it was the growing inability to keep them quiet. Across the continent, regulatory reforms, public disclosures, and increasingly brazen hackers combined to make cyber incidents more visible than ever.

Several African countries tightened breach-reporting requirements, forcing companies to treat cyberattacks as public accountability issues rather than internal IT failures. Algeria led the charge by mandating that breaches be reported within five days or risk heavy fines. Kenya and South Africa followed suit, strengthening enforcement frameworks that narrowed the window for silence.

In Kenya, organisations that detect a potential breach must now alert data controllers within 48 hours, while controllers are required to submit preliminary reports to the Office of the Data Protection Commissioner within 72 hours—even if investigations are incomplete. Regulators now directly link delayed reporting and weak security controls to fines, sanctions, and the possible loss of data-processing rights, making delay a liability in itself.

South Africa also tightened its regime under the Protection of Personal Information Act (POPIA). In April 2025, the Information Regulator introduced a mandatory online breach-reporting portal, requiring organisations to disclose the nature of incidents, affected data, containment steps, and guidance for affected individuals. According to the regulator, 2,374 breaches were reported in the 2024/25 financial year, with 82% logged after April—evidence not only of rising attacks, but of unavoidable disclosure.

Elsewhere, Zambia reframed cybersecurity as a national infrastructure concern. In April, it split its cyber legislation into a Cyber Security Act and a Cyber Crimes Act, placing critical sectors—energy, banking, health, transport, telecommunications, mining, and public services—under heightened supervision. Operators now face mandatory registration, local data-hosting requirements, annual audits, national cyber exercises, and penalties of up to ZMW 1.2 million ($48,000) or prison terms of up to 10 years for serious violations.

These regulatory shifts forced the exposure of some of 2025’s most disruptive cyber incidents. In October, Kenya’s M-TIBA health-financing platform suffered a breach in which stolen data was publicly posted on Telegram channels—part of a growing tactic by ransomware groups to pressure victims into paying. Telecom firms also emerged as prime targets. Telecom Namibia, Cell C, and MTN Group all disclosed breaches that exposed customer data and triggered investigations across multiple countries.

In South Africa, a January cyberattack crippled the Weather Service, disrupting aviation and marine forecasts across the region. In Namibia, municipal systems in Otjiwarongo were knocked offline, cutting residents off from essential services. But the most consequential breach involved Eskom, South Africa’s state-owned power utility.

Although the breach itself occurred in 2024, Eskom publicly acknowledged in December 2024 that criminals had exploited vulnerabilities in its prepaid electricity vending system to generate fraudulent yet technically valid tokens. By late 2025, local media reported that employees may have colluded in the scheme, allegedly costing the utility between R657 million and R1.1 billion ($39.5 million–$66 million). The case exposed how delayed disclosure, internal compromise, and financial loss can converge into public accountability crises.

Not all attacks sought disruption. Espionage-linked groups increasingly targeted telecoms for surveillance rather than sabotage. Researchers reported that China-linked actors such as Salt Typhoon targeted African networks for metadata and call records. In South Africa, allegations surfaced that the State Security Agency had been breached by suspected Chinese-linked group RedNovember—claims the government denied, though the episode underscored growing fears of covert cyber-espionage.

Ransomware and cybercrime continued to take a financial toll. South Africa alone was estimated to lose $120 million annually. Senegal’s tax authority faced ransomware threats in October, exposing the fragility of digital revenue systems. In East Africa, Kenya recorded over 842 million attempted intrusions in the third quarter of 2025, while Ethiopia and neighbouring states endured repeated DDoS attacks on telecom infrastructure.

Cybercrime also evolved socially. AI-driven impersonation attacks blurred trust in voice and video communications, while West Africa’s long-standing Business Email Compromise networks became more organised and industrial. In Nigeria, alleged insider collusion at Access Bank—where ₦826 million was reportedly diverted—highlighted how internal actors increasingly feature in major financial compromises.

There were signs of enforcement. INTERPOL arrested 1,209 cybercriminals across 18 African countries, while Nigeria’s Data Protection Commission fined MultiChoice ₦766 million for data-protection failures. In North Africa, cyber incidents escalated into geopolitical digital skirmishes, with alleged retaliatory hacks between Moroccan- and Algerian-linked groups exposing the personal data of nearly two million citizens.

By year’s end, the numbers told a stark story. INTERPOL estimates that Africa lost over $3 billion to cybercrime between 2019 and 2025, while 90% of African businesses still lack adequate cybersecurity protocols. Only 30% of African countries operate formal incident-reporting systems, and proactive security investment remains far below global averages.

As 2025 closed, the lesson was clear: African institutions no longer fear breaches alone. What they fear most is exposure—being seen as unprepared, evasive, or ordinary in a digital threat landscape that can no longer be managed quietly.