A new Mastercard report, Africa’s Digital Defense Race, puts numbers on something many of us already feel. Between 2016 and 2025, cyberattacks in Africa rose by 421.4%. The global figure for the same period was 307.3%.
Mastercard Cyber Insights logged 69,236 cyber events aimed at African organisations in 2025. That works out at roughly one attack every eight minutes.
Four countries took the bulk of it. Nigeria, South Africa, Morocco and Kenya absorbed 54.7% of everything recorded. Technology firms, government and financial services together accounted for 44% of attacks.
The report’s biggest finding is about people, not software. Africa doesn’t have enough trained cybersecurity staff, and Mastercard calls this both the continent’s weakest point and its biggest investment opportunity.
For most businesses, the website is the easiest door in. A WordPress site with an old plugin, a shared hosting account running thirty sites under one login, a file manager plugin nobody remembers installing. Attackers don’t need to be clever when the basics are left open, and they can sit inside a site for weeks without anyone noticing.
If you run a business website, three questions are worth asking your developer this week. When were the plugins last updated? Who has admin access, and do you recognise every name? Does anyone actually check the server for files that shouldn’t be there? If the answer to that last one is “I don’t know”, the answer is probably no.
Sources: Connecting Africa, TechTrends Kenya, Mastercard
