What South African businesses need to know about cybercrime

Cybercrime is becoming an increasingly serious threat to South African businesses, with attacks ranging from data theft and fraud to extortion by organised criminal networks. Even well-established organisations are vulnerable, and the consequences can extend far beyond financial losses. So what does the law say, how widespread is the problem, and what can businesses do to protect themselves? 3Cube Property Solutions has investigated the latest developments, examined the threats facing South African companies and unpacked what you need to know to protect your business.

Cybercrime is becoming a business threat

Cybercrime has evolved far beyond suspicious emails and stolen passwords. Today, businesses face increasingly sophisticated attacks involving ransomware, data theft, business email compromise and criminals who exploit vulnerabilities in company systems to demand payment.

In a worrying development, an INTERPOL report has revealed that more than half of cybercrimes in Africa are executed with the help of AI. This technology can help criminals automate attacks, create convincing scams and target victims more efficiently, making the threat increasingly difficult to ignore.

Organised criminal networks operate across borders, turning cybercrime into a lucrative business. The consequences for companies can be devastating. A ransomware attack could bring operations to a standstill, leaving employees unable to work and customers unable to access essential services. A data breach could expose confidential client information, trigger legal and regulatory consequences and destroy hard-earned trust. In a worst-case scenario, prolonged disruption, substantial recovery costs and reputational damage could threaten a company's survival.

Cybersecurity is no longer simply an IT concern. It is a business-critical risk.

What the Cybercrimes Act means for businesses

South Africa's Cybercrimes Act 19 of 2020 received presidential assent on 26 May 2021 and was published in the Government Gazette on 1 June 2021. Substantial provisions came into effect on 1 December 2021. The Act was introduced to define cybercrime offences, strengthen investigations and prosecutions, and support cooperation in tackling crimes that cross national borders.

For businesses, the Act provides a legal framework for prosecuting offences such as hacking, unlawful data interception, cyber fraud, cyber extortion and the theft of incorporeal property, which can include intangible assets. In practical terms, criminals who unlawfully access company systems, steal digital information or demand payment through cyber extortion can face criminal prosecution. However, the Act does not prevent attacks or replace the need for strong cybersecurity measures.While the existence of such legislation is a positive step, the results have not been as encouraging. According an article published earlier this year by ITWeb , only a handful of people have been convicted for cybercrimes since the Act came into effect.

Big organisations are being targeted

The scale of the threat becomes clear when you look at some of the organisations that have been targeted. In March 2026, Liberty disclosed that an unauthorised third party had accessed selected data systems, potentially exposing customers' personal information. Just weeks later, Standard Bank notified clients that certain personal information had been accessed in a data breach.

The attacks have not been confined to financial institutions. Wits University confirmed in 2025 that its Oracle E-Business system had been compromised in a zero-day attack, while a separate cyber incident affecting its learning management system was reported in 2026. South African Airways experienced a significant cyber incident in May 2025 that temporarily disrupted access to its website, mobile app and some internal systems. These incidents demonstrate that no organisation can assume its size, resources or reputation make it an unlikely target.

How businesses can strengthen their defences

While no business can eliminate the risk of cybercrime entirely, there are practical steps organizations can take to make themselves harder targets and limit the damage if an attack does occur. Businesses should consider the following:

• Keep software and systems updated. Security patches often address vulnerabilities that criminals are actively exploiting, so delaying updates can leave systems unnecessarily exposed.
• Use strong access controls. Multi-factor authentication, strong passwords and carefully managed user permissions can make it much harder for criminals to gain access to sensitive systems and information.
• Train employees regularly. Staff are often the first line of defence against phishing, business email compromise and other social engineering attacks. Regular training can help employees recognise suspicious emails, links and requests for information or payment.
• Back up critical data. Important business information should be backed up regularly and securely, with backups kept separate from the main network where possible. This can be particularly important in the event of a ransomware attack.
• Know what data you hold and where it is stored. Understanding what personal and confidential information the business holds makes it easier to identify valuable targets, limit unnecessary access and respond quickly if information is compromised.
• Have a cyber incident response plan. Businesses should know in advance who is responsible for responding to an attack, how systems will be isolated, who needs to be notified and how customers and other stakeholders will be kept informed.
• Review third-party risks. Suppliers, service providers and other partners may have access to company systems or information. Their cybersecurity practices should form part of the business's overall risk assessment.

Cybersecurity is no longer something businesses can afford to leave solely to the IT department. It is a fundamental part of protecting the organisation, its employees, its customers and its reputation. The most effective defence is to identify vulnerabilities before criminals do and make cybersecurity an ongoing business priority.

Staying one step ahead

Keeping your business data safe is of the utmost importance, but protecting your business goes beyond cybersecurity. The right premises can also play an important role in keeping your people, assets and operations secure. Whether you are looking for new premises or considering a move in Gauteng or the Western Cape, speak to 3Cube Property Solutions to find a commercial property that meets your business needs.