The report, titled Africa’s Digital Defense Race and published in October, draws on data collected by Mastercard’s Cyber Insights platform. It highlights the growing exposure of African economies to cyber threats as digital payments, online services and financial technologies expand in 2025.
Morocco recorded an average of 612 cyber events per month, with a peak of 1,882 in April. Across Africa, the platform recorded 69,236 events over the year, equivalent to roughly one every eight minutes.
February was the quietest month on the continent, with 3,601 events, while September saw the highest number, at nearly 10,600. Nigeria accounted for much of that monthly peak, recording 4,195 events in September alone.
Nigeria topped the continental ranking, accounting for 24.4% of recorded events, followed by South Africa at 12.6%. Morocco ranked ahead of Egypt, with 8.8%, and Kenya, with 7.1%. Chad, Ghana, Algeria, Sudan and Mali completed the top 10.
Nigeria, South Africa, Morocco and Kenya together accounted for 54.7% of the activity recorded. Mastercard links this concentration to the growing digitalization of these economies, where the expansion of electronic payments, banking infrastructure and online public services creates more opportunities for cybercriminals.
Technology, public services and finance among the main targets
Technology accounted for 15.7% of recorded cyber events across Africa, followed by the public sector at 14.3% and financial services at 14.1%. Together, the three sectors represented 44% of the total.
Services accounted for another 8.9%, followed by media at 8.1%, industry at 6%, research at 5.1%, telecommunications at 4.9%, education at 4.1% and energy at 3.8%.
Read also : Thousands of websites taken offline across Europe after AI uncovers security flaw
According to the report, these sectors are attractive targets because they hold valuable data and handle significant transactions. The growing use of digital services by the public has also expanded the number of potential targets, often faster than security investment has kept pace.
The relatively small share attributed to the energy sector does not mean the risks are insignificant. An attack disrupting energy infrastructure can affect the wider economy because businesses and public services depend on reliable power supplies.
Healthcare and education together accounted for more than 7% of recorded incidents. Attacks on these sectors can expose sensitive information about patients and students, with consequences extending beyond financial losses.
Four techniques account for most recorded events
Four types of activity accounted for 57.6% of the events tracked: malware at 17.7%, ransomware at 15.7%, email-based social engineering at 13.8%, and reconnaissance and attack preparation at 10.3%.
Other methods included web application attacks, at 4.8%; denial-of-service attacks, at 3.7%; mobile attacks, at 3.4%; and the misuse of legitimate tools, at 3.2%.
Malware can infiltrate systems, steal information or disrupt operations. Ransomware locks users out of files or systems and demands payment to restore access.
Social engineering relies on manipulating people, often through fraudulent emails designed to steal login credentials or persuade recipients to open malicious attachments. Reconnaissance involves identifying exposed systems, searching for vulnerabilities and gathering information before an intrusion.
Mastercard notes that these techniques can be deployed at scale rather than being designed for a single target. The report also highlights the spread of ransomware-as-a-service, a model in which attackers can access malicious software and related services, including payment processing and negotiations with victims, through a packaged offering. This lowers the technical barriers to carrying out attacks.
Cybercrime is becoming more organized
More than 60% of events for which the perpetrators could be identified were attributed to two categories: malicious hackers, or black-hat hackers, who accounted for 41.5%, and organized criminal groups, responsible for 20%.
Politically motivated actors, described in the report as cyber warriors, accounted for 13.9%, while state-backed actors represented 9.7%. Less experienced attackers accounted for 7.3% and hacktivists for 5.4%. Malicious insiders and industrial spies represented only a small share each.
Read also : AI models could soon power self-replicating cyberattacks, Anthropic warn
Mastercard says cyber threats against African organizations are increasingly coordinated and directed at critical systems that underpin economic activity. The motives vary, ranging from financial gain and espionage to gaining access to infrastructure or disrupting operations.
Business systems were the most frequently targeted assets, accounting for 28.1% of recorded activity. This points to attacks aimed at gaining operational control, including ransomware campaigns, denial-of-service attacks and intrusions into payment authorization infrastructure.
Personal customer information accounted for 12.7%, intellectual property for 11.9%, customers’ financial information for 11.2%, and physical assets for 10.8%. Personal and financial customer data together represented 23.9% of the activity.
The report identifies these targets as central to trust in the digital economy, from banking credentials and citizens’ identity records to payment platforms and proprietary systems used by financial technology companies.
Cyber threats are growing faster than defenses
Between 2016 and 2025, the estimated number of cyberattacks in Africa rose by 421.4%, compared with 307.3% worldwide. Although Africa accounted for just 2.3% of the global total cited in the report, the pace of growth was significantly higher.
The increase coincided with rapid expansion in digital services. Over the same period, the number of mobile money users in Africa grew 5.9-fold, the number of digital banking services increased 4.7-fold, and the value of e-commerce rose 4.2-fold.
Mastercard describes this as a compressed cycle of vulnerability. While advanced economies generally digitized over several decades, many African countries adopted mobile internet, mobile banking, fintech platforms and digital payments within a much shorter period. Security systems and practices have not always kept pace with that transition.
The report projects further growth in digital activity. Africa’s digital payments market could reach $1.5 trillion by 2030, while the continent’s AI economy could be worth $16.5 billion by the end of the decade. More than 60% of Africa’s population is under 25, a generation for whom digital finance is increasingly the norm.
Read also : Morocco-France CHEBEC naval exercise begins in Toulon with strengthened cyber component
Each new online service can introduce additional exposure to cyberattacks. Payment systems, personal databases and platforms supporting essential services may be targeted to steal information, divert funds or interrupt operations.
An attack on a payment platform can affect multiple businesses that rely on it. A data breach can also undermine customer trust and generate additional costs for investigations, system recovery and security improvements.
Small and medium-sized enterprises are particularly vulnerable. Many lack the budgets, specialized staff and security infrastructure available to larger companies, leaving them with fewer resources to respond to an attack. In severe cases, an incident can threaten the continuity of their operations.
Skills shortages weaken cyber resilience
The report estimates that Africa had more than 200,000 unfilled cybersecurity positions at the end of 2025. It also identifies a 23% workforce shortfall across the continent’s cybersecurity ecosystem and says 36% of African organizations consider their cyber resilience inadequate.
The challenge therefore extends beyond technology to the availability of qualified professionals.
Artificial intelligence adds another layer of complexity. It can automate certain operations, tailor fraudulent messages to specific recipients and help attackers prepare campaigns on a larger scale.
Gabriel Swanepoel, Mastercard’s division president for Africa, says AI has democratized cyber threats, making them possible for a wider range of actors regardless of their location. The challenge, he argues, is no longer simply whether a disruption will occur, but how well organizations can withstand it and how quickly they can recover.
Companies need to strengthen threat detection, train employees and establish clear response and recovery procedures. Effective prevention also depends on monitoring systems, managing access rights, applying security updates and ensuring staff can recognize suspicious activity.
Morocco has an established cybersecurity framework
Mastercard’s report places Morocco among the African countries with a structured institutional approach to cybersecurity. It highlights measures concerning the protection of critical infrastructure, mandatory incident reporting and data protection requirements.
The report also says the country’s threat profile has been shaped more by geopolitical factors than by financial crime. It points to significant incidents in recent years involving public institutions holding sensitive citizens’ data.
Morocco is described as one of Africa’s more connected economies, with high internet penetration, a developed financial services sector and a growing role as a technology hub linking North Africa and Europe. These characteristics support digital development but can also make the country an attractive target for attackers.
The number of recorded events alone, however, does not establish how effective a country’s cybersecurity defenses are.
Mastercard calls for a coordinated response
Mastercard argues that cybersecurity should be treated not only as a way to reduce risk but also as a condition for economic growth. Countries with resilient digital infrastructure are better positioned to attract investment, support innovation and maintain the confidence of businesses and consumers.
Cyber risk is already influencing lending and insurance conditions, while customers increasingly expect digital payments to be secure.
Read also : Cybersecurity maturity in Morocco rises from 49% to 56% in a year
The report calls for closer cooperation among governments, regulators, banks, telecommunications operators and technology companies. Much of Africa’s digital infrastructure is built and operated by private companies, which may detect suspicious activity before public authorities do because they have direct access to operational data.
Governments, meanwhile, are responsible for setting rules and pursuing offenders. Mastercard says sharing threat intelligence between these groups can help identify attacks earlier and limit their spread.
In 2026, the company announced the launch of its Africa Cybersecurity Center of Excellence, a virtual center intended to facilitate threat intelligence sharing, monitor risks and strengthen defensive capabilities.
The initiative is designed to help organizations assess their cyber resilience through crisis simulations and roundtable discussions involving security leaders across the continent. Its initial rollout is focused on South Africa and Nigeria. Mastercard says the initiative builds on more than $12.6 billion the company has invested in cybersecurity globally since 2019.
As payments, public services and commerce increasingly move online, cybersecurity is becoming essential to business continuity and public trust in Morocco and across Africa.
