When Cybercrime Becomes Infrastructure

Reading INTERPOL’s 2026 African Cyberthreat Assessment – and what it means for Zimbabwe

By Jabulani Simplisio Chibaya

HARARE – EVERY June, INTERPOL publishes a state of the nation on African cybercrime. This year’s edition should keep boards awake.

The INTERPOL African Cyberthreat Assessment Report 2026, drawn from survey responses across 36 member countries and cross-referenced against telemetry from Fortinet, Mastercard, the Shadowserver Foundation, S2W and TrendAI, describes a shift that African executives cannot afford to miss: cybercrime on the continent has moved from opportunistic hacking to an industrialised, borderless enterprise.

Reported losses more than doubled between 2024 and 2025, from USD 192 million to USD 484 million, while aggregate economic damage is estimated at USD 5 billion against a continental cybersecurity spend of just USD 15.3 billion. The gap between offence and defence is widening, not narrowing. For business leaders, data protection authorities, and IT security teams across Southern Africa, this report is less a curiosity than a planning document. Below is what it says, what it means, and what Zimbabwe specifically should take from it.

Key Findings and Trends

Seven categories dominate reported cases: online scams and phishing (17%), sextortion and harassment (14%), identity theft and financial fraud (14%), data breaches (11%), business e-mail compromise (10%), ransomware and banking trojans (7%), and direct attacks on critical infrastructure (6%). Ransomware has evolved from opportunistic extortion into infrastructure sabotage. South Africa alone accounted for 92% of continental ransomware detections, with confirmed or suspected incidents hitting the South African Weather Service, Nigeria’s Customs Service, and Uganda’s national power transmission utility.

Business e-mail compromise remains the financial engine of the ecosystem: 70% of detections trace to South Africa and 29% to Nigeria, and INTERPOL’s Operation Sentinel intercepted a USD 7.9 million BEC attempt against a Senegalese petroleum company before funds left the country. Online scam centres, frequently linked to human trafficking and coerced labour, were reported present in some form by 72% of surveyed countries, concentrated in Southern and West Africa. Digital sextortion, increasingly powered by AI-generated deepfakes, produced roughly 600,000 detections in 2025, with teenage victims in Ghana seeing financial losses increase fivefold.

Data breaches sit beneath almost everything else: the Shadowserver Foundation identified more than 6,000 exploitable, often well-known and unpatched vulnerabilities across the continent, feeding a cascading chain in which stolen credentials open mobile wallets, wallets fund BEC transfers, and proceeds launder through crypto exchanges and shell companies. And artificial intelligence now touches the majority of the caseload: 55% of reported cybercrime cases in 2025 involved AI in some capacity. Deepfake incidents rose sevenfold in a single year, and researchers have already identified ransomware strains — PromptLock and 01flip among them — that use generative AI to write, adapt, and execute their own malicious code.

Regional Snapshot

The threat is unevenly distributed. Southern Africa is the most digitally advanced and most heavily targeted region: South Africa alone recorded 213,523 DDoS attacks in 2025, one incident peaking at 312 Gbps. West Africa leads in BEC and sextortion detections, with Cabo Verde and Nigeria posting the highest ransomware volumes. East Africa’s story is mobile money: Kenya alone recorded 123,000 fraudulent SIM cards and a 327% surge in SIM-swap fraud, draining an estimated USD 3.8 million from mobile wallets. Central Africa is likely underreporting rather than under-attacked — Cameroon is the continent’s second-highest botnet detection hub, with 40.5 million incidents in 2025, suggesting quiet, long-dwell compromise rather than loud extortion. Zimbabwe sits inside the Southern African cluster and shares its defining features: high mobile-money dependence, growing connectivity, and rising exposure.

Implications for Business, CISOs, Data Protection Authorities and IT Security Personnel

For business leaders, cyber risk is now balance-sheet risk, not an IT line item. Reported losses doubled year on year, and critical infrastructure sectors — financial services, telecoms, government, and energy — are explicitly named as primary targets. Any business embedded in those supply chains inherits the exposure by association.

For CISOs, threat actors now operate at machine speed. Automated reconnaissance tools can scan tens of thousands of systems per second. Defence built on manual triage and signature-based detection is already behind the curve. Yet INTERPOL’s own survey found only 8% of intelligence analysts across Africa hold advanced AI expertise, and 92% of law enforcement agencies cite a lack of technical expertise as their primary barrier to adopting AI defensive tools — a gap that private-sector security teams are unlikely to have closed on their own.

For data protection authorities, the report is a case study in why enforceable breach-notification regimes matter. Only Nigeria, Kenya, South Africa and Mauritius mandate 72-hour disclosure; Ghana requires 24 hours. Most jurisdictions require neither, and 89% of survey respondents named underreporting as pervasive, driven by absent reporting mechanisms, fear of reputational damage, and uncertainty about legal obligations. A DPA without disclosure teeth is, in effect, subsidising underreporting.

For IT security personnel, identity has become the front line. SIM swaps, synthetic identities, and weak Know Your Customer controls are the entry point for the cascading chain described above. Patch management remains unglamorous but decisive — most of the 6,000-plus vulnerabilities identified in 2025 were well-documented and publicly known, not novel.

Notes for Better Safeguards, IT Governance and AI Governance

Three practical shifts stand out for IT governance. First, mandatory incident reporting with defined timelines: disclosure regimes correlate directly with detection and response maturity. Second, sector-wide cyber audits and enforced backup and recovery standards for public institutions, particularly utilities and financial infrastructure, now deliberately targeted for disruption rather than pure extortion. Third, formalised, MoU-based data-sharing channels between law enforcement, telecoms, and fintechs — currently only 44% of countries report improved public-private engagement, down sharply from 89% in prior assessments, and SIM-swap logs often require weeks-long court processes to obtain.

For AI governance specifically, the report’s own numbers make the case for urgency. Fifty-five per cent of cybercrime cases involved AI, yet only 33% of agencies use AI for threat detection and just 22% of digital forensics units have working knowledge of AI-driven threats. That asymmetry — criminal adoption of AI outpacing defensive adoption — is the central governance risk of 2026. Organisations building AI governance frameworks, whether aligned to ISO 42001, the EU AI Act’s risk-tiering logic, or a national AI strategy, should treat deepfake detection, synthetic-identity resistance, and staff AI-literacy training as core controls rather than optional extras. A board that approves an AI strategy without a parallel AI-threat-literacy programme is building capability with one hand and exposure with the other.

What to Watch Out For

Four trends merit close attention through the rest of 2026. First, Cybercrime-as-a-Service platforms are lowering the skill floor, letting low-competence actors rent high-impact tooling. Second, ransomware is shifting from pure data theft toward infrastructure sabotage — power utilities, weather services, and customs systems have all been hit in the past year. Third, scam centres, organised and often trafficking-linked enterprises, are industrialising romance baiting and investment fraud at a scale that outstrips public awareness campaigns. Fourth, synthetic identity and deepfake-enabled fraud is degrading the reliability of KYC and biometric verification at precisely the moment African fintech depends on those systems for financial inclusion. None of this is hypothetical; each trend has a documented 2025 incident behind it.

Insights for Zimbabwe: Risk Landscape and Framework

Zimbabwe does not appear as a standalone line in INTERPOL’s country-level statistics, and that absence is itself informative — in tables otherwise dominated by South Africa, Nigeria, Kenya and Namibia, it more likely reflects a reporting gap than genuine immunity. The one direct Zimbabwe reference in the report is instructive: Harare hosted AFJOC’s first-ever Mobile Forensic Workshop in December 2025, equipping regional investigators to extract and analyse evidence from smartphones. That is a welcome sign of Zimbabwe’s role as a regional training node, but it also signals that forensic capacity was thin enough to need building from that starting point.

Set against Zimbabwe’s regulatory architecture — the Cyber and Data Protection Act of 2021, POTRAZ’s oversight of telecoms and mobile money, the Reserve Bank’s financial-sector remit, and SECZim’s evolving virtual asset framework — the exposure areas the report flags regionally map onto Zimbabwe’s own risk surface. Mobile money fraud sits at the top of that list: Zimbabwean platforms operate in exactly the KYC-dependent environment the report identifies as a weak point continent-wide. SIM-swap risk is a related concern, given that real-time biometric verification remains less mature here than in markets such as Kenya, which was forced into reform only after a 327% surge in swap fraud. Business e-mail compromise is a third exposure, given how much Zimbabwean trade runs through counterparts in South Africa and Nigeria — the two dominant BEC origin points on the continent.

Zimbabwe’s National AI Strategy, launched in March 2026, arrives at a useful moment, but a strategy without a matching uplift in cyber-forensic and AI-threat-detection capacity risks staying aspirational. This is a natural moment for institutions such as SECZim, the Reserve Bank, the Zimbabwe Stock Exchange and the Financial Intelligence Unit to press for harmonised reporting timelines, formal MoUs with mobile money operators, and deeper participation in AFRIPOL’s regional coordination — cross-border cooperation is, by INTERPOL’s own account, Africa’s weakest link.

Recommendations

For boards: treat cyber resilience as enterprise risk with quarterly reporting to the board, not an annual IT briefing.

For CISOs: prioritise identity-layer defences — SIM-swap monitoring, multi-factor authentication hardened against social engineering, and deepfake-aware verification for high-value payment approvals.

For data protection authorities and regulators: legislate mandatory, time-bound breach disclosure and formalise data-sharing MoUs with telecoms and fintechs before the next major incident, not after it.

For IT security teams: patch the unglamorous, well-known vulnerabilities first — most 2025 breaches exploited these rather than novel exploits.

For AI governance leads: pair every AI capability rollout with an equivalent AI-threat-literacy programme for security and compliance staff.

For Zimbabwe specifically: push for full country-level participation in INTERPOL’s next member survey. Visibility is the precondition for resourcing, and a risk that goes unmeasured is a risk that goes unmanaged.

Cybercrime in Africa is no longer a technical nuisance. It is, on INTERPOL’s own framing, a mechanism of economic coercion. The institutions that treat 2026 as a genuine wake-up call, rather than another report to file, will be the ones still standing when the next assessment lands in 2027.

Jabulani Simplisio Chibaya is a Data and AI Consultant specializing in data science, artificial intelligence, blockchain, and cryptocurrency innovation. A seasoned conference speaker, he also writes on the intersection of technology, regulation, and economic development. Contact: Cell: +263 778 921 881 | Email: simplisiochibaya22@gmail.com | LinkedIn: https://www.linkedin.com/in/jabulani-simplisio-chibaya