South Africa’s economy faces an estimated annual loss of R141.96 billion, or approximately 1.81% of GDP, due to the surge in data breaches during the 2025/26 reporting period. Analysis by Cube ICT Solutions reached this figure by multiplying the average cost of a single breach—estimated at R44.1 million by the IBM Cost of a Data Breach Report 2025—by the 3,219 incidents formally reported to the Information Regulator.
Operational Costs Versus Economic Growth
Industry experts argue that these losses represent a significant diversion of capital that could otherwise be used for productive investment. Funds spent on emergency response and system remediation represent a drain on resources rather than a contribution to national wealth creation.
Thinking that paying a cybersecurity firm to fix a data breach creates income for that firm is false logic. Resources spent on remedying breaches are costs, not wealth-creating economic activity.
Adriaan Venter, CEO of Cube ICT Solutions, noted that the economy remains smaller than it would have been had these funds been directed toward capital equipment or other growth-oriented ventures. This perspective highlights the severe long-term impact that recurring security failures have on South Africa’s broader financial stability.
Rising Frequency Of Security Incidents
The prevalence of data breaches has accelerated significantly over the past three years, with monthly reporting to the Information Regulator rising from 56 cases in 2023 to more than 150 by late 2024. These figures indicate that despite heightened awareness, security infrastructure at many local organisations is struggling to keep pace with evolving threats.
While human error—such as phishing and poor password hygiene—remains a primary facilitator, the financial burden of these lapses continues to scale. As the Information Regulator continues to process the latest reports, industry analysts expect further scrutiny on the adequacy of cyber-resilience policies across both the public and private sectors.
Future reports from the Information Regulator are expected to reveal whether the current rate of investment in digital security is sufficient to stem the rising tide of economic harm.