Interpol's African cybercrime sweep arrests 1,462, but South Africa's part is unclear

South African police took part in an Interpol cybercrime operation that arrested 1,462 suspects across Africa between 29 June and 31 August. The results Interpol published on 22 October list case after case from other countries, but nothing from South Africa.

Operation Serengeti III involved law enforcement from 20 African countries and the United States. Interpol says investigators disrupted 10,909 malicious networks, identified 65,929 victims and linked the activity to losses of more than US$385 million. More than US$105 million was recovered. MyBroadband put the losses at about R6.35bn.

The missing local detail matters because Interpol's own research places South Africa near the centre of the crimes the operation went after: business email compromise, ransomware, online fraud and digital extortion.

What Interpol reported

Before the operation started, investigators in the participating countries received intelligence on suspicious domains, IP addresses and command-and-control servers. The private partners named were Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance, along with Zimbabwe's telecoms regulator, Potraz. The work was co-funded by GLACY-e, a joint European Union and Council of Europe project.

The examples Interpol gave came from elsewhere. In Uganda, police broke up two fraud rings and arrested 365 foreign nationals accused of running fake trading platforms and pension scams aimed at victims in Asia. In Angola, investigators shut two illegal cryptocurrency-mining centres, arrested nine people and seized more than 2,000 mining machines and six illegal power transformation stations worth over US$1 million.

Nigerian police arrested a suspect accused of running a phishing and email-fraud operation that had collected about 2.1 million email addresses. A second Nigerian suspect is linked to an investment scheme promoted on messaging apps, through which more than US$2.4 million moved, much of it laundered through crypto. Tanzania dismantled a malicious mobile-loan app scheme, Gabon disrupted a vehicle-import fraud network run through social media, and the Republic of Congo arrested 30 suspects.

"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," said Neal Jetton, Interpol's director of cybercrime.

Why South Africa stands out

Interpol's African Cyberthreat Assessment Report 2026, dated June, uses TrendAI data to say that 70% of business email compromise detections in Africa in 2025 originated in South Africa, against 29% from Nigeria. It says Microsoft has identified South Africa-based groups, active since 2017, that mainly target US companies and move stolen money offshore through compromised mailboxes and money mules.

The same report says South Africa accounted for 92% of ransomware detections in Africa recorded by TrendAI, almost 40% of African phishing detections tracked by SOCRadar, and 213,523 DDoS attacks, one of which peaked at 312Gbps.

South Africa is both a target and a base for these crimes. A regional operation that names arrests in Uganda, Angola and Nigeria but gives no South African figure leaves local companies with little sense of whether the groups attacking them were touched.

What is still unresolved

Interpol did not publish a South African arrest count, a recovered amount or a case summary. We found no Saps or Hawks statement on the operation by Monday morning.

Interpol says several investigations are still open, with authorities identifying more suspects, tracing illicit proceeds and analysing seized digital evidence. Whether any of that work leads back to the South African email-fraud groups its June report describes has not been said.