An attacker, possibly an automated one, pulled booking data from the platform behind 10,000 South African guesthouses, and a second booking site was hit days later. In the same week three separate reports put AI inside more than half of the attacks they studied, and Kenya and Ghana published the worst fraud figures they have recorded.
NightsBridge, the channel manager that handles reservations for about 10,000 hotels, lodges and B&Bs, says a code flaw let an attacker pull future booking summaries across its partner channels on 2 November. Its own assessment is that the intruder was an AI agent. The data is exactly what a scammer needs, real guest names with real dates and real booking numbers, and guests are already getting WhatsApp messages that hijack reservations or ask for payment.
Then on Thursday Cape Town's LekkeSlaap said an intruder had reached its calendar-sync system and taken some guests' names, emails, phone numbers and booking references. No card or ID data, it says, and no connection to NightsBridge. Two unrelated breaches of the same kind of system in one week is still a pattern. If you have a stay booked in South Africa before the holidays, treat any message about it with suspicion, even one that quotes your booking number.
Kaspersky traced intrusions at schools and universities in Africa and Latin America in September and October to CyberStrikeAI, an open-source AI agent that ran the reconnaissance, stole the credentials and pulled the data, reaching domain admin within days. A Heirs Technologies report on Nigeria, Kenya and South Africa found AI in more than 55% of the attacks it observed. Binance's own account of its $6.3bn loss describes a poisoned Homebrew download, a fake recruitment assignment and abuse of an internal AI tool before a deployment token was taken; the FBI blames North Korea, and Chainalysis says the money is being cycled through thousands of scripted transactions to hide its trail.
The defenders are behind. A World Wide Worx poll found that over half of 200 South African enterprises have seen or suspect AI phishing, voice cloning or deepfakes, yet fewer than 28% have upgraded their liveness or face-matching checks. Senegal's data regulator put out a public warning about cloned voices being used on relatives and colleagues. Nigeria, second in the world for crypto adoption, still has no AI law.
Kenya's banks lost a record Sh1.9bn to fraud in 2025. Card fraud more than doubled to Sh645m and overtook mobile banking, and the banks recovered about 6% of the money targeted, down from 19% the year before. Ghana's Cyber Security Authority counted 4,938 incidents costing GH¢209.7m in the first nine months of 2026, more than nine times the year before, most of it social engineering. In South Africa, Yazi puts 2025 losses at R2.4bn and finds the money mostly goes to slow investment and job scams built over weeks rather than sudden panic. Interpol's continental assessment puts reported losses at $484m and says South Africa logged 92% of Africa's ransomware detections. And 88% of the banks and fintechs in a Deloitte survey of 20 countries say digital fraud is now the main brake on expanding across borders.
The largest single case was inside the bank. Equity Bank says a former salary-processing manager used his own credentials to push disguised payroll transfers for eight months, Sh1.49bn in all, and a Kenyan court has frozen Sh303m and the cryptocurrency it was moved into.
South Africa's financial ombud describes a scam in which fake promoters ask shoppers to scan their faces, then use that biometric check to register the criminal's own device on the victim's banking profile. Home Affairs told Parliament that 17 of its officials face prosecution for processing fraudulent ID applications; the paper green ID book is still the main target. In Nigeria, police in Delta State say small SIM-registration outlets are quietly registering extra lines against customers' NINs and selling them on, and NIMC raided unlicensed enrolment points that were altering identity records. Ghana's traffic cameras went live and fake fine messages followed within days; the police say only the sender ID GPS-MTTD is genuine.
Kenya's new National Cybersecurity Agency held its first board meeting, though the law still doesn't say how it fits with NC4 and KE-CIRT; the ICT minister says getting it running is the priority, as the regulator logged 2.6bn threat events in a single quarter. A separate Online Safety Bill would make platforms verify ages, with fines of up to KSh500m. Nigeria plans to pass cybercrime, cybersecurity and digital economy bills in the first half of 2027, after the elections. Ghana is revising its 2012 data protection law to cover biometrics, location data and AI, with higher penalties, and its central bank named 20 unlicensed loan apps.
In South Africa, the enforcement notice behind FNB's R1m POPIA fine shows the bank drew on social media, cookies and retail data for credit decisions. A summit in Lagos heard that mismatched national laws are the obstacle to moving personal data across African borders at all.
Air Botswana disclosed a suspected ransomware attack on systems holding staff records; flights were unaffected. A botnet baked into the firmware of 1.3 million TV set-top boxes was taken down, with 41,651 of the devices in South African homes. The Nigerian Army got its X account back more than two months after it was hijacked. Two CVEs worth a look: a CVSS 10 authorisation bypass in Microsoft Entra Device Registration, and 46 critical bugs in IBM API Connect, one of them a login bypass, for the banks and telcos that run it. And the Cyber Africa Forum meets in Cotonou on 16 and 17 November.
The South African channel manager says a code flaw let an attacker, believed to be an AI agent, pull future booking summaries across partner channels on 2 November. Guests face WhatsApp reservation-hijack and phishing attempts using real dates and booking numbers.
Cape Town booking site LekkeSlaap says an intruder accessed its calendar-sync system and took some guests' names, emails, phone numbers and booking references, but no card or ID data. It warns of phishing posing as hosts and says the case is unrelated to the NightsBridge breach.
Kaspersky says intrusions seen in September and October used an open-source AI agent to automate reconnaissance, credential theft and data exfiltration, reaching domain admin within days. Schools and universities in Africa and Latin America were among the victims.
The 'Africa's Cybersecurity Landscape 2026' report on Nigeria, Kenya and South Africa finds AI used in more than 55% of observed attacks, from automated phishing to deepfakes. Weak currencies and dollar-priced security tools are pushing up defence costs for African firms.
Binance's initial investigation traces the heist to a poisoned Homebrew download in June and a fake recruitment 'assignment' in September, then abuse of an internal AI tool and a deployment token. About $2.85bn has been frozen and 98% of user assets replenished.
Chainalysis says the $6.3bn stolen from Binance is being cycled through thousands of scripted transactions to hide its trail. Binance has restored withdrawals in phases, with Binance Africa saying the losses were covered from the exchange's own reserves.
A World Wide Worx poll of 200 South African enterprises finds over half suspect or have seen AI-generated phishing, voice cloning or deepfakes, yet under 28% have upgraded liveness or face-matching controls and most lack tested response plans.
The CDP says AI-faked voices and videos are being used to trick relatives and colleagues into sending money or data, and reminds the public that a person's voice and image are protected personal data under Senegalese law.
Attackers used AI-driven techniques in the Chainalysis breach and the $6.3bn Binance heist, while Nigeria, second in global crypto adoption, still has no AI law. The NDPC and NITDA are reviewing data and cybercrime rules as AI-driven attacks on Nigerian finance reportedly rose 150%.
Central Bank of Kenya figures show card fraud losses more than doubled to Sh645m, online banking and internet scam cases climbed, and banks recovered only about 6% of targeted funds, down from 19% a year earlier.
The CSA says reported cyber incident losses rose more than ninefold from GH¢22.5m a year earlier, with social engineering behind most cases. It plans a zonal office in Tamale to improve reporting and response in the north.
Yazi's 2026 Global Digital Fraud Study finds phone calls are the top entry point for fraud in South Africa, with WhatsApp use far above the UK's. Most losses come from patient investment or job scams built over weeks, not sudden panic, so detection models should watch slow patterns.
A KnowBe4 Africa column draws on Interpol's latest African Cyberthreat Assessment, which puts reported cybercrime losses on the continent at $484m in 2025 and names South Africa the top target for ransomware, DDoS and phishing. It argues staff fear of blame is the bigger weakness.
The Deloitte and Jeune Afrique financial industry barometer, drawn from leaders in 20 African countries, finds electronic fraud is now the main operational brake on regional growth, with many lenders retreating to home markets and few connected to PAPSS.
Equity Bank says a former salary-processing manager used his user credentials to push disguised payroll transfers from the general ledger over eight months, with funds moved through third-party accounts and into cryptocurrency. The High Court ordered the crypto converted and held in escrow.
The National Financial Ombud says criminals posing as promoters ask shoppers to scan their faces, then use the biometric check to register their own device on the victim's digital banking profile. Fraud cases closed by the ombud rose 27.5% in the first nine months of 2026.
Minister Leon Schreiber told Parliament that 35 identity theft allegations were investigated this year and 17 officials accused of unlawfully processing ID applications were referred for discipline and prosecution. The paper green ID book remains the main target.
Nigerian police say some small SIM-registration outlets collect customers' NIN and personal details, then register other numbers that are sold to criminals. Victims risk being investigated for crimes committed with those lines and are urged to check which numbers are linked to their NIN.
Nigeria's identity commission raided unofficial enrolment points in Gwagwalada and elsewhere, seizing equipment used for illegal NIN registration and record changes. It says such operators extort applicants and risk compromising the national identity database.
Days after automated traffic cameras went live, police told drivers to trust only notices from the GPS-MTTD sender ID, check the ticket photo and plate, and pay via the NIB portal or *710*0#, never to personal mobile money numbers.
Interior CS Kipchumba Murkomen chaired the inaugural board of the agency created by executive order in July. It will audit and certify critical infrastructure and run a national operations centre, but the law has not yet defined how it fits with existing bodies.
At the Africa Cyber Defence Forum in Nairobi, ICT minister William Kabogo named operationalising the new agency and its operations centre as a top priority, with closer coordination with NC4, KE-CIRT and the data commissioner, as the CA logged 2.6bn threat events in Q3.
The private member's bill proposes fines of up to KSh500m or 10% of global turnover, plus jail for executives, with the Communications Authority enforcing age assurance and parental authorisation on Facebook, TikTok, X and others.
A House committee chair says the three bills will be enacted after the elections, with a national security architecture setting baseline standards. The review follows AI-driven fraud, the CAC and Remita data exposures, and N25.85bn in e-payment fraud losses in 2025.
Ghana's Data Protection Commission says the 2012 Act is being revised to cover biometrics, location data, cross-border transfers and AI, with stiffer fines. Its head also urged African states to keep copies of health, financial and energy data in-country.
The central bank says the loan apps breach Ghana's digital credit directive and violate customer data privacy and consumer protection rules. Banks and payment providers were told not to process transactions for them.
After FNB's R1m POPIA fine, the Information Regulator's enforcement notice also found the bank unlawfully gathered personal data from newspapers and other sources it treated as public. FirstRand's policy lists third-party data used to assess loan risk.
Speakers at the Lagos summit said diverging data protection laws, and regulators reading similar laws differently, create uncertainty for firms moving personal data between African countries under the AfCFTA Digital Trade Protocol, and called for harmonised rules.
The state-owned airline says intruders reached internal systems with staff and corporate records on 3 November, while booking and flight operations were unaffected. It has not said how many people are affected or whether a ransom was demanded.
Google, TrendAI and partners dismantled a botnet preloaded into the firmware of 1.3 million TV set-top boxes worldwide. The malware turned household connections into residential proxies for ad fraud and identity theft, and Google has banned the responsible manufacturer.
The Army says @HQNigerianArmy is back under official management after unauthorised access attempts on 29 August. The Defence Headquarters' X account was hit by a similar attack earlier that month and recovered within days.
An authorisation bypass in Entra Device Registration, rated CVSS 10.0, lets an unauthenticated attacker elevate privileges over the network. Entra is a cloud service, so Microsoft applies the fix, but admins should review Microsoft's advisory. NVD lists no exploitation yet.
A signature-verification bug in IBM API Connect 10.0.8 and 12.1 lets unauthenticated attackers bypass login; sibling flaws include hard-coded admin credentials and remote code execution. Banks and telcos running the API gateway should patch now. No exploitation reported.
The sixth edition of the forum will bring regulators, officials, executives and investors to Benin to discuss digital trust and cybersecurity in the age of artificial intelligence.