Ransomware in West African hospitals: the health sector under pressure
Three hospitals in Senegal and Côte d'Ivoire suffered ransomware attacks in May 2026. Clinical information systems were encrypted. The return to pen and paper lasted several days.
Severity
5Affected country
SNSector
HealthcarePublished
31 May 2026
Our score measures operational relevance to Africa — not the global virality of the story.
Contents · 6
What happened
Between May 4 and 17, 2026, three healthcare facilities confirmed ransomware incidents: the Hôpital Principal de Dakar (Senegal), the Centre Hospitalier Universitaire de Cocody (Côte d'Ivoire), and a private clinic in Abidjan whose name was not made public.
In all three cases, the identified or strongly suspected entry vector was targeted phishing via emails mimicking communications from each country's Ministry of Health — classic spear phishing executed with an unusual level of personalisation for the region.
The group behind the attacks
Technical indicators shared privately by two of the three facilities point to a group tracked as SilverMamba, active since late 2024. This group uses a ransomware-as-a-service (RaaS) variant with double extortion: data encryption AND a publication threat.
SilverMamba has so far primarily targeted government entities and healthcare facilities in francophone Africa. The group likely operates from Eastern Europe but has not been formally attributed.
Why healthcare is a priority target in Africa
African hospital systems combine several vulnerability factors:
— Limited IT budgets: cybersecurity accounts for less than 2% of IT budgets in the majority of public hospitals in sub-Saharan Africa. — Unpatched systems: Windows 7 and Windows Server 2008 remain in production in many facilities. — Lack of offline backups: cloud replication is rare; local backups are often on the same network as production systems. — Value of health data: a complete medical record sells for between $10 and $50 on underground markets, compared to less than $1 for a credit card.
Operational impact
Hôpital Principal de Dakar operated in degraded mode for 6 days. Medical prescriptions, test results and surgical schedules were managed manually. No death directly attributable to the incident was reported, but two non-urgent surgical procedures were postponed.
What facilities must do now
— 3-2-1 backups: three copies, two different media, one offline. Non-negotiable. — Network segmentation: connected medical devices (IoMT) must be on an isolated VLAN. — Monthly phishing simulation for administrative and clinical staff. — Business continuity plan (BCP) with documented and tested manual procedures.
Conclusion
African hospitals are no longer peripheral targets. The combination of ageing systems, high-value data and limited response capacity makes them prime targets for RaaS groups seeking solvent, low-resilience victims.
— ◆ —