SA Urges Password Managers by 2026 to Combat Cybercrime

The Breach Numbers Behind the Push

South African accounts have been hit hard. Around 70 percent of South Africans have had at least one account exposed in a data breach, and roughly 45.7 million South African accounts have been compromised since 2004.

• 22.9 million leaked passwords and 13.3 million exposed email addresses make up that total
• Globally, more than 19 billion passwords have surfaced in public breaches
• Between 80 and 85 percent of people reuse passwords across different accounts
• About 68 percent of leaked passwords can be cracked within a day, and over half end in a number, which makes them easier to guess

Credential Stuffing Takes Minutes, Not Skill

The real weakness isn’t the technology, it’s the habit of reusing passwords. Once one service is breached, attackers run that same password against hundreds of other sites using credential stuffing tools, a process that takes minutes and requires almost no technical expertise. For businesses, a single compromised employee password can open the door to company email, customer records, financial systems, and cloud storage. Workforce security research found that 36 percent of South African organizations have already experienced a cyberattack.

Why Password Managers Are the Recommended Fix

Tacking an exclamation mark or a number onto an old password no longer helps, since cracking tools are built to recognize those exact patterns. Security experts now point to long, randomly generated passwords, unique to every account, as the baseline. A password manager like F-Secure Total Password Vault handles that by storing every credential in an encrypted vault behind one master password, generating new unique passwords on request, and flagging accounts that turn up in future breaches. Paired with multi-factor authentication and regular breach checks, that combination covers most of the gap that reused passwords currently leave open. Recommended password length now sits at 14 to 16 characters minimum.

A Recommendation, Not a Requirement

“By 2026” sounds like a deadline, but there’s no penalty attached to missing it. The push is guidance, not regulation, which means its success depends entirely on whether individuals and IT departments bother to act before the next breach, not after. Given that most of the 45.7 million exposed South African accounts were already compromised before this guidance existed, the real test isn’t whether the advice is sound, it’s whether anyone adopts it ahead of the headline rather than because of one.