Ransomware hits South Africa's air traffic agency — staff collusion not ruled out
South Africa's Air Traffic and Navigation Services has brought in forensic investigators after a ransomware attack on the operational technology behind its weather-related air traffic services — an incident the agency says could have halted commercial aviation.
South Africa’s Air Traffic and Navigation Services (ATNS) has brought in forensic investigators to probe the source of a ransomware attack on its systems — one it says could have halted the country’s commercial aviation.
A preliminary investigation found its operational technology environment supporting weather-related air traffic services came under ransomware attack. If compromised, it could critically disrupt flight planning, visibility data and communication lines between meteorological providers and control towers, according to the Sunday Times.
Network monitoring indicated possible data exfiltration to external IP addresses in China. ATNS said internal teams had implemented containment and malware removal, “however, a comprehensive forensic investigation is required to determine the root cause, extent of compromise, and any remaining risks.”
The agency has not ruled out employees collaborating with hackers. Internal reports suggested staff may have unlawfully accessed and exfiltrated personal information without authorisation — but initial investigations could not substantiate the allegations, and an independent probe has been ordered. The mandate is corroborated by an official ATNS tender for a digital forensic investigation provider, published on 18 September and closed on 25 September (tender record).
Spokesman Khulu Phasiwe said the attack took place this financial year and ATNS was “currently unable to comment on the nature or extent of any potentially compromised data until the forensic investigation has been concluded.”
The stakes are high: ATNS manages more than 6% of the world’s airspace and employs more than 1,000 staff across 21 aerodromes, while supporting aeronautical satellite communication across 33 states.
Sources
- Sunday Times (South Africa), “Air traffic agency probes cyberattack”, 2026-09-26: https://www.sundaytimes.timeslive.co.za/business/news/2026-09-26-air-traffic-agency-probes-cyberattack/
- ATNS tender ATNS/RFQ14/07/2026/27/IT-DIGITAL FORENSIC_RE ADVERT (published 2026-09-18): https://www.governmenttenderssa.co.za/tender/atns%3Aatns-rfq14-07-2026-27-it-digital-forensic-re-advert/appointment-of-a-service-provider-for-digital-forensic-investigation-of-malwar-atns-rfq14-07-2026-27-it-digital-forensi
More on this topic: all Technology stories
