Air Botswana Probes Suspected Cyberattack: What Is Known

Air Botswana is investigating a suspected cyberattack, with the probe noted on 5 November 2026. The available facts do not confirm how the incident happened, which systems may have been affected, whether any data was accessed or whether flights and passengers experienced disruption. The airline’s investigation will need to establish those details before the incident can be assessed more fully.

For travellers, the distinction between a suspected attack and a confirmed breach matters. A cyber incident does not automatically mean that personal information has been stolen or that airline operations have stopped. Passengers should check official Air Botswana channels for confirmed updates and take ordinary account-security precautions rather than act on unverified messages.

What is known about the suspected Air Botswana cyberattack?

The confirmed point is that Air Botswana is probing a suspected cyberattack. The available information does not identify the entry point, the systems under investigation or the people responsible. It also gives no confirmed account of customer-data exposure, ransom demands, flight cancellations or booking-service interruptions.

Those gaps are significant. Investigators typically need to determine whether an unauthorised person accessed a system, what activity took place and whether the incident affected other services. Until those questions have answers, it would be inaccurate to describe the case as a confirmed data breach or to claim that passenger records have been exposed.

A suspected cyberattack can involve different kinds of activity, including attempts to steal login details, install malicious software or disrupt access to online services. These are general possibilities, not confirmed details about the Air Botswana investigation. The available facts do not establish that any particular method was used.

Why could an airline cyber incident matter to passengers?

Airlines depend on digital tools for customer interactions and business processes. If an incident affects a service passengers use, they may need to verify bookings or seek help through official customer-support channels. But the existence of a probe alone does not show that any such service has been disrupted in this case.

Passengers should be especially careful with unexpected emails, text messages and social-media posts that claim to offer refunds, confirm a booking problem or request account verification. A criminal may use a real incident as a pretext to collect passwords or payment information. Do not follow a link or provide sensitive details just because a message uses the airline’s name or logo.

Instead, open the airline’s official website or app directly, or use contact details already provided with a booking. If a message asks for a password, one-time security code or payment-card details to “fix” an account, treat that request as suspicious and verify it independently.

What should Air Botswana customers do now?

Travellers do not need to assume their accounts have been compromised. They can, however, take a few practical steps that reduce the risk of account misuse:

• Use a unique password. If you use the same password for an airline account and other services, replace it with a strong, separate password. A password manager can help create and store unique passwords.
• Turn on two-factor authentication. Where the service offers it, add a second verification step. Never share a one-time code with a caller or message sender.
• Check account activity. Look for unfamiliar sign-ins, changes to contact details or bookings you did not make. Contact the airline through an official channel if something looks wrong.
• Install software updates. Keep your phone, computer, browser and security software up to date. Updates often address known weaknesses.
• Keep booking records. Save your confirmation and payment records securely so you can compare them with account activity if you need help.
• Be cautious with payment requests. Verify unexpected requests for extra fees or refunds with the airline before paying or sharing financial information.

If you receive a suspicious message, keep a copy or screenshot, including the sender details and time. Do not forward it widely or reply with personal information. If you entered a password on a page reached through a suspicious link, change that password through the service’s official app or website and change it anywhere else you reused it.

How should organisations respond to a suspected cyberattack?

Businesses should treat a suspected incident as a matter for prompt, controlled investigation. Staff should report unusual account activity or system behaviour to their organisation’s IT or security team rather than trying to investigate by changing settings or deleting files. The team can preserve relevant logs, assess which services are affected and decide whether to isolate a device or account.

Organisations should review access to important accounts, remove access that is no longer needed and use multi-factor authentication where available. They should also maintain tested backups of critical information. A backup is useful only if the organisation can restore it, so recovery procedures need to be checked rather than assumed to work.

Clear internal communication helps limit confusion. Employees should know where to report a suspicious email or device, and customer-facing teams should use approved wording until investigators confirm what happened. Speculation about stolen data or service disruption can mislead customers and make incident response harder.

Where can people in Kenya report a cybercrime?

People in Kenya who believe they have experienced cybercrime can report it to the Directorate of Criminal Investigations’ cybercrime unit or at a police station. They should preserve relevant evidence, such as messages, transaction records, screenshots and account alerts. Do not delete the original evidence, and avoid sharing passwords or security codes while seeking help.

If the incident involves a bank account or payment card, contact the financial provider promptly through its official number or app and ask what steps can protect the account. If a work device or business system is involved, notify the organisation’s designated security or IT contact immediately. Reporting channels do not replace securing affected accounts, so change compromised passwords and enable two-factor authentication as soon as it is safe to do so.

Air Botswana’s probe establishes that a suspected cyberattack is under investigation, not that passenger data was stolen or flights were affected. Until more is confirmed, travellers should use verified airline channels, ignore unsolicited requests for credentials and secure any account that shows suspicious activity.