South Africa Seeks Help After Air Traffic Control Cyberattack

South Africa is seeking assistance after a cyberattack targeted its air traffic control environment, public reports say. The reported target is aviation infrastructure, but available information does not identify the attackers, explain how they gained access or confirm whether flights or air traffic services were disrupted.

That distinction matters. A cyberattack can target an organisation without affecting every system it operates. Until authorities provide more detail, it is not possible to say whether the incident affected operational technology, administrative networks, or both. There is also no confirmed public account of data theft, service interruption or damage.

For airlines, airports and aviation authorities, the immediate priority is to establish what was accessed and whether systems remain safe to use. For businesses elsewhere in Africa, the incident is a reminder to prepare for cyber incidents that may involve essential services, suppliers and operational technology.

What is known about the South African cyberattack?

The confirmed information is limited to the reported target and South Africa’s search for assistance. The target was air traffic control, and the country is seeking help after the attack. Public details do not name the responding authorities or outside specialists, identify a threat group, or describe the tools used.

Air traffic control depends on communications, data and technical systems that help staff manage aircraft movements. But the phrase “targeted air traffic control” does not, by itself, establish that attackers took control of those systems. It also does not prove that aircraft operations stopped. Those conclusions require evidence that has not been made public.

Keeping that uncertainty clear is important for travellers and organisations. There is no confirmed basis in the available information to advise passengers that flights have been cancelled or to claim that flight safety was compromised. Travellers should check directly with their airline or airport for current service information rather than rely on unverified social media claims.

Why does a cyberattack on air traffic control matter?

Air traffic control supports the safe and orderly movement of aircraft. A disruption to essential systems could create operational challenges, so aviation authorities need to assess the incident carefully and keep clear records of what they find. That is a general risk, not confirmation that this attack caused such a disruption.

Investigators typically need to determine which systems were exposed, how access occurred and whether the attacker could move between connected networks. They must also check whether sensitive information was accessed and whether any compromised equipment or accounts remain active. Those checks help distinguish an attempted intrusion from a confirmed service or data breach.

Organisations with operational technology face an added challenge: changing or disconnecting systems without a plan can itself create safety and service risks. Technical teams should coordinate containment with the people responsible for operating the infrastructure. They should preserve logs and other evidence while following approved safety procedures.

What should aviation and infrastructure operators do?

Operators should first follow their incident-response plans and notify the relevant national authorities. Security and operations teams should establish a shared picture of affected systems, restrict suspicious access where safe to do so, and preserve records for investigation. They should not make unverified claims about the cause or impact while those checks continue.

• Review access to critical systems, especially remote connections and accounts with administrative privileges.
• Use multi-factor authentication for remote access and privileged accounts wherever available.
• Separate business networks from operational systems, and limit connections to only those required for safe operations.
• Apply security updates through tested change procedures that account for operational and safety requirements.
• Keep protected backups of essential configurations and data, and test restoration procedures regularly.
• Check whether suppliers or service providers had access to affected environments, and coordinate investigations with them.
• Maintain a clear incident contact list and practise how technical, operational and communications teams will respond.

These are precautionary measures for operators generally; they do not imply that any particular weakness caused the South African incident. The details of the intrusion have not been publicly established.

What should individuals and Kenyan organisations do now?

Individuals can reduce the risk that a compromised personal account becomes an entry point into workplace systems. Use a unique password for every important account, store passwords in a reputable password manager, and turn on two-factor authentication, also called 2FA. Never share one-time login codes with someone who contacts you unexpectedly.

Install updates for phones, computers, browsers and security software. Back up important files to a separate, protected location and check that you can restore them. Be cautious with unexpected attachments, links and requests to reset a password. If you suspect an account has been accessed, change its password from a trusted device, end unfamiliar sessions and notify the organisation that manages the account.

Kenyan businesses should document suspicious activity, preserve relevant messages and system logs, and notify their internal security or IT team promptly. Organisations and individuals can report cybercrime to the Directorate of Criminal Investigations (DCI) cybercrime unit. Use official DCI channels to confirm current reporting procedures; avoid sending sensitive evidence to unverified contacts.

South Africa’s search for assistance signals that the incident requires investigation, but the available public account does not establish its cause or operational impact. Until authorities provide those details, travellers should confirm their own flight status with their airline, while infrastructure operators should follow incident procedures and secure access to critical systems.