Air Traffic and Services (ATNS) has roped in forensic investigators to probe the source of a cyberattack on its systems that could have brought commercial aviation activities in South Africa to a halt, with the entity not ruling out the possibility of employees collaborating with hackers.
Preliminary investigation shows that the agency’s operational technology environment supporting weather-related air traffic services came under a ransomware attack. If compromised, the system could critically disrupt flight planning, visibility data and communication lines between meteorological providers and control towers.
Network monitoring further indicated possible data exfiltration to external IP addresses located in China. “Internal technical teams have implemented containment measures and malware removal; however, a comprehensive forensic investigation is required to determine the root cause, extent of compromise, and any remaining risks,” ATNS said in a request for digital forensic experts to investigate the source and extent of the attack.
“Reports received through internal channels indicate that employees may have unlawfully accessed and exfiltrated personal information without authorisation. Initial investigations were unable to substantiate the allegations. An independent forensic investigation is required to establish facts, identify any policy or legislative violations, and provide defensible findings.”
ATNS manages more than 6% of the world’s airspace and employs more than 1,000 staff to ensure safe, efficient and orderly air traffic services across 21 aerodromes in South Africa. In the broader African region, ATNS supports aeronautical satellite communication across 33 states, connecting the continent from Cape to Cairo and extending to the Middle East.
ATNS spokesperson Khulu Phasiwe said the cyberattack took place during the current financial year, without being more specific. “ATNS is currently unable to on the nature or extent of any potentially compromised data until the forensic investigation has been concluded,” he said.
“ATNS is treating the matter with the necessary seriousness [and] will provide information, where appropriate, once the investigations have been completed.”
South Africa’s aviation assets have increasingly become a target of cyberattacks, with criminals looking to extort money from the entities.
South African Airways was hit by a significant cyberattack that temporarily disrupted its official website, mobile application and several internal operational and communication systems.
Airports Company South Africa (Acsa), which operates the country’s commercial airports, including OR Tambo, Cape Town and King Shaka international airports, this month warned that cyber threat risk remained relatively high.
Acsa used its annual report — published two weeks ago — to flag inadequate security governance and information security management system, as well as inadequate human resources capacity, as factors contributing to its cybersecurity risk.
The information and communication technology (ICT) inefficiencies included outdated systems and fragmented, non-integrated digital infrastructure.
It will fall to new Acsa CEO Siphamandla Mthethwa, who was announced on Friday, to accelerate the modernisation of outdated ICT systems and infrastructure. This will be his second stint at the top echelons of Acsa, having previously held the role of CFO before leaving the organisation in 2023 after a three-year stint.
Acsa chair Irvin Phenyane said Mthethwa’s combination of institutional knowledge and financial acumen would serve the entity well as it enters its phase of growth, including the implementation of its major airport infrastructure investment programme.
“Mthethwa returns to an organisation he knows well, but at a very different moment in its journey. He helped Acsa navigate some of its darkest financial days when Covid-19 brought aviation almost to a standstill,” Phenyane said.
“His financial acumen, understanding of the banking sector, and ability to build strong stakeholder relationships were important during that difficult period. He helped steady the organisation during the storm; he now returns to help us build for the sunshine.”
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
