Back Scworld

South African air traffic control firm investigates ransomware

Scworld • September 30, 2026

Coverage from Dark Reading indicates that the South African state-owned company responsible for air traffic control and weather operations, Air Traffic and Services (ATNS), has discovered ransomware-linked malware within its operational technology (OT) network. The company believes its technical team contained the attack, but is seeking cyber-forensics firms to investigate the incident, which may also involve data theft.

The incident at ATNS, which manages approximately 10% of the world's airspace, involved suspicious activity detected in OT environments supporting weather services. Preliminary findings pointed to malware commonly associated with the early stages of ransomware attacks. The company also noted suggestions of data exfiltration to external IP addresses in China. The investigation is looking into two facilities, Port Elizabeth Airport (FAPE) and potentially East London Airport (FAEL) in South Africa, as well as Maputo International Airport in Mozambique (FAMM) for a possible insider data theft.

This event underscores the growing risks to aviation infrastructure, a sector that saw a sixfold increase in ransomware attacks in 2025. Experts note that critical infrastructure in Africa is increasingly targeted due to the high visibility of disruptions like grounded flights. The ongoing investigation aims to determine the root cause, extent of compromise, and remaining risks, highlighting potential gaps in security governance, skills, and system maintenance within the region.

SC Staff September 25, 2026

Laura French September 25, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

South Africa's Air Traffic Control Faces Ransomware Attack Investigation Air Traffic and Services (ATNS) in South Africa reported a ransomware attack affecting its operational technology (OT) network, which supports air traffic control and weather services. The attack involved malware linked to ransomware and indicated potential data exfiltration to external IP addresses in China. ATNS has engaged forensic investigators to assess the incident, which could disrupt commercial aviation activities. The attack's exact timing is unclear, but ATNS requested cyber-forensic services starting September 18, 2026. Preliminary findings suggest that employees may have unlawfully accessed personal information, although these allegations remain unsubstantiated. ATNS manages approximately 10% of the world's airspace and has faced increasing cyber threats, with ransomware attacks in the aviation sector reportedly surging sixfold in 2025. The investigation is ongoing, and ATNS has implemented containment measures while awaiting further analysis. 3 sources 57

Extracted Entities

South African air traffic control firm investigates ransomware

The full story

Extracted Entities

Attack Types (3)

Companies (3)

Countries (3)

MITRE ATT&CK (1)