South Africa's Air Traffic Control Faces Ransomware Attack

• •ATNS detected ransomware in its operational technology network supporting air traffic services.
• •Possible data exfiltration to external IP addresses in China raises concerns about insider involvement.
• •Ransomware attacks on aviation infrastructure have surged, highlighting increasing cybersecurity risks.

Air Traffic and Services (ATNS) in South Africa reported a ransomware attack targeting its operational technology network, which supports weather-related air traffic services. The attack could have severely disrupted commercial aviation activities. Preliminary investigations indicated potential data exfiltration to external IP addresses in China, and there are concerns about possible insider involvement. ATNS has engaged forensic investigators to assess the extent of the compromise and to identify any remaining risks. The agency manages over 6% of the world's airspace and has implemented containment measures. The attack is part of a worrying trend, as ransomware attacks on aviation infrastructure have surged significantly. The exact date of the incident remains unclear, but ATNS began seeking forensic services on September 18, 2026.