South African Airways Confirms Cyber Attack, Investigates Possible Data Breach

South African Airways (SAA) has confirmed it was the target of a cyber attack that disrupted access to its digital platforms and internal systems over the weekend. The airline has since restored functionality and launched a forensic investigation into the incident.

In a statement issued today, the national carrier said the cyber incident began on Saturday, 3 May, impacting the airline’s website, mobile application, and various internal operations. SAA was quick to activate its disaster recovery and business continuity protocols to contain the breach.

“We acted swiftly to contain the disruption, restore services, and initiate a comprehensive investigation,” said Professor John Lamola, SAA Group CEO. “Our robust business continuity measures ensured operational stability, particularly for our valued customers.”

Despite the disruption, the airline confirmed that core flight operations remained unaffected. Customer service channels, including contact centres and sales offices, continued to function during the incident.

Investigation Underway

SAA has brought in independent digital forensic investigators to determine the root cause and assess the extent of the breach. While the full scope is still being evaluated, the airline says it is committed to notifying affected individuals should a data breach be confirmed.

“We are taking every necessary step to determine the root cause of this incident, strengthen our security framework, and mitigate any potential risks,” Lamola added.

As a National Key Point, SAA has reported the cyber attack to the State Security Agency, the South African Police Service, and the Information Regulator, in line with the Protection of Personal Information Act (POPIA).

South Africa’s Growing Cybersecurity Threat

The SAA breach is the latest in a string of cyber attacks targeting South African entities. Mobile networks MTN and Cell C have also recently experienced cyber-related incidents. According to cybersecurity firm ESET’s latest Threat Report, South Africa is the most targeted country in Africa for ransomware and infostealer attacks.

From June to November 2024 alone, the country accounted for over 40% of ransomware attacks and nearly 35% of infostealer incidents across the continent.

Customer Reassurance

SAA emphasised that the security of customer data remains its highest priority and that transparency is key to maintaining public trust.

“Should the forensic analysis reveal any risk to customer data, affected parties will be contacted directly in accordance with legal requirements,” the airline confirmed.

As cyber threats continue to escalate, South African businesses—especially state-linked enterprises like SAA—face growing pressure to bolster digital defences and protect critical infrastructure.

{Source: BusinessTech}

Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram

For more News in Johannesburg, visit joburgetc.com