Air Botswana Reports Suspected Ransomware Attack On Internal Systems

Air Botswana has disclosed a cybersecurity incident involving a suspected ransomware attack that gave unauthorised parties access to some of its internal systems.

In a public notice, the state-owned carrier said it identified the incident on November 3. Preliminary assessments indicate that the attack involved “systems containing employee and internal information.”

The airline said it had “immediately activated its incident response procedures, engaged the relevant authorities and initiated measures to address its applicable data protection obligations.”

According to the notice, passenger booking systems were not affected. Neither were aircraft systems, flight operations or aviation safety systems. The airline said it continues to operate in line with established aviation safety and security requirements while working with its technology partners to protect the security and integrity of its systems.

Customers were directed to the airline’s call centre in Gaborone or its WhatsApp line for enquiries.

What the notice says, and what it does not

The notice is precise about what was not affected, but considerably less specific about what was.

“Employee and internal information” covers a wide range of records, from payroll and human resources files to identity documents, contracts and internal correspondence. The airline has not disclosed how many people may be affected, which systems were accessed, or whether data was copied from its network or simply encrypted in place.

It has also not said whether a ransom was demanded. Its description of the incident as suspected ransomware suggests that the nature of the attack has yet to be confirmed.

No group has publicly claimed responsibility. The airline has not indicated how long the attackers had access before detection or when it expects affected systems to be fully restored.

Those gaps are understandable in an initial disclosure made a day after detection, while forensic investigations are still under way. They are also the questions that will determine the eventual scale of the incident.

The clock the airline is working against

Botswana now has a statutory deadline for reporting personal data breaches.

The Data Protection Act, Act No. 18 of 2024, took effect on October 29, 2024. It requires data controllers and processors to notify the Information and Data Protection Commission of a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it.

The notification must describe the nature of the breach, including, where possible, the categories and approximate number of affected individuals and records. Where notification is delayed, the controller must explain why.

Notification is not required where a breach is unlikely to pose a risk to the rights and freedoms of affected individuals. That determination may be difficult to make quickly in an incident involving employee records.

The Act also makes failure to implement appropriate security safeguards an offence, carrying a fine of up to US$36,457, imprisonment for up to nine years, or both.

Air Botswana’s reference to measures addressing its data protection obligations suggests it is working within this framework. However, it has not said whether it has formally notified the Commission.

A public notice within a day

The timing deserves attention in its own right.

Air Botswana identified the incident on November 3 and published a signed public notice shortly afterwards, including contact details for customers seeking information.

Organisations in the region have historically taken weeks or months to confirm incidents of this kind, sometimes only after stolen data appears on leak sites or regulators intervene.

Early disclosure carries risks. It means communicating while the facts remain incomplete and inviting questions the organisation may not yet be able to answer. It also brings public scrutiny before investigators have established the full extent of the incident.

But delayed disclosure carries its own risks, particularly when affected data eventually surfaces elsewhere.

The line the airline is drawing

The most consequential part of the notice is its distinction between internal systems and flight operations.

Aviation organisations typically operate separate technology environments. Corporate information technology supports functions such as email, finance, human resources and booking. Operational technology supports systems involved in aircraft operations, navigation and safety.

These environments are expected to be segregated. Air Botswana’s statement indicates that this separation remained intact during the incident.

That claim will need to be assessed as investigations progress. A recent incident in South Africa illustrates why the distinction matters.

In September, Air Traffic and Navigation Services disclosed that it had found ransomware-linked malware in its operational technology network, including environments supporting weather services across several airports. The organisation brought in external forensic specialists to establish the extent of the compromise and determine whether data had been transmitted to external addresses.

Air Botswana operates a smaller fleet, with three aircraft serving eight scheduled destinations across Botswana, South Africa, Zambia and Zimbabwe. The airline is wholly owned by the Botswana government and based at Sir Seretse Khama International Airport.

But the underlying cybersecurity question is the same regardless of fleet size: what systems did the attackers reach, and what could they access from there?

What to watch

Four developments will help establish the seriousness of the incident.

First, whether Air Botswana confirms ransomware and discloses whether data was exfiltrated. That distinction separates a systems disruption from a data breach with potentially longer-term consequences.

Second, whether the airline establishes and publishes the number of affected employees and records.

Third, whether the Information and Data Protection Commission comments on the incident or initiates its own process.

Finally, whether any group publishes Air Botswana data on a leak site, which could provide further evidence of the attack and the information compromised.

For now, the airline has taken an important first step: disclosing the incident while investigations are still under way.