Air Botswana

Summary

Air Botswana disclosed a suspected ransomware attack that gave unauthorised parties access to some internal systems containing employee and internal information. The airline identified the incident and activated its response procedures, engaging relevant authorities and addressing data protection obligations while passenger booking systems, aircraft systems, flight operations, and aviation safety systems remained unaffected. It operates a smaller fleet serving scheduled destinations across several countries and is wholly government-owned. The disclosure did not specify how many people were affected, which systems were accessed, whether data was copied or encrypted, or if a ransom was demanded, and no group has claimed responsibility. Botswana's Data Protection Act requires breach notification to the Information and Data Protection Commission without delay and where feasible within 72 hours of awareness, with penalties for failure to implement appropriate security safeguards.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Air Botswana identified a cybersecurity incident on November 3 involving unauthorised access to some of its internal systems. The state-owned carrier disclosed the incident in a public notice published shortly after detection. Preliminary assessments indicated that the attack involved systems containing employee and internal information. The airline described the incident as a suspected ransomware attack, noting that the nature of the attack had yet to be confirmed. No group has publicly claimed responsibility for the incident. The airline has not disclosed how many people may have been affected, which specific systems were accessed, or whether data was copied from its network or encrypted in place. It has also not stated whether a ransom was demanded. Air Botswana has not indicated how long the attackers had access before detection or when affected systems are expected to be fully restored.

Passenger booking systems were not affected by the incident. Aircraft systems, flight operations, and aviation safety systems were also unaffected. The airline stated that it continues to operate in line with established aviation safety and security requirements. The notice distinguished between corporate information technology environments and operational technology environments, indicating that the separation between internal systems and flight operations remained intact during the incident. Air Botswana operates a fleet of three aircraft serving eight scheduled destinations across Botswana, South Africa, Zambia, and Zimbabwe. The airline is wholly owned by the Botswana government and is based at Sir Seretse Khama International Airport.

Air Botswana immediately activated its incident response procedures following detection. The airline engaged relevant authorities and initiated measures to address its applicable data protection obligations. Customers were directed to the airline’s call centre in Gaborone or its WhatsApp line for enquiries. The airline has not said whether it has formally notified the Information and Data Protection Commission. Botswana’s Data Protection Act, Act No. 18 of 2024, took effect on October 29, 2024, and requires data controllers and processors to notify the commission of a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it. The Act requires notification to describe the nature of the breach, including categories and approximate number of affected individuals and records where possible. Failure to implement appropriate security safeguards under the Act carries a fine of up to US$36,457, imprisonment for up to nine years, or both.

Employee and internal information includes payroll and human resources files, identity documents, contracts, and internal correspondence. Investigations remain under way to determine the full extent of the compromise. The airline’s public notice was precise about what was not affected but less specific about what was compromised. The disclosure followed identification of the incident on November 3 and publication of a signed public notice shortly afterwards, including contact details for customers seeking information.

Sources

Sources available to members: 1 source.