ATNS: Malware, Missing Records and More Questions Than Answers

By Garth Calitz

Cybersecurity concerns, unexplained financial record deletions and an uncomfortable audit outcome have put South Africa’s air navigation service provider under scrutiny. For an organisation responsible for keeping the country’s skies orderly, the questions are piling up faster than the answers.

Few organisations in South African aviation can afford to have a bad day quite like Air Traffic and Navigation Services (ATNS). When the systems responsible for managing aircraft movements, communications and other essential services come under scrutiny, the consequences extend well beyond the organisation’s boardroom. Unfortunately, ATNS has recently found itself dealing with more than one uncomfortable set of questions.

A reported malware incident involving an operational technology environment supporting weather-related air traffic services has prompted a forensic investigation. Separately, the Auditor-General has raised serious concerns about internal controls and unexplained deletions of revenue-related records.

Two different matters, certainly. There is no established evidence that they are connected. But together they make for an uncomfortable picture of an organisation that really should have its systems, controls and oversight firmly under control. Because in aviation, “we think everything is fine” is not quite the same as proving that it is.

The cyber incident reportedly involved malware associated with the early stages of a ransomware attack. ATNS identified the infection and undertook containment and removal measures, while specialist forensic work was sought to establish the extent of the compromise. The obvious questions are straightforward. How did the malware get in? Which systems were affected? Was information actually removed from ATNS networks? And, most importantly, can the organisation demonstrate that the incident did not compromise the reliability of essential air traffic services?

These are not unreasonable demands. They are the minimum questions any organisation responsible for critical aviation infrastructure should expect.

Reports of network activity involving external IP addresses located in China have also attracted attention. However, an IP address is not a passport, and a destination does not establish who was behind an intrusion. Attribution requires evidence, not a glance at a map and a generous helping of geopolitical suspicion.

There has been no confirmed public evidence in the reporting reviewed that aircraft safety systems were taken over or that the incident caused flight disruption. That distinction must be maintained. Nevertheless, the absence of publicly confirmed operational consequences does not mean that the incident can simply be filed under “problem solved” and forgotten. Removing malware is one task. Establishing how it arrived, whether it spread and what must change to prevent a repeat performance is another.

As if the cybersecurity investigation were not enough, ATNS has also faced uncomfortable questions about its financial controls. The Auditor-General’s findings, reported in October, included significant weaknesses in IT general controls and unexplained deletions of revenue-related records. These deficiencies meant auditors could not rely on certain system-generated reports and automated controls used in processing and recording revenue.

ATNS reported approximately 303,034 billable aircraft movements in the financial year to March 2026, up from 287,760 in the preceding year. Regulated revenue reportedly increased by 18.9% to approximately R1.8 billion. Those are substantial numbers. They also make reliable financial records rather important.

A disclaimer audit opinion does not automatically mean fraud has occurred, and unexplained deletions are not proof of theft. But when auditors cannot obtain sufficient appropriate evidence to verify the accuracy and completeness of revenue information, management has a problem that cannot be solved with a carefully worded corporate statement.

The question is not merely whether the numbers look plausible. It is whether they can be independently verified. A missing maintenance entry can ground an aircraft. A missing financial record may not stop a departure, but it can undermine confidence in the organisation responsible for providing the services that make those departures possible. One would hope the standards applied to both are equally serious.

It is important not to join the dots before investigators have established whether there are any dots to join. The cyber incident and the financial-control findings are separate matters, and there is no established evidence that one caused the other. However, both raise legitimate questions about access controls, monitoring, system integrity and management oversight.

ATNS has also faced a separate investigation into allegations that employees accessed and removed personal information without authorisation at Mahikeng Airport. The initial investigation reportedly did not substantiate the allegations, and they should not be presented as proven misconduct. Still, the industry is entitled to ask what these investigations have established, which corrective actions have been implemented and whether the organisation can demonstrate that its control environment is working as intended.

Commissioning a forensic investigation is a sensible step. Announcing an improvement plan is also sensible. But neither is the finish line. The public needs to know whether the investigations have been completed, what the findings were and whether those responsible for addressing any shortcomings have actually done so. Otherwise, investigations risk becoming yet another paperwork exercise, promises and endless assurances, with little evidence of meaningful progress.

ATNS should provide clear answers on several fronts:

First, it should explain the extent of the cyber incident, including whether data exfiltration was confirmed, which systems were affected and whether independent investigators identified any continuing vulnerabilities.

Second, it should clarify whether essential air traffic services were exposed to operational risk and what contingency arrangements were available. This does not require publishing sensitive technical details that could assist future attackers. It does require giving the aviation industry meaningful assurance.

Third, the organisation needs to explain the unexplained deletions of revenue records identified by the Auditor-General. What caused them? How far back did the problem extend? Can all billable aircraft movements be reconciled against reliable records? And what controls have been introduced to prevent a recurrence?

Finally, ATNS should publish a clear account of its corrective actions, with milestones and accountability. “We are addressing the matter” is a familiar phrase in corporate communications, but it is not a particularly useful measure of progress. The industry needs evidence of improvement, not simply confirmation that improvement is on somebody’s to-do list.

ATNS occupies a critical position in South African aviation. Airlines, general aviation operators and other airspace users depend on reliable air traffic services. The organisation’s resilience is therefore not merely an internal management concern; it is an industry-wide issue. Cybersecurity threats are a reality for critical infrastructure around the world. No organisation can credibly promise that it will never be targeted. What matters is whether it has effective defences, reliable monitoring, tested recovery arrangements and the ability to identify and correct weaknesses quickly.

The same principle applies to financial governance. Systems must produce trustworthy records, management must be able to account for them, and independent auditors must be able to verify the results. None of this is unreasonable. It is what good governance is supposed to look like.

ATNS does not need a public relations rescue mission. It needs to demonstrate that its systems work, its records are reliable and its management understands the seriousness of the issues being raised. The cyber incident must be investigated properly. The audit findings must be addressed. Any weaknesses must be corrected, and the results must be independently verified. There is no need for sensationalism, speculation about foreign involvement or suggestions that aircraft were placed in danger without supporting evidence. The facts are serious enough on their own.

But neither should the industry be expected to accept a reassuring statement as a substitute for answers. Trust is earned through evidence, procedures and demonstrated performance. It is not restored by issuing another statement saying that everything is under control. For an organisation that helps keep South Africa’s skies moving, that should be a fairly basic principle.

And if ATNS can demonstrate that its systems and controls are as dependable as the services it provides, it will have gone some way towards answering the questions now hanging over it.

Until then, the industry will quite reasonably keep asking.