SAA operations ‘remain resilient’ post cyber incident

The breach temporarily disrupted access to the airline’s website, mobile application, and several internal operational systems, prompting swift response measures to mitigate its effects.

SAA immediately activated its disaster management and business continuity protocols upon detection of the incident. These actions successfully contained the incident and minimised disruption to core flight operations. They also ensured the continued functionality of essential customer service channels, such as the airline's contact centres and sales offices. Normal system functionality across all affected platforms was restored later the same day.

SAA said it has undertaken all reasonable and lawful steps as a National Key Point, including formally reporting the incident to the State Security Agency (SSA), South African Police Service (SAPS) for criminal investigation and notifying the Information Regulator of South Africa as a precautionary measure under the Protection of Personal Information Act (POPIA).

Prof. John Lamola, Group CEO of South African Airways, said: "The security and integrity of our business systems and the protection of the consumer data entrusted to us remain our highest priority. In response to the cyber incident that began on May 3rd, we acted swiftly to contain the disruption, restore services, and initiate a comprehensive investigation. Our robust business continuity measures ensured operational stability, particularly for our valued customers. I want to assure all stakeholders, including our partners, customers, and dedicated employees, that we are taking every necessary step to determine the root cause of this incident, strengthen our security framework, and mitigate any potential risks. SAA remains committed to delivering safe, reliable, and resilient service."