South African Airways (SAA) listed by the Inc Ransom ransomware group

Overview

The Inc Ransom group has listed South African Airways (SAA), the state-owned passenger and freight airline, on its leak site. A member of the Star Alliance, SAA is headquartered in Johannesburg. The listing appeared on 16 May 2025.

What was published

The group claims to have exfiltrated data from the airline. The archive is expected to include passenger records, booking data and corporate information.

Risks for affected individuals

• Passenger personal data may be exposed.
• Booking records could enable fraud.
• Employees' information may be included.

What remains unknown

• The volume of data exfiltrated.
• Whether the data has been published.
• The response status of the airline.

What affected people should do

Passengers should monitor their accounts and be cautious of unsolicited communications. SAA should notify affected passengers and staff, review its systems, and coordinate with aviation authorities on the response.