The Communication Regulatory Authority of Namibia (Cran) has confirmed that a company called INC Ransom is responsible for the cybersecurity incident the Namibia Airports Company (NAC) suffered last week.

Cran spokesperson Mufaro Nesongano in a statement issued on Thursday says the group claims to have exfiltrated approximately 500GB of data and that it will disclose the information once a specified timer lapses.

"They claim to have exfiltrated financial records, human resources information, customer data and contact details. However, none of the data has been released," he says.

This is the second company the group has targeted in Namibia, after an attack on the Otjiwarongo municipality last year.

Keep up with the latest headlines on WhatsApp | LinkedIn

The INC Ransomware Group is a highly active and sophisticated cybercriminal organisation responsible for numerous attacks worldwide, across both public and private sectors.

It employs double-extortion tactics, combining data theft with the encryption of critical information to increase pressure on victims.

"The Namibia Cyber Security Incident Response Team (NAM-CSIRT) reiterates its earlier advisory on the INC Ransomware Group that was shared with all constituents. The advisory is available to download from the NAM-CSIRT official website," says Nesongano.

Organisations are encouraged to prioritise the implementation of best practice security controls, patch management, multifactor authentication on VPN, basic cyber hygiene, awareness training, development of incident response plans and disaster recovery and business continuity plans.