CSIDB logo
Incident

Unitel

Incident posture

Attack window
Jul 2026
Location
Angola
Status
Ongoing
CIA posture
Available to members
Updated
2026-08-26 19:03

Linked entities

Victim
Unitel
Threat actors
0 actors
Sources
3 sources

Timeline

Occurred
Jul 2026
Discovered
Undetermined
Disclosed
Jul 2026
Resolved
Pending

Summary

Unitel experienced a cyberattack that disrupted voice, mobile data and internet services nationwide just before its stock market debut. The attack affected its technology infrastructure, causing outages of 2G, 3G, SMS, 4G, 5G and some digital services, with restoration efforts ongoing. The incident coincided with the company's IPO, during which its stock initially rose sharply before declining the following day. Service disruptions forced some businesses to rely on cash as financial platforms like Multicaixa Express were unavailable. The operator serves over 21 million customers and holds a majority market share, raising concerns about customer migration to competitors.

Motives

Detailed motive labels are available to members.

0 motives

TTPs

Detailed technique labels are available to members.

0 techniques

Description

On Tuesday, July 28, 2026, Unitel detected a cyberattack at 02:20 local time that affected its technology infrastructure and caused widespread service disruptions across Angola. The attack disrupted voice, mobile data and internet services nationwide, leading to outages that impacted the telecom's 2G, 3G, 4G and 5G networks as well as some digital services. Unitel reported that 2G and 3G service were restored on July 30, SMS service was restored on July 31, while 4G, 5G and certain digital services continued to experience problems after those dates.

The cyberattack occurred on the same day that Unitel began trading on the Angola BODIVA stock exchange following the government's sale of a 15% stake in the company for 7.5 million shares, which generated more than 300 billion kwanzas (about $320 million). Unitel's stock rose almost 25% on the day of trading but fell nearly 13% the next day. In a statement posted to Facebook on August 1, Unitel described the incident as a 'deliberate and malicious cyberattack on its technological infrastructure' and said it would keep the market and investors informed of any relevant developments. The company noted that restoration efforts were ongoing but did not specify when full service would be restored and declined to provide details about the nature of the attack or who might be responsible.

Unitel serves more than 21 million customers in Angola, and the disruption forced many users to seek alternative means for services that relied on its network. On August 4, business people in Luanda had to turn to cash because popular financial services such as Multicaixa Express, which accounted for 62% of financial transactions over networks in 2025, were no longer functional. The operator also stated that it remained engaged in the complete normalization of its services over the coming days and would comply with legal rules applicable to a publicly traded company.

Sources

Sources available to members: 3 sources.

CSIDB