Angola's Biggest Mobile Network Hit by Cyberattack on the Day It Went Public

Key points

• Unitel, Angola's dominant mobile carrier, was hit by a cyberattack at 2:20 am on July 28, 2025, the same day the Angolan government sold a 15% stake in the company for roughly $320 million.
• Basic 2G and 3G voice calls came back on July 30, but faster 4G and 5G data services were still disrupted as late as August 4.
• Unitel controls between 66% and 76% of Angola's mobile market, meaning the outage affected the majority of the country's phone users.
• By August 4, residents of the capital Luanda could not use popular digital payment apps, forcing many to switch to cash.
• No ransomware group had publicly claimed responsibility as of the time of writing.

Unitel is Angola's largest mobile phone operator, serving the vast majority of the country's mobile users. On July 28, 2025, it had two big things happen at once: it became a publicly traded company, and somebody broke into its network.

The attack started at 2:20 am local time, several hours before Unitel's shares began trading on the Angola BODIVA stock exchange. The Angolan government had sold 7.5 million shares, representing a 15% stake, collecting more than 300 billion kwanzas (around $320 million). The stock climbed almost 25% on its first day. By the next morning it had fallen nearly 13%.

Unitel confirmed the attack in a statement posted to Facebook on August 1, calling it a "deliberate and malicious cyberattack on its technological infrastructure."

What went wrong for ordinary customers?

The outage knocked out most of the network for days. Engineers restored basic 2G and 3G service (older, slower connections used mainly for voice calls and text messages) on July 30. SMS messaging came back on July 31. But the faster 4G and 5G data services that people rely on for mobile internet remained disrupted well into the following week.

That mattered far beyond frustration with slow phones. Angola, like much of Africa, runs a large share of its economy over mobile networks. By August 4, residents in Luanda, the capital, could not use Multicaixa Express, the country's leading digital payment app, and had to fall back on cash. Multicaixa Express handled 62% of all network-based financial transactions in Angola in 2025.

Unitel holds between 66% and 76% of the Angolan mobile market, according to industry estimates, so there was no easy alternative for most users.

How does this fit into a wider pattern?

Africa's telecoms have become a repeated target. MTN Group, which serves more than 200 million customers across nearly twenty African and Middle Eastern markets, suffered a data breach in April 2025. Telecom Namibia was broken into in late 2024, with customer data leaked online in what appeared to be a ransom scheme, where criminals steal data and threaten to publish it unless they are paid.

No group has publicly claimed the Unitel attack, and Unitel has not said whether a ransom demand was made. Dark Reading, which first covered the story in detail, reported no attribution.

Should Angolan Unitel customers do anything right now?

If you use Unitel and your mobile data is still patchy, keep a small amount of cash on hand for payments until full service returns. Watch for phishing messages (fake texts or emails pretending to be from Unitel, asking you to click a link or confirm your account details). Criminals often send these after a publicised outage, when customers are expecting updates from their provider. If Unitel contacts you asking for your password or banking details, treat it as suspicious.

Kevin Cardwell, chief information officer at Cybastion, a cybersecurity firm working on Angola's digital infrastructure, said the attack illustrated what happens when a network is not properly segmented, meaning its systems are not divided into separate zones so that a break-in to one area does not automatically spread to the rest. "If you do take that hit, you can isolate that damage, and the attackers only take out, maybe, that segment," he said.