Angola's Biggest Mobile Network Hit by Cyberattack on the Day It Went Public

Key points

• Unitel, Angola's dominant mobile carrier, was hit by a cyberattack at 2:20 am on July 28, 2025, the same day the Angolan government sold a 15% stake in the company for roughly $320 million.
• Basic 2G and 3G voice calls came back on July 30, but 4G and 5G data services were still disrupted as late as August 4.
• Unitel controls between 66% and 76% of Angola's mobile market, meaning the outage affected the majority of the country's phone users.
• By August 4, residents of the capital Luanda couldn't use popular digital payment apps, forcing many to switch to cash.
• No ransomware group had publicly claimed responsibility as of the time of writing.

Unitel is Angola's largest mobile phone operator. On July 28, 2025, it became a publicly traded company and somebody broke into its network, all before dawn.

The attack started at 2:20 am local time. Unitel's shares began trading that same morning on the Angola BODIVA stock exchange, where the Angolan government had sold 7.5 million shares, a 15% stake, collecting more than 300 billion kwanzas (around $320 million). The stock climbed almost 25% on its first day, then fell nearly 13% the next.

Unitel confirmed the attack in a statement posted to Facebook on August 1, calling it a "deliberate and malicious cyberattack on its technological infrastructure."

What went wrong for ordinary customers?

Engineers restored basic 2G and 3G service (older connections used mainly for voice calls and texts) on July 30. SMS came back July 31. Faster 4G and 5G data remained disrupted well into the following week.

That mattered far beyond slow phones. Angola, like much of Africa, runs a large share of its economy over mobile networks. By August 4, residents in Luanda couldn't use Multicaixa Express, the country's leading digital payment app, and had to fall back on cash. Multicaixa Express handled 62% of all network-based financial transactions in Angola in 2025.

With Unitel holding between 66% and 76% of the Angolan mobile market, there wasn't an easy alternative for most users.

How does this fit into a wider pattern?

Africa's telecoms have become a repeated target. MTN Group, which serves more than 200 million customers across nearly twenty African and Middle Eastern markets, suffered a data breach in April 2025. Telecom Namibia was broken into in late 2024, with customer data leaked online in what appeared to be a ransom scheme, where criminals steal data and threaten to publish it unless they're paid. We noted the pressure this pattern puts on enforcement in our piece on Nigeria's rising fraud costs on 15 July 2026: the incidents are getting rarer but the damage per incident keeps climbing.

No group has publicly claimed the Unitel attack, and Unitel hasn't said whether a ransom demand was made.

Should Angolan Unitel customers do anything right now?

Keep a small amount of cash on hand for payments until full service returns. Watch for phishing messages, fake texts or emails pretending to be from Unitel and asking you to click a link or confirm your account details. Criminals often send these after a publicised outage, when customers are expecting updates from their provider. If Unitel contacts you asking for your password or banking details, treat it as suspicious.

Kevin Cardwell, chief information officer at Cybastion, a cybersecurity firm working on Angola's digital infrastructure, told Dark Reading the attack illustrated the danger of poor network segmentation, where systems aren't divided into separate zones so a breach in one area doesn't spread automatically to the rest. "If you do take that hit, you can isolate that damage, and the attackers only take out, maybe, that segment," he said.

The timing is what should concentrate minds here. Whoever hit Unitel chose the morning of a high-profile IPO, guaranteeing maximum visibility and minimum tolerance for downtime. Whether that was deliberate pressure or just opportunism, it worked.