The Unitel cyberattack reported Tuesday cut off voice, mobile data and internet service for millions of people in Angola, according to the country’s largest telecommunications operator. The outage landed hours before Unitel began trading on Angola’s securities exchange, turning a landmark privatization into a live test of resilience.
Unitel said it detected the incident shortly after 2 a.m. local time and activated response and containment measures. The company said technical and cybersecurity teams were working to limit the damage and restore service. It did not say what kind of attack it faced, who may have been responsible, or when customers should expect normal service to return.
In its statement, Unitel said services were still disrupted and that work was underway to stabilize the network. The company put its customer base at more than 21 million people. Its 2025 annual report cited 20.8 million customers and a 76% market share. Angola’s population is about 40 million, according to U.N. estimates for 2026.
What happened in the Unitel cyberattack?
Public network data suggests the failure was concentrated inside Unitel rather than caused by a broad cut to its outside internet connections. Network measurements from RIPE NCC reviewed by Recorded Future News showed Unitel’s IP prefixes stayed announced to the global internet during the disruption, meaning the routers connecting Unitel to the rest of the internet remained visible.
That matters because those prefixes would typically vanish if an upstream provider cut connectivity or if an external traffic flood overwhelmed the edge of the network. The pattern instead suggests an incident affecting Unitel’s internal core systems, though Unitel has not publicly confirmed the technical cause.
Cloudflare Radar telemetry showed Unitel traffic dropping sharply around the time the company said it detected the incident and remaining far below normal into Wednesday. Recorded Future News reported that the degradation appeared limited to Unitel, with no comparable decline across other Angolan network operators during the same period.
The outage also spilled into commerce. Angolan business publication Expansão reported that point-of-sale payment terminals using Unitel’s network were disrupted, affecting business communications and digital services that depend on internet access.
Did the IPO still happen?
Yes. Unitel started trading Wednesday on BODIVA, Angola’s securities exchange, in what officials described as the largest initial public offering in the country’s capital market history. The Angolan state, through the asset management institute IGAPE, sold a 15% stake in the company.
The offering ran from July 6 to July 24 and was oversubscribed at 120.72%, with more than 11,000 investors taking part. Trading went ahead despite the outage, valuing Unitel at $2.14 billion and raising about $321 million for the government’s stake.
The listing is a major piece of President João Lourenço’s privatization program, which is intended to reduce state control in Angola’s economy and draw foreign capital. Unitel became the first non-financial company listed on the Angolan exchange, and the sale has been treated as a signal for possible future listings of larger state-linked companies, including national oil company Sonangol.
Unitel came under state control in 2022 after Angolan authorities seized shares previously owned by Isabel dos Santos, daughter of former President José Eduardo dos Santos. That seizure formed part of Lourenço’s campaign to unwind business networks tied to his predecessor’s 38-year rule.
BODIVA and Angola’s capital markets regulator had not issued public statements on the cyberattack by the time of publication, according to Recorded Future News. Angolan authorities also had not said whether they believe the timing was connected to the IPO.
This story draws on original reporting from The Record.
