Executive Summary
In the early hours of 28 July 2026 (~02:00–02:20 local), Unitel S.A.—Angola’s largest mobile operator—detected a cyberattack against its technology infrastructure and activated incident response and containment. The incident caused nationwide disruption of mobile voice, data, internet, and messaging for more than 21 million customers (other coverage cites ~20.8 million; ~76% market share).
Timing: the outage began on OFS settlement day on BODIVA; trading admission was 29 July 2026. The state sold 7.5 million shares (15%) at AOA 40,040, raising AOA 300.3 billion (~$321–329 million); subscription was ~120.72%, with 11,264 new investors. It was the first non-financial BODIVA listing. Trading proceeded despite the outage. No BODIVA/CMC public statement tying the cyber incident to IPO process changes was identified (The Record, 29 July 2026).
Telemetry reported by The Record: Unitel prefixes stayed in RIPE; Cloudflare Radar showed a traffic collapse that was Unitel-specific; POS and digital services were disrupted. Around 3 August, a criminal investigation was opened (Aguinaldo Jaime); BODIVA leadership noted customer and business impact. On 5 August, core mobile and third-party services were restored (ANGOP, 6 August). Around 20 August, nationwide restore was affirmed (wait-tone excepted); forensic work had identified no personal-data compromise to date; automatic compensation was announced. The operator characterized the event as a deliberate attack of extraordinary magnitude and sophistication.
As of 14 September 2026 OSINT: no public indicators of compromise, malware families, named actors, or CVE have been published. This is an availability-focused critical-telecom TPRM narrative under capital-markets pressure—not a product CVE bulletin.
Technical Information
Public reporting describes a deliberate, targeted cyberattack that caused extended nationwide outages. The exact technical mechanism has not been published. Confirmed impact is on voice, data, messaging, POS, and third-party services on Unitel. Other Angolan MNOs and BODIVA trading systems were not reported as affected.
MITRE ATT&CK mappings below are Rescana analytical alignments to the confirmed availability impact only; they are not Unitel-confirmed:
This advisory does not attribute the incident to a named APT. The operator stated around 20 August that no personal-data compromise had been identified to date.
Affected Product Versions
N/A — this is not a CVE or product-build advisory. The named operator is Unitel S.A.
Workaround and Mitigation
For enterprises, banks, and fintechs that depend on Unitel:
- Inventory hard dependencies (voice, data, SMS OTP, POS, WAN).
- Maintain alternate-MNO, satellite, and offline-POS playbooks for 24–216 hour outages.
- Heighten monitoring and assurance asks around IPO and M&A event windows.
- Close confidentiality and availability findings separately in the supplier file.
- Require contractual notice SLAs and a high-level RCA even when no IoCs are published.
Do not invent indicators of compromise or APT claims.
Indicators of Compromise
No public indicators of compromise have been published as of this advisory. Treat that as an honest empty set—not as proof of non-compromise—and validate any future indicators before enforcement.
References
- Business Insider Africa, “Cyberattack hits Angola’s biggest telecom hours before landmark $329 million IPO,” 2026-07-28 — https://africa.businessinsider.com/local/markets/cyberattack-hits-angolas-biggest-telecom-hours-before-landmark-dollar329-million/ywd3hz1
- African Markets, “Angola: Unitel hit by cyberattack ahead of BODIVA stock market debut,” 2026-07-28 — https://www.african-markets.com/en/news/southern-africa/angola/angola-unitel-hit-by-cyberattack-ahead-of-bodiva-stock-market-debut
- The Record, Angola Unitel cyberattack outage, 2026-07-29 — https://therecord.media/angola-unitel-cyberattack-outage
- ANGOP, “UNITEL suffers cyberattack,” 2026-07-28 — https://angop.ao/en/noticias/economia/unitel-sofre-ataque-cibernetico/
- ANGOP, “UNITEL completes restoration of mobile services,” 2026-08-06 — https://angop.ao/en/noticias/economia/unitel-conclui-reposicao-dos-servicos-moveis/
- Portal Ango Line, “Unitel abre investigação criminal para identificar autores de ataque cibernético,” 2026-08-03 — https://portalangoline.com/unitel-abre-investigacao-criminal-para-identificar-autores-de-ataque-cibernetico/
- Observador, “Unitel repõe serviços em Angola mais de três semanas após ataque cibernético,” 2026-08-20 — https://observador.pt/2026/08/20/unitel-repoe-servicos-em-angola-mais-de-tres-semanas-apos-ataque-cibernetico-que-paralisou-as-comunicacoes/
- RNA, “UNITEL anuncia compensações aos clientes após ataque cibernético,” 2026-08-20 — https://rna.ao/rna.ao/2026/08/20/unitel-anuncia-compensacoes-aos-clientes-apos-ataque-cibernetico/
- Economia & Mercado / Mercado, “UNITEL conclui reposição dos serviços após ataque cibernético,” 2026-08-20 — https://mercado.co.ao/unitel-conclui-reposicao-dos-servicos-apos-ataque-cibernetico/
- FurtherAfrica, “Unitel Angola IPO Raises $329m in Oversubscribed Debut,” 2026-07-29 — https://furtherafrica.com/2026/07/29/unitel-angola-ipo-raises-329m-in-oversubscribed-debut/
Why this matters for your vendors
Unitel is a critical national carrier dependency. For enterprises, banks and fintechs in Angola, one carrier outage took out voice, data, messaging, POS and third-party services. Core services were restored only on 5 August. Forensic work had found no personal-data compromise to date, but that does not close the availability risk. Keep availability and confidentiality findings separate in the supplier file.
Forward this to your TPRM owner: For suppliers, and your own operations, that depend on Unitel or on any single mobile operator (Rescana guidance):
- Which of your services depend on Unitel, or on a single mobile operator, for voice, data, SMS OTP, POS or WAN, and is there an alternate carrier?
- What failover have you tested for a multi-day outage, including alternate-MNO, satellite and offline-POS playbooks?
- During capital-market or M&A event windows, what extra monitoring and assurance do you put in place?
- What notice SLA and high-level root-cause summary will you provide after an availability incident, even when no indicators of compromise are published?
Working through critical-telecom suppliers on questions like these? Rescana's agents can help your team map single-carrier concentration and check that failover evidence is on file before residual availability risk is closed, with your reviewers approving each decision.
