Angola's top mobile telecommunication provider, Unitel, continued to recover this week from a cyberattack that hit the operator on July 28, the same day the government closed a public offering for 15% of the carrier.
The purported attack caused widespread outages across the telecom's networks — the mobile operator restored 2G and 3G service on July 30 and SMS service on July 31, but its 4G and 5G — as well as some digital services — reportedly continue to have problems. In a statement in Portuguese posted to Facebook on Aug. 1, Unitel called the incident a "deliberate and malicious cyberattack on its technological infrastructure."
"Unitel will keep the market and investors informed of any relevant developments, in compliance with the legal rules to which it is bound as a publicly traded company, and remains engaged in the complete normalization of its services over the coming days," the company said in its statement.
Unitel is the latest telecommunications provider in Africa to be hit with a disruptive cyberattack. In April 2025, mobile operator MTN Group, which operates in nearly a score of markets across Africa and the Middle East, suffered a breach that potentially exposed the data of its more than 200 million customers. In late 2024, cyberattackers successfully compromised Telecom Namibia, leaking customer information online in an apparent ransom scheme.
Unitel's Really Good, Really Bad Day
The cyberattack against Unitel kicked off at 2:20 am on July 28, the same day that the company began trading on the Angola BODIVA stock exchange. The Angola government had auctioned off 7.5 million shares of the company for a 15% stake, taking in more than 300 billion kwanzas, or about $320 million. Unitel's stock shot up almost 25% that day, but declined nearly 13% the next.
The danger for the mobile operator is that the disruption of services will send customers to seek out other mobile providers, even though Unitel commands a hefty majority of the market, with estimates of its share varying between 66% and 76%. While the majority state-owned operator has little competition, consumers and business in Africa rely on mobile networking for digital services, making the restoration of services a priority.
On Aug. 4, for example, business people in the capital of Luanda had to turn to cash because some popular financial services, such as Multicaixa Express, no longer worked, according to a Ver Angola news report. In 2025, Multicaixa Express accounts for 62% of financial transactions over networks, the report stated.
Typically, recovery from major telecom breaches requires anywhere from 24 hours to several days, depending on scope of the compromise and the preparedness of the operator. Because budgets are tight in most African regions, organizations should consider compromises inevitable and work to limit the damage through reducing the attack surface, says Kevin Cardwell, chief information officer at Cybastion, a digital services and cybersecurity provider that has signed an MOU to fast track Angola's digitalization and cybersecurity.
"The countries [need to] identify where their high risk areas are at, and then ... mitigate the risk," he says. "If you do take that hit ... you can isolate that damage, and the attackers only take out, maybe, that segment."
Reduce Attack Surfaces
Overall, Africa's heavy reliance on mobile infrastructure often exposes a different set of cybersecurity vulnerabilities that may not be addressed by the security models for fixed-line infrastructure, Cardwell says. The Unitel attack shows the dangers of insufficient network segmentation in critical infrastructure as well, he adds.
"You need an entire process, one that starts with evaluating your network and knowing where your risk points are at and then mitigating the risk points by trying to reduce your attack surface to the outside of an attacker," he says.
Critical infrastructure providers such as Unitel need to have practiced processes to quickly get back up and running in the event of a cyberattacks, says Eric Howard, a malware researcher with cybersecurity firm ESET.
"Upstream infrastructure could be separated between services, which would make it possible for some services to remain online," Howard says, although upstream core issues including regional routing, authentication bottlenecks, or internal backend services could remain disrupted and block access.
Read more about:
DR Global Middle East & AfricaAbout the Author
Want more Dark Reading stories in your Google search results?
Add Us NowYou May Also Like
Want more Dark Reading stories in your Google search results?
No comments:
Post a Comment