At approximately 02:20 local time on Tuesday, July 28, 2026, technical teams at Unitel — Angola’s largest telecommunications operator — detected anomalous activity targeting the company’s core technology infrastructure.

Within hours, voice, mobile data and internet services failed nationwide for the company’s 21 million subscribers. The outage arrived one day before Unitel’s debut on BODIVA, the Angola Debt and Securities Exchange, in what would become the largest initial public offering in the history of Angola’s capital market — a 15% stake raising about $321 million, oversubscribed by more than 20%.

Trading opened Wednesday as planned. The network did not fully recover on the same schedule.

What Broke

The disruption was not confined to phone calls. In a country where mobile money and card processing ride the dominant carrier’s network, point-of-sale payment terminals running on Unitel’s infrastructure stopped working, along with business communications and any digital service dependent on internet access.

That is the part of a telecom outage that never appears in the subscriber count. Twenty-one million people lost connectivity; an unquantified number of merchants lost the ability to take payment at all. In markets with thin cash-handling infrastructure and high mobile penetration, the carrier is the payment rail. Knocking it out is an economy-wide event, not a customer-service one.

Unitel said restoration efforts were ongoing and did not commit to a full-restoration timeline. It declined to describe the nature of the attack or identify who might be responsible.

The Timing

Attribution is absent, so motive is speculation. The timing is not speculation.

An attacker striking a national carrier at 02:20 the day before its listing has chosen the single window in the company’s corporate history when disruption carries maximum leverage. The IPO had already priced and been oversubscribed. Public failure of the core network in that window threatens the debut valuation and the credibility of the exchange hosting it.

It also lands on a politically loaded transaction. Unitel was built in the late 1990s as a joint venture between state oil company Sonangol and private investors including Isabel dos Santos — daughter of former president José Eduardo dos Santos — who held 25% through her vehicle Vidatel. The Angolan state seized the private stakes in October 2022 under President João Lourenço’s anti-corruption campaign, and ownership now sits with IGAPE, the state asset agency, and the Sonangol group. The July 2026 sale disposed of 15% while the state retained control.

That leverage is exactly what an extortion operator prices into a demand. It is also exactly what a politically motivated actor targets when the objective is embarrassment rather than payment. Nothing publicly available distinguishes the two, and Unitel’s silence guarantees it stays that way.

Notably, there is no indication that the IPO process or the exchange’s trading infrastructure itself was compromised. The attack hit the operating network, not the listing.

Africa’s Carrier Concentration Problem

Unitel is not merely large in Angola. It is close to synonymous with connectivity there. Angola’s mobile sector counted 28.4 million active users in 2025 — a 75% penetration rate — and Unitel held 73.3% of it, against 25.5% for Africell and 2% for Movicel.

When one operator carries roughly three-quarters of a country’s mobile connections, “carrier outage” and “national communications outage” become the same event, and there is no meaningful failover for subscribers, merchants or emergency services to fall back to.

This is the structural condition across much of the continent’s telecom market, and it is the inverse of the fragmentation problem that makes the US water sector so hard to defend. Fragmentation means thousands of undefended targets and no central authority. Concentration means one well-resourced target whose failure is total. Neither shape is safe; they simply fail differently.

Concentration at least offers the theoretical advantage that hardening one operator hardens a nation. That only pays off if the operator’s core infrastructure was actually hardened — and an attacker reaching core systems at 02:20 and producing a full-service national outage is not evidence that it was.

What Is Still Unknown

Nearly everything material:

  • Attack vector — undisclosed
  • Threat actor — unclaimed and unattributed
  • Whether subscriber data was accessed or exfiltrated — not addressed
  • Whether an extortion demand was made — not addressed
  • Full restoration timeline — not given

The subscriber-data question is the one that matters most for the 21 million people involved, and it is the one Unitel has been quietest about. A core infrastructure compromise deep enough to sever national service is deep enough to reach subscriber records. Absence of a statement is not absence of a breach.

Sources

  • Xinhua, Cyberattack disrupts Unitel services across Angola, July 30, 2026
  • The Record, Cyberattack hits Angola’s largest telco hours before landmark stock debut
  • Business Day, Cyberattack hits Angola’s Unitel a day before its listing
  • Developing Telecoms, Angola’s Unitel suffers cyberattack ahead of stock market debut
  • Telecompaper, Angola’s mobile market adds 2 mln subscribers in 2025 (market size and operator shares)
  • Billionaires.Africa, Angola raises $321 million selling Unitel stake it seized from Isabel dos Santos, July 29, 2026
  • Ecofin Agency, Angola sells a stake in Unitel, but keeps control of its telecom giant