Unitel, Angola’s largest telecommunications operator, detected a cyberattack at 02:20 on 28 July 2026. Voice services, mobile data and internet access failed nationally. The company puts its subscriber base at more than 21 million. Point-of-sale payment terminals running on the network were disrupted along with business communications and services dependent on connectivity.
Gradual restoration began at 11:45 on 29 July and the operator reported primary services fully restored on 5 August. The attack arrived less than 24 hours before the formerly state-owned company’s debut on the Angolan stock exchange; trading proceeded, valuing Unitel at $2.14 billion and raising around $321 million for the government’s stake.
When The Network Is The Country’s Network
We filed national-scale outage at 22-1104, where Vanuatu’s government worked from personal email for over a month, and at 22-0508. Those were states losing their own systems.
This is a commercial operator whose failure is indistinguishable from national infrastructure failing, in a market where one carrier holds a dominant share. Nobody chose that concentration as a policy; it is what a telecommunications market looks like in most countries, and it means the resilience of a nation’s communications is a private company’s operational decision.
The Payment Terminals Are The Second Story
Point-of-sale terminals ride the mobile network. When it went, so did the ability to take card payments across the businesses using it.
The corpus recorded the same dependency at 23-0625, where a fuel retailer’s outage left 1,500 sites cash-only, and argued there that thin harm spread across a very large number of uninvolved people is the kind nobody measures. Here it is a week, nationally, and no figure for it will ever exist.
The Flotation Went Ahead
A company whose network was down listed on schedule, and the market priced it at $2.14 billion.
The desk records that without a conclusion attached. It is either evidence that markets correctly treat a recoverable outage as immaterial to long-run value, or evidence that they cannot price operational risk on a week’s notice. We filed the materiality question at 26-0806 and 23-0502, and this is the cleanest natural experiment it has: the same event, disclosed and priced within days.
Compiled from the operator’s statements and contemporaneous reporting, listed below. No operation is named and no entry route or attack type was published — the incident is described only as a cyberattack, which is why this file is graded medium and why it carries no claim about ransomware despite its section. No figure for affected businesses or transactions exists. Corrections: corrections@forensicpost.com.