• Mário Vaz, Vodafone Portugal CEO, says recovering from “terrorist” incident will be a “lengthy” job.
  • Data, SMS, voice, and TV services impacted, with emergency services forced onto contingency connectivity plans.

Vodafone Portugal suffers “terrorist” cyberattack

Vodafone Portugal suffers “terrorist” cyberattack

Source: Vodafone

Vodafone Portugal continues to work “non‑stop” to restore 4G and 5G services after a cyberattack earlier in the week.

Mário Vaz, Chief Executive at the operator, said that the network was forced offline by “a terrorist and criminal act”. The relevant authorities are supporting Vodafone’s investigation into the matter, which Vaz described as unprecedented in terms of scale and severity.

He was not able to forecast when services will return to normal, but said that the recovery would be a “lengthy job”.

“ The aim of this attack was clearly to make our network unavailable and with a level of severity to make the restoration of services as difficult as possible.”

— Vaz.

Impact felt nationally

The attack caused disruption for four million Vodafone customers, with problems in the provision of all services, including data, SMS, TV, and voice. Although the investigation is in its early stages, the operator has said it does not believe any customer data was compromised in the attack.

Services were taken offline late on 7 February. An hour later, Vodafone restored voice services, with 3G connectivity following shortly after “in almost the entire country”. SMS services were recovered early on 8 February, with TV provision partly restored overnight also. Vodafone’s 4G connectivity is being restored incrementally in limited parts of the country, with maximum speed caps in place to ensure “equitable and sustainable distribution” of bandwidth.

Although much of the immediate impact is on Vodafone customers, the operator’s enterprise and public sector clients are also facing problems. The country’s emergency services rely on Vodafone connectivity, and the Portuguese ambulance operator INEM was forced onto its contingency plan. Other impacted services include Multibanco’s ATM network, which relies on Vodafone’s 3G connectivity.

Investigation ongoing

The attack is being treated as a criminal act, with Vaz going so far as to suggest it was an act of terrorism, but no group has claimed it yet.

Vodafone is Portugal’s second high‑profile victim of a cyberattack in as many months. In January, national media conglomerate Grupo Impresa had two of its online news outlets taken offline by ransomware group Lapsus$, who shared false news messages and contacted subscribers via Impresa’s compromised Amazon Web Services account. Again, the incident is the subject of a police investigation.