Vodafone Portugal struggles to restore service following cyberattack

Vodafone Portugal is slowly working to recover following a “deliberate and malicious cyberattack” that brought down services used by millions of people and businesses in that country, including those for ambulances and other emergency services.

Vodafone Portugal—a subsidiary of UK-based Vodafone Group with 4.3 million cellphone subscribers and 3.4 million fiber subscribers—said in a statement that the attack began on Monday evening. The attack quickly took down the subsidiary’s 4G and 5G networks and halted fixed voice, television, SMS, and voice and digital answering services.

“[It was] a targeted attack on the network, with the purpose, surely voluntary, intentional to leave our customers without any service,” Vodafone Portugal CEO Mário Vaz said at a news conference according to Portuguese news site Lusa. “The aim of this attack was clearly to make our network unavailable and with a level of severity to make the level of services as difficult as possible.”

The attempt largely succeeded. Millions of customers were unable to make voice calls, send text messages, use the Internet, or access cable TV, Lusa and other local news outlets reported. The operator of the country’s Multibanco ATM network said that the attack caused “some occasional instability” in its services. Other businesses and public services were also affected, including ambulance operators, fire departments, and hospitals.

Vodafone Portugal was able to restore 3G voice and data services for most of the country later on Monday, but many of the remaining affected services continued to struggle as of Wednesday. Restoration of services is being prioritized for emergency services.

“Unfortunately, the scale and seriousness of the criminal act to which we were subjected implies careful and prolonged work for all other services,” company officials wrote in Tuesday’s statement. The recovery process “involves multiple national and international teams and external partners,” they added.

Vaz said the company hadn’t received any ransom demand that would indicate it was hit by a ransomware attack. The CEO also said he had no indications the attackers had accessed subscriber information or other sensitive data. Specifics of the attack remain unknown.

The attack comes a month after the websites of two of Portugal’s biggest news outlets—Impresa and later COFINA—were hacked by a ransomware group calling itself Lapsus$. As of the time this post went live, the group hadn’t taken credit for the Vodafone outage.