Summary

  • ANACOM recorded 87 significant telecom security or integrity incidents in 2025, five more than in 2024. Total impact hours fell from 2,570 to 2,412.
  • Affected subscribers/accesses rose from 1.9 million to 14.6 million, mainly because of the 28 April blackout. Public information was reported in 21 of the 87 cases.

Eighty-seven is a tidy number. Fourteen-point-six million is not.

Portugal’s telecom incident ledger for 2025 has the look of a quiet year until one column walks in wearing a hard hat and blocks the light. ANACOM counted 87 significant security or integrity incidents, up five from 82 in 2024. Total impact duration fell to 2,412 hours from 2,570. Then the affected-subscriber/access total leapt from 1.9 million to 14.6 million.

The culprit in that arithmetic is not a mystery novel: ANACOM says the rise came mainly from the nationwide blackout on 28 April. One event did most of the counting.

That is a useful distinction for anyone reading an outage report as a proxy for resilience. The incident count asks how often a reportable event entered the ledger. Impact hours ask how long recorded effects lasted. The affected-subscriber/access figure asks how many subscriptions or access points were caught in those effects. These measures can move in opposite directions without contradicting each other. In 2025, five more incidents sat beside fewer total impact hours and a far larger affected-access figure.

ANACOM’s series follows significant security breaches or losses of integrity notified by companies offering public networks or publicly available electronic communications services. It records events that cross the regulatory reporting boundary; customer complaints and brief interruptions travel through other reporting channels. The ledger follows reportable incidents, not every bad afternoon with a dead router.

The denominator needs its own seat at the table

The regulator says five of the 87 incidents had national reach. Fixed telephony and fixed internet were each affected in 59% of incidents; subscription television was affected in 46%. Those percentages overlap because an incident can hit several services at once. Four broad cause groups—third-party supply failures, natural events, malicious attacks, and maintenance or hardware/software failures—accounted for 98% of reports.

ANACOM labels the 14.6 million measure ‘subscribers/accesses affected’: it counts affected subscriptions or access points. The April blackout dominates that total, while the annual incident count records it as one case. Put the two figures on a slide without their units and a board can mistake reach for recurrence, or recurrence for reach. The slide will look clean; the decision can still be cleanly wrong.

The public-information column raises a different question. ANACOM says information was provided to the public in 21 cases. Article 23 of Security Regulation No. 303/2019 sets public-information conditions using incident duration and affected subscriber/access thresholds, with affected geography available when access counts do not apply or cannot reasonably be estimated. The regulation also allows ANACOM to direct public information in other circumstances it considers to be in the public interest. Article 24 calls for clear, accessible and precise information about affected services and areas.

The 21 cases record where public information was provided. ANACOM’s release leaves those case names and their links to duration, service footprint and affected-access calculations out of the summary. That is where an annual headline needs an operational ledger behind it.

Publish the join, not just the annual total

A useful public record would give each incident a stable case reference and join six fields: affected services, start and end of impact, geographic footprint, affected subscribers or accesses, whether public information was issued, and the notice itself. Where access counts cannot be estimated, the geographic measure and reason should travel with the record. Readers could then distinguish one national event from a string of local failures without asking an annual aggregate to do two jobs.

That record would help operators too. A service provider comparing its own incidents with the national series needs to know whether it is comparing event frequency, duration, reach or disclosure practice. Regulators need the same distinctions when they assess resilience and public communication. A polished year-on-year percentage cannot substitute for a stable unit.

Portugal’s 2025 figures describe separate dimensions: 87 reportable incidents, fewer total impact hours, one blackout dominating the affected-access total, and 21 cases with public information. The hard part is keeping those facts connected after the headline is gone. A ledger that lets readers follow the connection would make the next annual report much harder to misread—and much harder for anyone to hide behind a convenient denominator.

Sources: ANACOM’s 2025 incident report; ANACOM’s report summary; Security Regulation No. 303/2019; Electronic Communications Law No. 16/2022.