Summary

  • UNITEL said on 6 August that voice, messaging, data and internet services had been fully restored nationwide as of 5 August, including third-party services using its infrastructure.
  • The recovery statement closes the public service-status phase of the cyberattack detected at 02:20 local time on 28 July, which had disrupted mobile voice, mobile data and internet across Angola.
  • A 30 July update had described phased restoration beginning at 11:45 on 29 July in 13 provinces while SMS remained unavailable, showing that recovery occurred by service and geography rather than in one step.
  • Twilio separately resolved its SMS-delivery incident to UNITEL subscribers at 06:51:55 UTC on 5 August and said its own delivery path was operating normally.
  • Neither the operator declaration nor the Twilio record supplies a nationwide uptime denominator, subscriber-level quality distribution, province-by-province restoration time or duration of stable observation.
  • The public evidence still does not identify an attacker, entry vector, persistence mechanism, data-exposure result, eradication proof, durable control change or post-incident review.

Recovery now has three dates, not one

The useful recovery record is a sequence. UNITEL says the restored state was effective on 5 August. The company confirmed that state on 6 August. Telecompaper published the specialist report on 7 August. Each date answers a different question: when the operator says the service condition changed, when it made the statement, and when that statement became visible through the current reporting record.

That distinction prevents two opposite errors. Using 7 August as the restoration date would add two days to the outage lifecycle. Treating the report as stale because the condition was effective on 5 August would ignore the first new record available for this monitoring window. The event is not the original attack and it is not another report of partial recovery. It is the later claim that the national multi-service recovery process reached its end state.

The opening clock remains important. UNITEL said it detected the cyberattack at 02:20 local time on 28 July. Reuters reported disruption to mobile voice, mobile data and internet nationwide and said the operator serves more than 21 million customers. That customer figure describes UNITEL’s scale; it is not a count of people who lost every service or experienced the same duration of impairment.

A national network came back in layers

The 30 July market notice provides the bridge between disruption and recovery. As reported by TechAfrica News, gradual restoration of mobile voice, data and internet began at 11:45 on 29 July. Thirteen provinces were named as having partial restoration, while SMS remained unavailable and work continued in the remaining areas.

That earlier state matters because it shows why a single green or red label is a poor description of a national telecom incident. Voice can return before messaging. A data session can establish while congestion or routing remains uneven. A province can be broadly reachable while individual cells, transport links or customer groups still lag. Services delivered by other businesses on the operator’s infrastructure can recover on yet another schedule.

The 5 August declaration is therefore substantial. It says that the operator regarded all four named service families—voice, messaging, data and internet—as restored nationwide, and it explicitly includes third-party services on the network. It replaces the earlier open-ended recovery state with an operator-declared endpoint. It does not retroactively make the intervening experience uniform.

Twilio verifies one narrow edge of the recovery

Twilio’s public incident offers a rare external checkpoint. At 06:51:55 UTC on 5 August, Twilio marked its SMS incident resolved and said delivery from Twilio to UNITEL network subscribers in Angola was operating normally. The timing is consistent with UNITEL’s effective recovery date, and it closes a dependency path that had still been identified as impaired during the earlier phase.

The denominator must remain narrow. Twilio observes traffic originating through its own platform toward UNITEL subscribers. Its status does not test every person-to-person message, every enterprise aggregator, every bank alert, every short code, every roaming route or every handset. Nor does it measure mobile voice, data sessions or general internet access. It is independent corroboration of one edge, not an independent nationwide audit.

That narrowness is a strength when stated honestly. External service providers can reveal whether interconnection paths recover at the same time as an operator’s internal components. A portfolio of such signals—messaging aggregators, payment gateways, roaming partners, emergency call platforms and enterprise access probes—would produce a more defensible recovery picture than any one status page.

“Fully restored” is a state claim without a published denominator

UNITEL’s statement deserves to be reported in its own terms: all named services restored nationwide. It should not be silently upgraded into 100% measured availability. The available sources do not publish the number of successful versus failed sessions, delivery latency, packet loss, dropped-call rate, congestion by hour, cell-site availability, customer complaints or a province-by-province timestamp.

This matters because restoration thresholds are operational choices. An operator may declare a service restored when core functions are available, while optimisation, queue draining or isolated repair continues. That can be entirely reasonable, but readers need the measurement rule to understand what the label means. A service-level claim without its denominator is evidence of operator confidence, not a substitute for telemetry.

The missing observation window is equally important. The record does not say whether the network ran stably for hours or days before the declaration, what load it carried, or what conditions would reopen the incident. A durable recovery is more persuasive when it survives peak traffic, billing cycles, dependency retries and a defined monitoring period.

Third-party restoration expands the control surface

The explicit reference to third-party services is more than a reassuring phrase. UNITEL’s infrastructure supports businesses and public functions whose applications may appear independent to users but depend on the mobile network for transport, authentication, messages, payments or customer access. Restoring the radio and core network is necessary; it may not be sufficient to restore every service chain.

Each dependency can preserve a different failure mode. Queued messages can expire or arrive late. Authentication codes can fail after basic connectivity returns. Payment retries can duplicate or time out. Enterprise tunnels can remain misconfigured. Roaming and inter-operator paths can recover asymmetrically. A third party may also keep its own protective controls in place after UNITEL has normalised the underlying network.

The most useful recovery ledger would therefore name service classes and interfaces rather than offer one aggregate colour. It would distinguish originating and terminating messaging, domestic and roaming traffic, consumer and enterprise data, emergency access, payment and identity flows, and services hosted or transported for other providers. UNITEL’s inclusion of third-party services points toward this broader obligation even though the public record does not expose the underlying tests.

Continuity risk moved from outage to reconciliation

During the outage, the immediate risks were obvious: failed calls, interrupted data access and delayed messages. Once service returns, a quieter set of risks appears. Businesses must reconcile transactions that were attempted more than once, messages that arrived outside their useful window, jobs that remained in queues and users who switched to alternative channels.

For small companies, the recovery burden can persist after the network looks normal. A shop may need to reconcile mobile payments. A delivery service may have stale orders. A clinic or public office may need to confirm that delayed notifications reached the intended recipients. An authentication system may need to distinguish an expired one-time code from a malicious retry. These are not claims that such losses occurred; they are the operational consequences a multi-day national disruption makes necessary to test.

Public-sector continuity has the same issue at larger scale. Agencies need evidence that critical contact trees, field systems, emergency workflows and citizen services returned cleanly, not merely that devices showed signal. Recovery plans should define owners for backlog clearance, integrity checks and customer communication before the next incident rather than invent those responsibilities under pressure.

The cyber-risk clock remains open

A service can be restored before investigators know how an attacker entered, what persisted or whether information was accessed. The current source set identifies none of those elements. It provides no attacker attribution, exploit or credential path, malware account, lateral-movement description, data-exposure assessment, integrity conclusion or independent forensic report.

It also provides no public eradication proof or durable control change. There is no disclosed record of credential rotation, segmentation, monitoring improvement, recovery-environment validation, backup use, supplier action or governance review. Absence of disclosure is not proof that the work did not occur. It means the public cannot yet evaluate it.

That is why “service restored” and “incident closed” should not be treated as synonyms. The first is a customer-facing operating condition. The second should eventually include cause, containment, eradication, recovery, lessons and remediation ownership. Collapsing them rewards speed of status messaging while concealing the controls that determine whether recurrence risk has actually fallen.

Trust now depends on an evidence ladder

UNITEL has taken the most important first step for users: it says the services are back, and one external SMS provider shows a compatible recovery signal. The next step is to make that claim progressively testable. A basic disclosure could state the monitored service classes, geographic scope and observation period. A stronger one would quantify affected customers or failed transactions. The strongest would add a root-cause boundary and remediation milestones without exposing security-sensitive detail.

The sequence matters for credibility. A company need not publish speculative forensics while an investigation is active. It can say what is known, what remains unknown and when the next update is due. It can separate service metrics from security findings and customer remediation. That preserves caution without leaving “fully restored” as the last public sentence about a material national incident.

UNITEL’s market position raises the standard. An operator serving more than 21 million customers is part of Angola’s economic and public-service fabric. The wider the dependency, the more valuable a consistent incident taxonomy becomes: detection, customer impact, partial recovery, full service restoration, stable observation, forensic findings, control remediation and final review.

The real milestone is a closed loop, not a green dashboard

The 5 August state is a genuine operating milestone. It closes the unresolved service question left by the earlier partial-restoration phase and gives customers, counterparties and supervisors a shared point from which to measure stability. Twilio’s resolution makes the record stronger because it shows one previously impaired external route returning to normal.

Yet the event remains asymmetric. The service side has a declared endpoint; the assurance side has almost no public detail. That gap is not a reason to doubt the restoration statement, but it is a reason to limit what can be concluded from it. The network may be available while the causes, consequences and lasting protections remain under investigation.

A mature recovery account will eventually join the two sides. It will show not only that packets, calls and messages flow, but also that backlogs were reconciled, data integrity was assessed, access paths were understood, persistence was removed and corrective controls have owners and dates. Until then, Angola has a restored national service and an open cyber-assurance file.

Sources