Vodafone Portugal network sabotage

Late on 7 February 2022, Vodafone Portugal suffered a sweeping network failure that the operator quickly attributed to "a deliberate and malicious cyberattack intended to cause damage and disruption." Rather than a data theft, this was a destructive sabotage event that severed connectivity for millions of people across Portugal and rippled into emergency and essential services.

What happened

The attack struck Vodafone's core network infrastructure on the evening of 7 February, knocking out services that depend on the data network: the 4G and 5G mobile network, fixed voice, SMS, television, and digital/voice customer-care channels. Vodafone Portugal serves more than four million mobile subscribers and roughly 3.4 million fixed home and business internet customers, so the blackout was felt nationwide almost immediately.

Vodafone did not publish technical detail on the intrusion vector, but the pattern — widespread system unavailability requiring days of rebuilding rather than a quick reboot — was consistent with a destructive attack against network management systems. The company emphasized that the operation appeared aimed squarely at causing disruption, not at extracting a ransom or exfiltrating data.

Impact

• Millions of individuals, businesses and public bodies lost mobile and fixed connectivity. Reports noted knock-on effects on ambulance services, fire departments, hospitals and ATM networks that relied on Vodafone links.
• Mobile voice was recovered across most of the country within about a day, but mobile data was initially available only over the legacy 3G network.
• Restoration of 4G data began on 9 February, with services progressively re-established over the following days.
• Vodafone stated it found no evidence that customer data was accessed or compromised.

Attribution

No threat actor publicly claimed responsibility, and Vodafone never named one. The Lapsus$ group, which had hit Portuguese media conglomerate Impresa weeks earlier, did not take credit. The absence of a ransom note or leak-site listing kept the incident in the category of anonymous network sabotage rather than financially-motivated ransomware.

Why it matters

The Vodafone Portugal outage is a stark illustration of telecom networks as critical national infrastructure. A single carrier-level compromise degraded emergency response, payment systems and everyday communications for a large share of a European country — without any data being stolen. It reinforced regulatory attention on operator resilience and incident response in the EU, where the NIS framework treats telecom providers as essential entities precisely because a deliberate outage can cascade into public-safety risk far beyond the company's own customers.