{
	"id": "b14711ff-5fab-4e58-aa31-19568ee529c1",
	"created_at": "2026-04-06T00:08:10.561049Z",
	"updated_at": "2026-04-10T13:12:02.760198Z",
	"deleted_at": null,
	"sha1_hash": "28a4b842b24c3f7a724057a6f567cf895b7e42a7",
	"title": "Cyberattack brings down Vodafone Portugal mobile, voice, and TV services",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32347,
	"plain_text": "Cyberattack brings down Vodafone Portugal mobile, voice, and TV\r\nservices\r\nBy Catalin Cimpanu\r\nPublished: 2023-01-17 · Archived: 2026-04-05 22:59:36 UTC\r\nVodafone Portugal said today that a large chunk of its customer data services went offline overnight following \"a\r\ndeliberate and malicious cyberattack intended to cause damage and disruption.\"\r\nThe company's 4G and 5G mobile networks, along with fixed voice, television, SMS, and voice/digital answering\r\nservices are still offline following the attack.\r\n\"We have already recovered mobile voice services and mobile data services are available exclusively on the 3G\r\nnetwork in almost the entire country but, unfortunately, the scale and seriousness of the criminal act to which we\r\nwere subjected implies careful and prolonged work for all other services,\" the company said in a statement\r\npublished earlier today.\r\nVodafone said it's working on restoring the remaining services throughout the day, with the help of local and\r\ninternational teams in what currently is the largest cybersecurity incident the company has ever dealt with.\r\nThe company also said it's working with authorities to investigate the incident and that based on current evidence,\r\ncustomer data doesn't appear to have been accessed or compromised.\r\nAlthough despite the presence of some rumors online, Vodafone Portugal has not attributed the ongoing incident\r\nto a ransomware attack.\r\nThese rumors are currently making waves online because over the past month, a ransomware gang had\r\nextorted Impresa and Cofina, two of Portugal's largest news media outlets. The Lapsus$ ransomware gang, which\r\nwas behind the two attacks, has not taken credit for the Vodafone Portugal outage on any of its online accounts.\r\nContacted via LinkedIn, a Vodafone Portugal employee said they were only aware of the technical outage and\r\nwere not aware of the company's press release attributing the outage to a cyberattack, suggesting details about\r\nwhat happened on the night between February 7 and February 8 have yet to uncovered or shared internally.\r\nSource: https://therecord.media/cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services/\r\nhttps://therecord.media/cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services/\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://therecord.media/cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services/"
	],
	"report_names": [
		"cyberattack-brings-down-vodafone-portugal-mobile-voice-and-tv-services"
	],
	"threat_actors": [
		{
			"id": "be5097b2-a70f-490f-8c06-250773692fae",
			"created_at": "2022-10-27T08:27:13.22631Z",
			"updated_at": "2026-04-10T02:00:05.311385Z",
			"deleted_at": null,
			"main_name": "LAPSUS$",
			"aliases": [
				"LAPSUS$",
				"DEV-0537",
				"Strawberry Tempest"
			],
			"source_name": "MITRE:LAPSUS$",
			"tools": [
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "d4b9608d-af69-43bc-a08a-38167ac6306a",
			"created_at": "2023-01-06T13:46:39.335061Z",
			"updated_at": "2026-04-10T02:00:03.291149Z",
			"deleted_at": null,
			"main_name": "LAPSUS",
			"aliases": [
				"Lapsus",
				"LAPSUS$",
				"DEV-0537",
				"SLIPPY SPIDER",
				"Strawberry Tempest",
				"UNC3661"
			],
			"source_name": "MISPGALAXY:LAPSUS",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2347282d-6b88-4fbe-b816-16b156c285ac",
			"created_at": "2024-06-19T02:03:08.099397Z",
			"updated_at": "2026-04-10T02:00:03.663831Z",
			"deleted_at": null,
			"main_name": "GOLD RAINFOREST",
			"aliases": [
				"Lapsus$",
				"Slippy Spider ",
				"Strawberry Tempest "
			],
			"source_name": "Secureworks:GOLD RAINFOREST",
			"tools": [
				"Mimikatz"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "52d5d8b3-ab13-4fc4-8d5f-068f788e4f2b",
			"created_at": "2022-10-25T16:07:24.503878Z",
			"updated_at": "2026-04-10T02:00:05.014316Z",
			"deleted_at": null,
			"main_name": "Lapsus$",
			"aliases": [
				"DEV-0537",
				"G1004",
				"Slippy Spider",
				"Strawberry Tempest"
			],
			"source_name": "ETDA:Lapsus$",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434090,
	"ts_updated_at": 1775826722,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/28a4b842b24c3f7a724057a6f567cf895b7e42a7.pdf",
		"text": "https://archive.orkl.eu/28a4b842b24c3f7a724057a6f567cf895b7e42a7.txt",
		"img": "https://archive.orkl.eu/28a4b842b24c3f7a724057a6f567cf895b7e42a7.jpg"
	}
}