Portugal's internet outage was an attack

If your connection dropped on Monday evening, now you know why. It's Wednesday, 16 September. Twenty-seven degrees. Air quality: 40 (Good). Here's what you need to know.

🗞️ MEO CONFIRMS MONDAY'S NATIONWIDE OUTAGE WAS A "MASS ATTACK"

The internet and mobile disruption that hit much of Portugal on Monday evening was not a technical fault. MEO, the country's largest telecoms operator, has confirmed it was targeted by a deliberate "mass attack" that caused what it called "congestion and degradation of the international network."

The problems began around 5pm on Monday, 14 September, and peaked about an hour and a half later. At its worst, the outage-tracking site Downdetector had logged more than 7,400 reports about MEO, by far the most of any Portuguese operator, with customers reporting trouble in Lisbon, Porto, Funchal, Coimbra and Braga. Other networks saw far smaller numbers: a few hundred each for NOS and Vodafone, around forty for Digi.

The reassuring part is what MEO says did not happen. The company stressed there was no intrusion into its systems and no access to customer data. "There was no intrusion or access to MEO or its customers' data as a result of the attack," it said, adding that it activated recovery measures immediately and restored stability quickly. In other words, this looks like an attack designed to knock the network offline, a flood of malicious traffic overwhelming the international connection, rather than a breach aimed at stealing information.

There is a wider context worth knowing. Monday's disruption coincided with online problems reported in more than 70 countries the same day, with major services including Cloudflare, Amazon Web Services and Microsoft Azure also hit by temporary outages. MEO, however, attributed its own problem specifically to the attack and did not link it to the global disruption, and the origin of the attack has not been made public.

As for who was behind it, no one has said, and MEO has not pointed a finger. But the shape of the incident, a "mass" flood of traffic that congested the network rather than a break-in, is the classic signature of what is known as a DDoS, or distributed denial-of-service attack, where a target is overwhelmed until it buckles. Attacks of exactly this kind have become a regular feature of the European landscape over the past three years, frequently carried out by pro-Russian hacktivist groups striking at countries that support Ukraine. That is background, not a conclusion, no group has claimed this one, and a similar outage across Spain and Portugal last year was blamed on hackers before the authorities concluded it was not a cyberattack at all.

For readers, the practical takeaway is limited but worth holding onto. Your MEO data was not compromised, according to the company, so there is no password-changing panic to have here. But an attack that can take down the country's biggest network for an evening is a reminder of how exposed everyday connectivity is. If Monday left you unable to work, pay or call, a backup, a second provider, or a bit of mobile data on a different network, is cheap insurance.

Bottom line: it was an attack, not a glitch, your data is said to be safe, and service is back. But it is a reminder of how quickly the whole thing can fall over, and worth having a plan B for next time.

⚡ QUICK HITS

A Portuguese digital rights group is suing the big social platforms over "addictive design." D3, a digital rights association, has filed four collective lawsuits against Facebook, Instagram, TikTok and YouTube, accusing them of deliberately engineering features that keep users hooked: infinite scroll, autoplay, constant notifications and personalised feeds that, it argues, work like gambling-industry techniques by removing the natural moment you would otherwise stop. The action, which lets an association sue on behalf of a wider group, follows similar cases abroad, TikTok was charged under EU rules in February, and Meta agreed to pay up to $18 billion to settle US addiction claims in August. It lands the same week as a new survey showing 85% of Portuguese people spend their free time on social media, against 62% who read for pleasure. Google points to tools like "take a break" reminders; Meta and TikTok have not commented.

Portugal has recorded 66 mpox cases in six weeks, with the virus now spreading locally. The cases involve a newer variant, clade Ib, and the World Health Organisation says Portugal reported more of them in that six-week window than any other European country, 162 in total, the third-highest tally in Europe after Spain and France. "Spreading locally" means at least some infections can no longer be traced to travel, though the WHO stresses this does not yet mean broad spread in the general population; transmission has largely been within sexual networks. Mpox causes fever, headaches, muscle pain, swollen glands and skin lesions, spreads through close physical contact, and has a vaccine for those at higher risk. One troubling footnote: the health authority DGS's most recent public mpox update dates from May 2025, a reporting gap of well over a year.

easyJet has launched a "Mega Sale" on flights from Portugal. The sale runs until 23 September and covers travel between 28 September and 18 March, aimed at anyone eyeing an autumn break, a Christmas trip or some winter sun. Fares to France are advertised from under €32, Luxembourg from €32.99, and Cabo Verde, with flights from Lisbon to Praia and Boa Vista and from Porto to Sal, from €81.99. As always, the cheapest prices are on selected seats and dates rather than the whole network, so check the actual fare for your trip, but if you have somewhere in mind it is worth a look before it closes.

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list

A quick note: today's ad comes from one of our network partners, Superhuman AI. Partnerships like this one are what keep The Lisbon Letter free to read every morning, and we thank them for it.

🍽️ SPOT OF THE DAY

26 VEGAN FOOD PROJECT (CHIADO)

You do not have to be vegan to eat well here, but it helps to arrive curious. 26 Vegan Food Project is a fully plant-based restaurant tucked away on the lower floor at Rua da Horta Seca 5 in Chiado, and it has spent years steadily winning over sceptics with food that is not trying to imitate meat so much as be genuinely good in its own right. The room is small, simple and warm, the kind of place that fills with regulars, and it holds a 4.6 rating across thousands of reviews.

The menu takes Portuguese classics and rebuilds them without any animal products. The standout is the seitan bifana, the plant-based version of Portugal's great pork sandwich, served on bolo do caco, the soft Madeiran flatbread. Beyond it there are vegan burgers reviewers keep recommending, a vegan take on the francesinha, tofu à lagareiro, and starters like vegan cheese boards and pastéis de bacalhau made without the cod.

There is an organic wine list and craft beer to go with it. It is open every day, 12:30 to 6pm and 7pm to 11pm.

→ Find them here ←

Insider tip: it is on the -2 floor, so do not be put off hunting for the entrance, and order the seitan bifana. It is the dish that best captures what this place does, taking something quintessentially Portuguese and rebuilding it, convincingly, without the meat.

📅 WHAT'S ON

See you tomorrow morning.

Reach Lisbon's English-speaking community, every morning. Advertise.