MEO, a Portuguese telecom operator, confirmed on 14 September 2026 that a targeted distributed denial of service (DDoS) attack had degraded its international network. Lusa, through RTP, reported the company's account. The company says there was no intrusion and no access to its data or customer data.
What happened
MEO reported incidents in three windows, as relayed by Lusa:
- 00:45 to 02:55
- 17:30 to 19:30
- 22:45 to 01:05
The attack caused congestion and temporary degradation of the international network. Some customers had trouble reaching websites and services that depend on international traffic. MEO's engineering, operations and cybersecurity teams concluded that traffic patterns and other technical indicators confirmed a targeted DDoS. The BGP routing instability seen during the event is described as a consequence of the attack, not the cause.
The incident was reported to the Centro Nacional de Cibersegurança, Portugal's national cybersecurity centre.
What is confirmed, reported and unknown
- Confirmed by MEO, as relayed by Lusa: the DDoS, the three windows, the impact on international traffic, the report to the CNCS and the statement "não houve intrusão nem acesso a dados" (there was no intrusion or access to data).
- Unknown: whether other operators were affected, who is responsible, the traffic volume, the attack method and how long mitigation took in each window. MEO has not named a group and none has been tied to it in the sources we found.
What to do now
- If you depend on one carrier for internet, add a second carrier with a different upstream path.
- Ask your provider how it handles volumetric attacks and what its scrubbing or filtering capacity is.
- Check what your application does when international traffic is slow: timeouts, retries and degraded modes.
- Write down who you call at your carrier, and how, if your normal channels are the thing that is down.
- Keep a status page hosted outside your own network.
How this could have been avoided
A DDoS aimed at a carrier's international links cannot be stopped by one customer. These controls limit the damage, and they are the usual ones for operators.
- Upstream filtering. Agreements with upstream providers to drop attack traffic early keep links from saturating.
- Capacity and path diversity. More international paths make a flood harder to land on one choke point.
- Pre agreed mitigation runbooks. Three waves in one day reward teams that can repeat a response quickly.
- Customer side redundancy. Multi homing turned a carrier problem into a degraded path.
Try it yourself
Take your three most important external dependencies and mark which use the same carrier or the same international route.
Click through it at your own pace, or open it full screen.
Quick check
Did attackers get into MEO's systems?
MEO says no. It reported no intrusion and no access to company or customer data.
Who was behind it?
Unknown. No attribution has been given in the sources we found.
