Why did Vodafone go down for four hours yesterday? Experts say a cyberattack 'can't be ruled out' after outage left hundreds of thousands of Brits offline

Hundreds of thousands of Brits were left unable to get online yesterday, as Vodafone experienced one of the biggest blackouts of the year. 

At the peak of the four–hour outage, more than 135,995 users reported issues on DownDetector – with 69 per cent saying they couldn't use their landline internet.

So, what was behind the outage? 

In a statement this morning, a spokesperson for Vodafone claimed the problems were 'triggered by a non–malicious software issue with one of our vendor partners'. 

However, experts have warned that we 'can't rule out a cyberattack'.  

'Something went really quite wrong,' Professor Alan Woodward, a computer security expert at the University of Surrey, told the Daily Mail. 

'Vodafone are being very coy – theoretically it could still have been some kind of attack.

'If it were deliberate, the question is who and how.' 

According to the academic, it could have been a 'nation state' cyberattack – where the perpetrators are acting on behalf of their government. 

In this case, it would have been more likely for sheer disruption than having a financial movie behind it, Professor Woodward said. 

'If it was an attack, it would have had to be a well resourced attack such as could be mounted by a nation state,' he told the Daily Mail.

'National states often hide behind criminals as proxies for deniable plausibility.

'It was a fairly spectacular outage which is unusual as networks tend not to have single points of failure precisely in case there is a technical fault, so it's possible it was deliberate.' 

Alternatively, there may have been some kind of internal issue – a 'silly little mistake' by someone with a lot of control behind the scenes, such as a company engineer. 

'Someone may have done a software upgrade that went horribly wrong and took the whole thing down,' he said. 

'We've seen large critical organisations brought to a halt by technical failures that theoretically should not have impacted as badly as they did due to human error, such as configuration mistakes, so I still wouldn't rule that out.' 

Professor Woodward added that 'we need more details' before any conclusion is reached. 

In Vodafone's latest official statement about the incident, the telco blamed a 'non–malicious software issue', but didn't give any further information.  

Andy Aitken, co–founder and CEO of mobile virtual network operator Honest Mobile said the outage likely stemmed from a 'technical fault'. 

'Given how severe the outage was, it was likely with one of their most important pieces of infrastructure,' he told the Daily Mail. 

'If Vodafone have gone on the record to say this was a non–malicious software issue, it's pretty safe to say it wasn't a cyber attack.

'It would be incredibly brazen to deny that and then have to walk it back later.' 

Mr Aitken said it's 'shocking' how often outages happen with such critical infrastructure. 

'Outages like this aren't rare anymore – we're seeing a couple every year,' Mr Aitken said. 

'You'd expect more resilience to be baked in, yet the reality is that telecoms systems aren't as robust as people assume. 

'When one critical piece of infrastructure fails badly, it can knock millions of people offline in an instant. 

'That's why it's becoming increasingly important for people to have the flexibility to connect across different networks – so one company's outage doesn't bring millions to a standstill.' 

Dr Manny Niri, senior cyber security lecturer at Oxford Brookes University, said 'technical faults can look like attacks'.

'For now, we can take Vodafone's statement as accurate,' he told the Daily Mail. 

'A vital matter now is learning from the incident – big telecom companies rely heavily on software and systems from other companies, and a single problem with a partner can affect millions of customers and critical services.'   

Jake Moore, tech expert and security advisor at ESET, said he doesn't think it was a cyberattack, although the sudden nature of the outage mirrors a 'distributed denial–of–service' (DDoS).

A DDoS is where the attacker floods a server with internet traffic to prevent users from accessing connected online services and sites, like a traffic jam on the internet. 

'Outages will always naturally raise early suspicions of a potential cyber incident, though current evidence points more towards an internal network failure than a confirmed attack,' Moore said. 

'The sudden outage, combined with the inability to access customer service lines, mirrors classic symptoms of a distributed denial–of–service (DDoS) attack, where attackers overwhelm the network so the site or systems collapse.

'However, malicious or not, this once again highlights our heavy reliance on digital infrastructure, especially in an age where we increasingly depend on mobile networks for everything.

'Ultimately, resilience is essential, whether the cause is a direct cyberattack, a supply chain issue or a critical internal error.'