DDoS Attacks Surge 140.7% in First Nine Months of 2026

In the first nine months of 2026, the number of DDoS attacks rose 140.7% compared to the same period in 2025. That's according to data from Curator, a cybersecurity and content delivery solutions provider. Alongside the growing number of attacks, their intensity has surged sharply: extreme attacks have gone from rare, isolated incidents to a regular occurrence.

Extreme intensity becomes the new normal

Curator recorded 20 DDoS attacks exceeding 1 Tbps between January and September 2026. By comparison, only one such attack was recorded during the same period in 2025, and in the first nine months of 2024 no attacks of that scale were registered at all.

The maximum duration of attacks also shows a sharp jump. In the second quarter of 2026, the longest attack lasted 79.9 hours; in the third quarter, it climbed to 200 hours (targeting a banking sector organization) — nearly double last year's record of 119.2 hours. At the same time, typical attacks have gotten shorter: average duration fell from 2,764 to 1,571 seconds, and the median dropped from 150 to 120 seconds.

The financial sector is the main target

Fintech has borne the brunt of the attacks. From January to September 2026, the financial sector accounted for 41.7% of all DDoS incidents, up from 24.4% in the same period of 2025. The "IT and Telecom" segment came in second with a 21.7% share (up from 14.4% a year earlier). E-commerce's share, by contrast, fell from 23.4% to 12.8%.

At the individual industry level, banks stand out in particular — the number of attacks against them grew 7.4 times year-over-year.

Attack architecture is shifting

The share of multi-vector DDoS attacks in the third quarter of 2026 stood at 6.8% — a notable decline both from 2025 (8.0%) and from the second quarter of 2026 (11.7%). At the same time, the share of attacks combining L3-L4 and L7 levels remains fairly high, at 4.1% of all incidents.

Dmitry Tkachev, CEO of Curator, emphasized: "After a relatively stable 2025, we're seeing a sharp shift in DDoS attack dynamics. Over nine months, their number has more than doubled, and attacks exceeding 1 Tbps in intensity are moving from isolated cases to a regularly observed phenomenon. Pressure on the financial sector in particular has increased significantly. For businesses, this means that planning defenses based solely on the average figures of previous years is no longer enough — infrastructure needs to withstand both sharp intensity spikes and sustained loads."

The growing DDoS threat signals the need to reassess cybersecurity approaches. Curator's statistics show that last year's defense standards and peak-load benchmarks are no longer relevant for the current year.