DDoS Attack Statistics 2026: Key Facts and Trends

DDoS attacks more than doubled in 2025, with Cloudflare alone mitigating 47.1 million of them, up 121% in a single year, and blocking a record 31.4 Tbps assault that lasted just 35 seconds. Distributed denial-of-service traffic is now constant background noise on the internet, roughly 1.5 attacks every second. This 2026 reference gathers the DDoS numbers that matter from the primary sources that define the field: Cloudflare, NETSCOUT, and Akamai.

What’s in This Report

1How Many DDoS Attacks Are Happening

The clearest fact about DDoS in 2026 is volume. Attacks are not rare, targeted events reserved for banks and governments. They are a constant, automated hum against everything connected to the internet. Cloudflare, which sits in front of a large share of the world’s web traffic, put a hard number on it for 2025.

Averaged out, 47.1 million attacks in a year works out to about 5,376 every hour, or roughly 1.5 every second, every day, all year. NETSCOUT’s independent count from its ATLAS platform, more than 8 million attacks across 203 countries in just the second half of the year, confirms the same picture from a different vantage point: DDoS is global, automated, and relentless. The two data sets measure different networks, which is why the totals differ, but they agree on direction. The question for any business is no longer whether its infrastructure will be probed, but whether it can absorb a flood when one arrives.

Source: Cloudflare 2025 Q4 DDoS Threat Report | NETSCOUT DDoS Threat Intelligence Report

Protect your business with a DDoS-ready security review

2The Size Records That Keep Breaking

If frequency is the story at the bottom of the market, raw power is the story at the top. Throughout 2025, the record for the largest DDoS attack was broken repeatedly, and the pace of escalation was extraordinary. What would have been an unthinkable attack a year earlier became a routine headline within months.

The jump between the second and third quarters is the one to notice. A 7.3 Tbps attack in May was, at the time, the largest ever seen. By the third quarter the Aisuru botnet had pushed a single attack to 29.7 Tbps, roughly four times larger, in a matter of months. These record-setting bursts are deliberately brief, often under a minute, because they are designed to overwhelm defenses instantly rather than sustain pressure. A 35-second, 31.4 Tbps hit does not need to last long to take an unprepared target offline. The same fast-moving threat landscape shows up in how quickly attackers now weaponize new vulnerabilities.

Source: Cloudflare 2025 Q3 DDoS Threat Report | Cloudflare on the 7.3 Tbps attack

Harden the network that has to absorb a volumetric flood

3Why Most Attacks Are Small and Short

The record-breaking attacks dominate the news, but they are the exception, not the rule. The overwhelming majority of DDoS events are small, brief, and cheap to launch. That is the single most important nuance in the data, because it changes who is actually at risk.

Source: Cloudflare 2025 Q2 DDoS Threat Report | Cloudflare 2025 Q3 DDoS Threat Report

Keep critical infrastructure online when traffic spikes

4Who Gets Targeted

DDoS attackers are not indiscriminate. The data shows clear preferences by industry and region, shaped by where downtime is most painful and where extortion pays. Financial services has become the standout target, but the picture depends on whether you count network-layer floods or application-layer attacks.

Two shifts stand out. First, financial services is no longer just frequently attacked, it is attacked harder and for longer: Akamai measured the median duration of network-layer attacks on financial firms climbing 738% since 2024, and maximum attack scale rising 236%. Second, the most targeted network-layer industry in Cloudflare’s 2025 data was telecommunications, service providers, and carriers, the infrastructure that everyone else depends on. When a carrier or hosting provider is the target, every business riding on it can feel the outage, even if it was never the intended victim. That indirect exposure is why DDoS is a concern for organizations that assume they are too small to be worth attacking.

Source: Akamai State of the Internet research | Cloudflare 2025 Q4 DDoS Threat Report

Get always-on monitoring for your business systems

5The New Playbook: Botnets, AI, and Extortion

The reason attack sizes and volumes both jumped in 2025 is that the tooling behind DDoS matured. Massive botnets built from compromised routers, cameras, and IoT devices now supply the raw firepower, cheap rentals put it in anyone’s hands, extortion turns it into a business model, and AI lowers the skill required to run a campaign.

Source: NETSCOUT on botnet-driven DDoS in 2H 2025 | Cloudflare on the Aisuru botnet

Build a DDoS response plan with a virtual CIO

6What the Data Means for Small and Midsize Businesses

Read together, the 2025 numbers tell a story that is easy to misread. The record-breaking attacks suggest DDoS is a problem for hyperscalers and banks. The frequency and size distribution say something very different for everyone else.

The defensive takeaway is not to fear the headline attack. It is to assume the ordinary one. A short, modest flood that arrives without warning is the common case, and the only reliable answer is mitigation that reacts in seconds without a person in the loop. For most organizations that means putting the network, hosting, and continuity plan in the hands of a team that watches them around the clock. The same logic applies to the broader threat landscape, from ransomware to third-party and supply chain attack data, where speed of response consistently separates a contained incident from a costly one.

Source: Cloudflare 2025 Q4 DDoS Threat Report | NETSCOUT DDoS Threat Intelligence Report

Plan for continuity when an attack lands

Full Statistics Table

Frequently Asked Questions

Methodology & Sources

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC