DDoS Attacks Up 140.7% in the First Nine Months of 2026

The number of DDoS attacks in the first nine months of 2026 rose 140.7% compared with the same period of 2025. That is roughly a 2.4-fold increase: where a year ago 100 attacks were recorded, the count is now about 241. CNews reports this. In the available excerpt, the name of the analyst company is cut off, so the counting methodology and absolute figures will have to be checked against the original report.

What is known and what is not yet

The facts fit into a few lines. The comparison covers two identical windows: January–September 2025 and 2026. What is measured is the number of attacks, not their power or total traffic volume. That distinction matters. A rise in count may mean that attackers have started launching many short, cheap waves instead of a few large ones. It may also mean that the systems that detect such incidents have become more sensitive.

The available text contains no peak size in Tbit/s, no average duration, and no breakdown by industry or attack type. Without that, it is hard to say what we are dealing with: volumetric noise that providers absorb at the network edge, or application-layer attacks that hit specific services.

• Period: January–September 2026 versus January–September 2025.
• Growth in attack count: +140.7%.
• Multiple: roughly ×2.4.
• Publication: CNews, October 13, 2026.
• Not disclosed in the excerpt: peak size, duration, industry breakdown, regions.

Where such growth may come from

What follows are hypotheses, not conclusions from the report. First: the tooling itself got cheaper. The DDoS-as-a-service market has long run on subscriptions, and botnets built from cameras, routers and other IoT devices are replenished faster than they can be cleaned out. Second: the barrier to entry dropped. Using language models to generate scripts and automate routine work saves time even for poorly prepared operators. The excerpt has no direct data on the share of such attacks, but the direction is plausible.

The third hypothesis concerns the targets. More and more businesses live in APIs and cloud services. For AI platforms, an application-layer attack is dangerous in a particular way: every request to a model takes up GPU compute time. Thousands of "human-like" requests per second can knock out a service that would easily have withstood the same flow aimed at an ordinary static page. And the bill for downtime and for wasted resources arrives at the same time.

What to check in your defenses right now

First, work out exactly which kind of attack you are protected against. A contract with a volumetric-traffic protection provider does not cover L7 attacks on a login, search or inference endpoint. Such points need rate limits per key and per user, client behavior checks, and separate queues for heavy operations.

Next, calculate the cost of a single request. If a model request costs a noticeable fraction of a GPU-second, unauthenticated access to it should be either closed or tightly limited. Caching of typical responses and instant rejection under overload both work well: it is better to return an error to some users than to take everyone down.

Finally, run drills. Check who switches traffic to filtering and how many minutes it takes, whether the team has contacts on the provider's side, and whether the plan holds if an attack coincides with a release or a sales peak. The +140.7% figure speaks first of all to frequency. And when frequency is high, what decides the outcome is not protection "just in case" but a rehearsed procedure.