Cloudflare Warns of 8,226 DDoS Attacks an Hour as Short-Burst Strikes Surge
New data from Cloudflare shows it mitigated 18.2 million network-layer DDoS attacks in Q3 2026 — an average of 8,226 an hour — with short, intense bursts and DNS amplification attacks jumping by more than 200%. The trend raises costs and risks for banks, governments, crypto platforms, and any business that depends on staying online.
Distributed denial-of-service attacks, once treated as background noise of the internet, are scaling into a persistent operational hazard for organizations across the world.
Cloudflare reported that it blocked 18.2 million network‑layer DDoS attacks in the third quarter of 2026, a 38% increase over the previous quarter, according to figures shared publicly. That works out to an average of 8,226 attacks every hour, many of them too brief for traditional defenses and monitoring tools to catch in time.
The most striking change is in how attackers are striking. Short‑burst attacks — high‑intensity floods that last seconds or a few minutes — surged by 208%. These hit hard, overwhelm unprepared systems, then drop off before some mitigation services fully spin up or before incident response teams can even confirm what happened. At the same time, DNS amplification attacks, which abuse open domain name servers to massively multiply the volume of traffic hitting a target, jumped by 215%.
For banks, governments, online retailers, media outlets, and cryptocurrency exchanges, the effect is direct: outages, slower services, and stretched security teams. Because DDoS attacks typically aim to make services unavailable rather than steal data, they are sometimes dismissed as a nuisance. But when they are coordinated with extortion demands, disinformation pushes, or intrusion attempts under the cover of network noise, they become a serious national security and business continuity concern.
The report did not spell out every sector hit, but Cloudflare’s customer base and previous quarters’ data point to a recurring target list that includes financial services, gaming, telecoms, critical infrastructure providers, and politically sensitive government and media sites. The ability to cheaply disrupt these services for even a few minutes during market hours, elections, or crises gives both criminal groups and state‑aligned actors a blunt but effective tool.
Technically, the trends are a sign that DDoS tooling is getting more sophisticated and more accessible. Botnets built from compromised Internet‑of‑Things devices, poorly secured servers, or even hacked cloud accounts can now be orchestrated to generate huge volumes of junk traffic in concise waves. Attack kits increasingly come with user‑friendly dashboards, turning what used to require specialized knowledge into something a moderately skilled operator can rent and deploy.
Strategically, the surge in DNS amplification and short bursts forces a rethink of how organizations and governments measure and manage cyber risk. Static capacity planning and once‑a‑year incident drills don’t capture a threat that can knock services offline in under a minute. Cloud‑based mitigation can absorb much of the traffic, but only if organizations have properly configured routing, tested failovers, and realistic assumptions about what an adversary can throw at them.
The numbers also suggest that attack volume and frequency are no longer the only metrics that matter. A campaign of dozens of small, precisely timed DDoS incidents that hit payment processors or election reporting sites at critical moments can be more politically and economically damaging than a single massive flood that is quickly noticed and mitigated. Availability has become a frontline in information and economic warfare.
Signals to monitor now include which sectors and regions appear most frequently in future breakdowns, whether insurance markets begin to price DDoS risk more aggressively, and how regulators incorporate availability attacks into critical infrastructure rules. Organizations will also be watching for the next shift in attacker tactics — whether toward more application‑layer attacks that blend in with normal traffic or toward campaigns explicitly synchronized with physical‑world protests, crises, or military operations.
Sources
- OSINT