Distributed Denial-of-Service (DDoS)

What it is

Distributed denial-of-service, or DDoS, makes a service unavailable by overwhelming it with coordinated demand from many sources. The limiting resource may be network bandwidth, connection capacity, or expensive application work. Availability attacks do not by themselves prove that private data was stolen, although they can coincide with a separate intrusion or extortion campaign.

How it works

Compromised devices or other distributed infrastructure generate large volumes of traffic. Some attacks consume bandwidth before traffic reaches your server; others make apparently ordinary requests that exhaust application resources. Because sources and requests vary, a single local IP block or firewall rule may be insufficient.

How people get tricked

No individual user needs to be deceived. Defenders may confuse hostile demand with a legitimate traffic surge, or assume scaling will always solve it. Scaling an expensive endpoint without limits can increase costs while leaving the bottleneck intact.

Example scenario

A website's bandwidth is saturated upstream. Its own firewall discards packets, but legitimate visitors still cannot reach it because the congested link is before the firewall.

Warning signs

• Sudden traffic or connection growth accompanied by failures.
• Disproportionate demand for expensive endpoints or protocols.
• Provider alerts and reduced availability despite healthy individual servers.

If it happens to you

Engage the provider and apply targeted mitigations while tracking service recovery. Preserve traffic evidence and communicate through unaffected channels. Check for parallel compromise, but distinguish availability evidence from data-breach evidence; review mitigation and unexpected costs after the incident.