446/69 Tuesday, August 18, 2026
Threema, a paid secure messaging provider from Switzerland that focuses on privacy and security, disclosed that its services were affected by multiple large-scale Distributed Denial of Service (DDoS) attacks, resulting in communication issues and service disruptions. However, organizations using Threema On-Prem were not affected because that system runs on the organizations’ own infrastructure. Threema stated that DDoS attacks are difficult to defend against because they originate from multiple sources simultaneously, and attackers can continuously change the sources, methods, and patterns of attack.
Users began reporting Threema service issues on Tuesday evening. Initially, the company described the incident as a network issue affecting its colocation provider, before later confirming that it was caused by several rounds of DDoS attacks. The attacks affected both Threema and its colocation partner, Nine. The attack patterns changed continuously, making mitigation difficult. Threema services were unavailable for approximately four hours, from 7:30 p.m. to 11:30 p.m. CEST on Tuesday, and intermittent disruptions continued on Wednesday morning before services returned to normal at 12:23 p.m. CEST.
Threema stated that it remains unclear whether the company was the primary target of the attack or whether the attack targeted multiple entities at the same time. The company communicated updates through social media, while Threema Work customers received updates by email. To strengthen its defenses, Threema deployed additional upstream DDoS protection on August 14 to filter malicious traffic before it reached the company’s infrastructure. Threema also plans to improve its status page by adding incident history and an RSS feed, enabling users and administrators to better track service status through independent channels.
Source: https://securityaffairs.com/197353/hacking/ddos-attacks-cause-major-threema-outages.html