Cloudflare says it mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks in the third quarter of 2026, alongside 14.4 trillion HTTP DDoS requests. According to the company, this represents a significant increase in attack activity compared with the previous quarter and underlines the ongoing pressure on internet-facing business systems.
What happened
In its latest reporting, Cloudflare said threat actors are launching large volumes of network-layer DDoS attacks, averaging thousands of incidents per hour. Network-layer attacks typically target infrastructure such as servers, networks and connectivity, with the aim of overwhelming bandwidth or system resources and making services unavailable.
The figures reported by Cloudflare relate to attacks the company says it observed and mitigated across its own network. They should therefore be understood as Cloudflare's visibility into the threat landscape rather than a complete measure of all global DDoS activity.
Why it matters for European businesses
For European companies, DDoS attacks are a business continuity issue as much as a security issue. Even relatively short periods of downtime can disrupt online sales, customer portals, booking systems, SaaS platforms, internal dashboards and public websites. For businesses that depend on APIs, cloud applications or digital customer journeys, service availability directly affects revenue, operations and trust.
The reported increase also matters because DDoS attacks are no longer only a problem for large consumer platforms. SMEs, e-commerce businesses, software providers and regional service companies can all be targeted, whether for extortion, disruption, competitive sabotage or as collateral damage from attacks aimed at suppliers or hosting providers.
European organisations should also consider third-party exposure. If a hosting provider, cloud platform, DNS provider or application delivery partner is affected, customer-facing services may still go offline even if the business itself was not directly targeted.
Who may be affected
- E-commerce companies
Online shops and payment-related journeys are highly sensitive to downtime, particularly during campaign periods and seasonal peaks. - SaaS providers and digital platforms
Customer logins, APIs and dashboards may be disrupted by volumetric attacks against infrastructure or application endpoints. - SMEs with public websites or portals
Smaller organisations may have limited in-house security resources and may rely heavily on a single hosting or connectivity setup. - IT and digital teams
Teams responsible for uptime, cloud infrastructure, web performance and incident response may need to reassess DDoS preparedness. - Regulated or service-critical organisations
Businesses in sectors with stricter continuity or security obligations may need stronger evidence of resilience measures and supplier controls.
What companies should consider
- Review DDoS protection coverage
Check whether websites, APIs, DNS, load balancers and cloud endpoints are covered by appropriate mitigation services. - Assess supplier dependency
Understand how hosting, CDN, DNS and cloud providers handle large-scale attacks and what service commitments are in place. - Test incident response procedures
Ensure teams know how to detect availability issues, escalate quickly and communicate with customers and partners during disruption. - Identify critical internet-facing assets
Map which systems would create the biggest commercial or operational impact if they became unavailable. - Plan for redundancy
Where justified, consider backup connectivity, failover arrangements or multi-provider strategies for business-critical services. - Monitor business risk, not only technical metrics
Downtime affects revenue, customer experience and reputation, so resilience planning should involve operations and management as well as IT.
While Cloudflare's figures are based on the attacks it says it mitigated on its own network, the broader message is clear: availability attacks remain frequent and operationally relevant. For European businesses with revenue or service delivery tied to digital channels, DDoS resilience should be treated as a practical continuity priority rather than a niche security concern.