Threema Messaging Service Suffers Massive DDoS Attack

Key Takeaways

• Threema, a secure messaging service, experienced significant service disruptions due to sustained distributed denial-of-service (DDoS) attacks.
• The attacks targeted Threema’s infrastructure and its colocation partner, Nine, causing intermittent outages for users between Tuesday evening and Wednesday morning.
• The company confirmed that no user data or system security was compromised, as DDoS attacks focus on service availability, not data access.
• Threema has implemented enhanced DDoS protection measures and plans to improve its status communication channels.

Secure Messaging Service Threema Hit by Extensive DDoS Campaign

Threema, the encrypted messaging platform recognized for its privacy safeguards, recently endured a substantial distributed denial-of-service (DDoS) attack that severely hampered user access to its services. The multi-stage cyberattack crippled the platform for several hours and caused intermittent disruptions over a 24-hour period.

The initial wave of attacks struck on Tuesday evening, resulting in a four-hour service outage for Threema users, specifically from 7:30 p.m. to 11:30 p.m. CEST. Although service was largely restored, the assault persisted with evolving patterns, leading to additional, shorter interruptions throughout Wednesday morning. By 12:23 p.m. CEST on Wednesday, Threema confirmed that all its services had returned to normal operational status.

A distributed denial-of-service (DDoS) attack is a malicious attempt to render an online service inaccessible by overwhelming its network infrastructure with an immense volume of illegitimate traffic. Unlike traditional denial-of-service attacks originating from a single source, DDoS attacks leverage a multitude of compromised devices across diverse networks and geographical locations. This distributed nature significantly complicates defensive efforts, as security teams cannot simply block a single IP address. Attackers continuously alter their traffic sources, request types, and attack methodologies, creating a dynamic challenge for defenders to adapt their filtering mechanisms.

Attack Details and Impact

Threema disclosed that the DDoS campaign targeted both its core infrastructure and that of its colocation partner, Nine. The company has not clarified whether it was the sole intended victim or if the incident was part of a larger, multi-organizational offensive. Threema characterized the event as an “ongoing wave of attacks with constantly changing patterns,” which complicated efforts to block malicious traffic without inadvertently impacting legitimate users.

Crucially, Threema emphasized that the attacks exclusively impacted service availability and did not compromise the confidentiality or security of user data. A DDoS attack’s primary objective is to consume network bandwidth, processing capabilities, or other vital infrastructure resources, thereby preventing legitimate user requests from being processed. Such attacks do not inherently grant attackers access to servers, message content, account information, or internal systems.

Further complicating communication during the incident, Threema’s public status page also experienced issues. The company stated that a separate, unrelated technical problem initially prevented updates to the status page. It was subsequently taken offline temporarily until the issue was resolved, limiting the availability of official outage information for a portion of the incident. Threema communicated updates primarily through its social media channels and directly informed Threema Work business customers via email on Wednesday morning. Account managers also provided direct responses to customer inquiries as the service instability continued.

Notably, organizations utilizing Threema OnPrem, which operates on customer-managed infrastructure, were unaffected by the attack. These deployments remained fully operational while Threema’s hosted service faced the DDoS onslaught.

Response and Mitigation

In response to the incident, Threema swiftly implemented an additional, specialized DDoS protection mechanism. This new control is designed to filter malicious traffic upstream, before it reaches Threema’s core infrastructure. This approach significantly reduces the load on internal systems and existing defensive layers. The company confirmed the activation of this upstream filtering protection in its production environment on August 14, 2026, at 6:05 p.m. CEST.

Looking ahead, Threema plans to enhance its status page by adding an incident history and an RSS feed. This initiative aims to provide users and Threema Work administrators with an independent and reliable channel for receiving system status alerts during any future outages.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.