DDoS Attack Statistics: 2026 Report

How Many DDoS Attacks Hit Each Country in 2026?

This section ranks the 20 countries and territories with the most DDoS attacks in the first half of 2026, using our DDoS Attack Study of NETSCOUT's country pages. The 158 countries and territories with published counts account for 8,190,224 attacks, about 89.5% of the 9,146,021 global total (our calculation). NETSCOUT does not assign every attack to a country.

Source: CyberReviewed DDoS Attack Study (Source 1), from NETSCOUT 1H 2026 country pages (Source 2). Shares are our calculation from NETSCOUT's global total. Data: table1-top20-countries.csv; all 158 rows in netscout-1h2026-country-dataset.csv.

• The United States received nearly twice as many attacks as South Korea in second place. Brazil ranked third with 487,415.
• The top 10 countries account for 4,470,900 attacks, about 48.9% of the global total (our calculation). The other 148 countries and territories, plus attacks NETSCOUT does not assign to a country, make up the rest.
• A company that hosts its services in the United States runs them on the most attacked national networks in NETSCOUT's data. For that company, a DDoS attack is a routine event to plan for.

Average attack duration in the United States was 52.48 minutes, close to the 50.35 minute median of the country averages (our calculation). The United Kingdom had the longest average among the top 20, at 146.08 minutes, and its top vector was DNS amplification. Saudi Arabia had the shortest, at 9.10 minutes. TCP ACK floods were the top vector in 75 countries and territories, including the United States, and DNS amplification led in 27.

Which Countries Face the Most DDoS Attacks per Resident?

This section adjusts the attack counts for population, to show where attacks are concentrated relative to the number of people living in a country. We divided each top 20 country's NETSCOUT attack count by its 2024 World Bank population. Attacks are counted against targets in a country, including hosting providers and carriers that serve customers elsewhere, so the rate measures how densely attacks fall on a country's networks.

Source: CyberReviewed DDoS Attack Study (Source 1), from NETSCOUT 1H 2026 country pages (Source 2) and World Bank population, 2024, indicator SP.POP.TOTL (Source 6). Rates are our calculation. Data: table2-attacks-per-million-residents.csv.

• Hong Kong had the highest rate of the 20, about 20,685 attacks per million residents (our calculation). That is about six times the US rate of 3,315.
• India and China rank 11th and 16th by count and last by rate. Their rates were about 157 and 103 attacks per million residents (our calculation).
• A high rate points to networks that host or carry traffic for far more people than live in the country. For an organization choosing where to place its servers, the rate shows how heavily attacked a location's networks are relative to its size.

Most attacks on Hong Kong targets hit web hosting and computing infrastructure providers, which took 110,391 of its 155,639 attacks, about 70.9% (our calculation). Saudi Arabia, third by rate, took its largest count against wired telecommunications carriers, and Poland, fourth, against wireless carriers.

Which US Industries Take the Most DDoS Attacks?

This section breaks down the US attack count by the industries NETSCOUT reports, which follow the North American Industry Classification System. The nine industries on the US page account for 964,745 attacks, about 85.6% of the 1,126,971 US attacks (our calculation).

Source: CyberReviewed DDoS Attack Study (Source 1), from the NETSCOUT 1H 2026 United States page (Source 2). Shares are our calculation from the US total. Data: table3-us-industries.csv.

• Wired telecommunications carriers took more attacks than any other US industry. The three telecommunications categories together took 647,148, about 57.4% of all US attacks (our calculation).
• Attacks on hobby, toy and game retailers averaged 269 minutes, the longest of the nine industries. Attacks on computer terminal and other computer peripheral equipment makers averaged 191 minutes, and both categories ranked in the bottom three by count.
• For an online store, an attack lasting hours can mean an afternoon of lost sales. Retailers that sell through their own websites carry that cost directly.

Gaming companies also appear in other vendor data. Arelion reported that the Aisuru botnet, which it calls the most disruptive DDoS threat of 2025, mainly targeted major gaming and cloud providers. Colleges and universities complete the US list with 8,366 attacks.

Which Attack Vectors Hit US Targets Most?

This section shows the five attack vectors NETSCOUT counted most often against US targets. TCP ACK and SYN floods bombard servers and firewalls with connection packets, and DNS floods and DNS amplification abuse the internet's address lookup system. A single attack can use several vectors, so a vector count is the number of attacks that included it, and the shares cannot be added together.

Source: CyberReviewed DDoS Attack Study (Source 1), from the NETSCOUT 1H 2026 United States page (Source 2). Shares are our calculation from the US total. Data: table4-us-attack-vectors.csv.

• TCP ACK floods appeared in 246,815 US attacks, the most of any vector. DNS floods ranked second with 167,694.
• TCP SYN floods ranked fourth with 82,630 attacks. ICMP floods, which send large numbers of ping style messages, ranked fifth with 39,801.
• One US attack combined 27 vectors, according to NETSCOUT's US page. A defense that filters one kind of traffic leaves the others free to reach the target.

DNS attacks were also prominent in Cloudflare's global data. Cloudflare reported that DNS floods and DNS amplification made up 34.3% of the network attacks it mitigated in the first half of 2026, and that DNS floods alone rose from 25.7% to 40.0% of network attacks between the first and second quarters. Cloudflare measures its share on attacks mitigated on its own network, a different base from the NETSCOUT US count. NETSCOUT reported that direct path methods, which send traffic straight from attacking machines to the target with no third party servers in between, accounted for 64% of the attacks it observed worldwide.

How Long and How Large Are DDoS Attacks in North America?

This section compares the duration and bandwidth of DDoS attacks in North America with NETSCOUT's global distribution. NETSCOUT publishes these bands only by region, so North America is the closest available measure for US attacks. The United States accounts for about 76.7% of the 1,469,259 attacks NETSCOUT recorded in North America (our calculation).

Source: CyberReviewed DDoS Attack Study (Source 1), from NETSCOUT 1H 2026 regional pages (Source 2). Data: table5-duration-bands.csv.

• About 77.0% of North American attacks ended within 15 minutes (our calculation, adding the first two bands). Worldwide, the figure was 72.2%.
• The 5 to 15 minute band held 59.70% of North American attacks. It was the largest single band in either distribution.
• Short attacks can interrupt service for users connected during those minutes. An outage log that counts only long incidents leaves most of them out.

Source: CyberReviewed DDoS Attack Study (Source 1), from NETSCOUT 1H 2026 regional pages (Source 2). Data: table6-bandwidth-bands.csv.

• About 34.5% of North American attacks exceeded 1 Gbps (our calculation, adding the top three bands). The global figure was 29.4%.
• The 1 to 10 Gbps band held 29.97% of North American attacks. That is more than six percentage points above the global share of 23.51%.
• An organization with a 1 Gbps internet line cannot absorb attacks in the top three bands on that line alone. Filtering them takes capacity upstream, at the carrier or a scrubbing service.

Cloudflare's network also showed short durations, with 90.60% of network attacks ending in under 10 minutes, and 96.62% of its network attacks stayed under 500 Mbps. NETSCOUT reported that attacks lasting one minute or less have roughly doubled as a share of attacks since the second half of 2023, and linked the trend to DDoS for hire services.

How Do DDoS Attacks Break Down by Region?

This section sets the regional totals NETSCOUT published for the first half of 2026 against the previous six months. The four regions sum to 8,712,770 attacks, below the global total, because some attacks are not assigned to a region.

Source: CyberReviewed DDoS Attack Study (Source 1), from NETSCOUT 1H 2026 regional pages (Source 2). Shares are our calculation; changes are as NETSCOUT published them. Data: table7-regions.csv.

• North America had the largest increase of any region against July to December 2025. Asia Pacific had the smallest, at 2.2%.
• Europe, the Middle East and Africa received about 45.6% of global attacks (our calculation). That is nearly three times North America's share of about 16.1%.
• A North American organization whose defenses were sized for the second half of 2025 saw about a quarter more attacks in its region in the first half of 2026. Capacity and budgets planned on late 2025 traffic had to cover that larger load.

Radware's customer data also points to North America as a main target. North America received 43.1% of the network DDoS attacks Radware mitigated in the first half of 2026, and 79.5% of the malicious web application and API transactions. Radware's highest attack frequency was in the Middle East, at an average of 520 network attacks per customer per day.

How Often Do US Public Companies Mention DDoS in Annual Reports?

This section counts the annual reports on Form 10-K that mention denial of service or DDoS in each year from 2014 to October 24, 2026, and sets each count against all 10-K filings found by the same search method. About 94.3% of the 6,143 10-K filings in 2026 list a business address in a US state, the District of Columbia or Puerto Rico (our calculation), so the count tracks how often US public companies describe the risk.

Source: CyberReviewed DDoS Attack Study (Source 1), from SEC EDGAR full text search (Source 4). Original 10-K filings only, counted once per accession number. Shares are our calculation. Data: table8-10k-ddos-mentions.csv; industry figures in table8b-10k-ddos-mentions-by-industry-2026.csv.

• The share of 10-K filings that mention denial of service or DDoS rose from about 4.9% in 2014 to about 31.4% in 2026 to date. It grew in every year of the series.
• Mentioning filings rose from 383 in 2014 to 1,935 in 2025. Over the same years, the number of 10-K filings fell from 7,762 to 6,423.
• A risk factor mention shows that the company considers attacks a threat to its business. A filing has to describe a specific attack before it shows the company was hit.

The largest annual rise in share came in 2024, from about 23.6% to about 28.6% (our calculation), the first filing season in which the SEC required a cybersecurity section in 10-K reports for fiscal years ending on or after December 15, 2023. Mentions vary by industry. Among 2026 filings to October 24, about 60.2% of the 399 filings from software and data processing companies (SIC codes 7370 to 7379) mention denial of service or DDoS, against about 50.6% of 81 communications filings and about 21.1% of 2,325 filings in finance, insurance and real estate (all our calculation).

A mention can be a line in a list of possible risks or a description of a past attack, and our count does not separate the two. Incident filings are a separate measure. Since December 18, 2023, companies have had to report material cybersecurity incidents on Form 8-K under Item 1.05. EDGAR full text search tags 85 Item 1.05 filings through October 24, 2026, including 26 amendments, from 59 registrants. The only two that mention denial of service, from V.F. Corporation, use the phrase in forward looking risk language in filings about a different kind of incident. None of the 85 describes a DDoS attack as the incident.

How Do the 2026 DDoS Vendor Reports Compare?

This section sets the four main DDoS reports for 2026 side by side by period, vantage point and unit of measurement. Each vendor reports from its own network and counts a different unit. Cloudflare counts the attacks and HTTP requests it mitigated, Radware reports attacks per customer per day, and Arelion measures the traffic crossing its internet backbone, so their headline totals cannot be added together or compared directly.

Source: NETSCOUT (Sources 2 and 3); Cloudflare (Source 7); Radware (Source 13); Arelion (Source 14). Data: table9-vendor-comparison.csv.

• NETSCOUT and Cloudflare both cover January to June 2026. NETSCOUT counts attacks seen from its passive, active and reactive vantage points, and Cloudflare counts attacks it mitigated on its own network.
• Radware's rate of network attacks per customer per day rose 36.6% over its 2025 baseline. Radware does not publish a total attack count.
• A headline DDoS figure is usable only alongside its unit and the network it comes from. An organization comparing providers' reports needs to match the units before comparing the numbers.

NETSCOUT, Cloudflare and Radware all report growth in 2026, by different amounts. NETSCOUT's count of attacks above 1 Tbps or 1 billion packets per second rose 1,286% year over year, and Cloudflare's count of network attacks above 1 Tbps rose from about 130 in the first quarter (our calculation, 935 for the half less 805 in the second quarter) to 805 in the second. Radware reported that web DDoS attacks rose 110.6% from the first half of 2025 and 36.3% from the second half of 2025. Cloudflare also changed its schedule in 2026. The H1 2026 edition is its first half year report, combining the first and second quarters, so there is no separate Cloudflare report for the second quarter of 2026.

Cloudflare and Radware also rank the United States. Cloudflare ranked it the second most attacked location in the first half, with 18.8% of HTTP DDoS requests in the second quarter, behind China at 22.4%. Brazil overtook the United States as the largest source of DDoS traffic, at 14.9% against 13.4%. In Radware's tracking of hacktivist DDoS claims, the United States drew 7.7% of claimed attacks, behind Israel at 16.9% and Ukraine at 8.4%, and the group NoName057(16) made 40.5% of all claims.

How Many DDoS Attacks Does Cloudflare Mitigate per Year?

This section tracks Cloudflare's yearly attack totals, the one series among the four vendors that gives a count of attacks for each full year. The H1 2026 edition gives network attacks and HTTP DDoS requests separately and no combined attack total, so the network attack column is the one that runs through all three periods.

Source: Cloudflare DDoS threat reports for 2024 Q4, 2025 Q4 and H1 2026 (Sources 12, 8 and 7). Data: table10-cloudflare-attacks-per-year.csv.

• Cloudflare's total for 2025 was more than double its 2024 total. Network attacks more than tripled over the same year.
• The hourly rate of network attacks in the first half of 2026 was about 36.1% above the 2025 rate (our calculation). At its first-half 2026 rate of 5,343 network attacks an hour, Cloudflare mitigated about 89 a minute (our calculation).
• The hourly rate covers all of Cloudflare's customers together. For any single customer, it describes the workload of the provider protecting it.

Some of the growth comes from single campaigns. Cloudflare's first quarter of 2025 alone held 20.5 million attacks, and an 18 day campaign against Cloudflare and other infrastructure it protects drove 13.5 million of them. April 2026 was the peak month of the first half, with 6.46 trillion HTTP DDoS requests. Cloudflare noted that requests declined afterward, possibly in response to Operation PowerOFF, an action across 21 countries that targeted more than 75,000 users of DDoS for hire services, took down 53 domains and led to four arrests.

What Are the Largest DDoS Attacks on Record?

This section traces the record bandwidth attacks Cloudflare disclosed from October 2024 to the end of 2025. Cloudflare describes each attack as the largest publicly disclosed at the time, or in the case of the 6.5 Tbps attack as equal to the largest. No larger attack has been publicly disclosed in 2026 reports from these vendors.

Source: Cloudflare DDoS threat reports for 2024 Q4 and 2025 Q1 to Q4 (Sources 8 to 12); Arelion release of July 15, 2026 (Source 14). Data: table11-record-attacks-timeline.csv.

• The record rose from 5.6 Tbps in October 2024 to 31.4 Tbps in the fourth quarter of 2025. Each of the five disclosures was at least as large as the one before.
• The largest jump came in the third quarter of 2025, from 7.3 Tbps to 29.7 Tbps. The Aisuru botnet made the 29.7 Tbps attack.
• Network capacity that matched the record in late 2024 covered less than a fifth of the record by late 2025 (our calculation). A defense sized to the October 2024 record would have been outgrown within about a year.

Aisuru drove most of the later records. Arelion reported that the botnet used more than 500,000 compromised internet of things devices and Android systems, and drove about 33% of the DDoS attack traffic on Arelion's backbone, where the largest attacks reached 6.1 Tbps. By early 2026, Arelion said, a variant called KimWolf had infected more than 2 million Android TV and streaming devices. Arelion also reported that the average attack duration on its network fell 20% to 8.9 minutes. NETSCOUT observed its first IPv6 attack above 1 Tbps in the first half of 2026.

What the DDoS Numbers Mean

Most US attacks land on the carriers and hosting providers that other businesses run on. A company can lose its website, apps or phone lines when its provider is flooded, even when no attacker chose the company.

This dependence makes a provider's filtering part of each customer's own defenses.

If you depend on a carrier, host or cloud provider, ask how it detects and stops attacks that end within minutes and how much attack traffic its network can absorb.

Sources

1. CyberReviewed, DDoS Attack Study: analysis of NETSCOUT's January to June 2026 attack counts for 158 countries and territories and four regions, including US attacks by industry and vector and North American attacks by duration and bandwidth, of World Bank 2024 population figures, of DDoS mentions in every original Form 10-K filed on SEC EDGAR from 2014 to October 24, 2026, and of the 85 Form 8-K filings tagged Item 1.05 from December 18, 2023 to October 24, 2026, conducted October 2026. Data files: netscout-1h2026-country-dataset.csv, table1-top20-countries.csv, table2-attacks-per-million-residents.csv, table3-us-industries.csv, table4-us-attack-vectors.csv, table5-duration-bands.csv, table6-bandwidth-bands.csv, table7-regions.csv, table8-10k-ddos-mentions.csv, table8b-10k-ddos-mentions-by-industry-2026.csv, table9-vendor-comparison.csv, table10-cloudflare-attacks-per-year.csv, table11-record-attacks-timeline.csv.
2. NETSCOUT, DDoS Threat Intelligence Report, January to June 2026 (global, regional and country pages)
3. NETSCOUT, "High-Capacity DDoS Attacks Surge 1,286% in 1H 2026 According to NETSCOUT Threat Intelligence Research" (October 14, 2026)
4. US Securities and Exchange Commission, EDGAR full text search
5. US Securities and Exchange Commission, "SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies" (July 26, 2023)
6. World Bank, World Development Indicators, population total (SP.POP.TOTL), 2024
7. Cloudflare, "Cloudflare DDoS Threat Report H1 2026" (August 11, 2026)
8. Cloudflare, DDoS threat report for 2025 Q4
9. Cloudflare, DDoS threat report for 2025 Q3
10. Cloudflare, DDoS threat report for 2025 Q2
11. Cloudflare, DDoS threat report for 2025 Q1
12. Cloudflare, DDoS threat report for 2024 Q4
13. Radware, "Radware H1 2026 Global Threat Report Shows Web DDoS Attacks Jump More Than 110% as Cyber Threats Accelerate" (September 9, 2026)
14. Arelion, "Arelion's 2026 DDoS report shows Aisuru botnet responsible for nearly one third of DDoS attacks" (July 15, 2026)

Data Collection and Methodology

Our study. The CyberReviewed DDoS Attack Study, conducted in October 2026, has two parts. The first analyzes NETSCOUT's January to June 2026 country and regional pages with World Bank population figures. The second counts DDoS mentions in SEC filings.

Country data. We collected the NETSCOUT country pages for January to June 2026, 159 pages in all, and recorded each page's attack count, average attack duration, the largest number of vectors seen in one attack, the top five attack vectors and the most targeted industries. The Rwanda page redirects to the EMEA regional page and carries no count, which leaves 158 countries and territories. Shares of the global total use NETSCOUT's figure of 9,146,021 attacks. The country counts sum to 8,190,224 and the four regional counts to 8,712,770, because NETSCOUT does not assign every attack to a country or region. Country names follow common English usage (for example, United States for NETSCOUT's United States of America and South Korea for Republic of Korea), and NETSCOUT's own names are kept in the dataset. Industry labels are NETSCOUT's North American Industry Classification System labels in sentence case with their commas restored. The top attack vector for a country is the vector with the highest count on its page. Duration and bandwidth bands come from NETSCOUT's regional pages, which do not break these figures down by country.

Attacks per million residents. We divided each country's attack count for the half year by its 2024 population from the World Bank and multiplied by one million. The rate covers the 20 countries with the most attacks. It reflects where targets are located, including hosting and carrier networks that serve customers in other countries.

Vendor units. Each vendor counts from its own network and in its own unit. NETSCOUT counts attacks, Cloudflare counts the attacks and HTTP requests it mitigated, Radware reports attacks per customer per day, and Arelion measures traffic on its backbone. We report each figure in its source's own unit.

Annual report mentions. We searched SEC EDGAR full text search for Form 10-K documents containing "denial of service", "denial-of-service" or "DDoS" in each calendar year from 2014 to October 24, 2026, and for all 10-K documents containing the standard cover page phrase "Section 13 or 15(d)" as the denominator. We counted unique filings by accession number, so a filing with several matching documents counts once, and we excluded amended filings (Form 10-K/A) from both the numerator and the denominator. Full text search covers filings from 2001, but its result counts stop at 10,000, which made the denominator unreliable before 2014. The numerator counts only filings that also matched the denominator search, so every counted filing is in both. The 2026 figures run to October 24. Shares are our calculation. Business addresses come from the state field in the search results. Industry groups in the 2026 breakdown follow SIC divisions, with SIC codes 7370 to 7379 shown separately and all other service codes from 7000 to 8999 grouped as other services; 167 filings with no SIC code are left out of the breakdown.

Incident filings. We used EDGAR full text search with the Item 1.05 item tag (items=1.05) for Form 8-K filings dated December 18, 2023, when Item 1.05 (Material Cybersecurity Incidents) took effect, to October 24, 2026. The search returned 85 filings, 59 on Form 8-K and 26 amendments on Form 8-K/A, from 59 registrants by SEC CIK (58 companies; Brandywine Realty Trust and Brandywine Operating Partnership file jointly). The 8-K count includes amendments, and the 10-K count excludes them. We then ran the same denial of service and DDoS terms with the same item tag and read every matching filing.

Rounding. Our calculated percentages are rounded half up to one decimal place and our calculated rates per million residents to whole numbers.

Vendor figures. Figures from Cloudflare, NETSCOUT, Radware and Arelion are reported as each source published them. Our calculations, including the first quarter 2026 count of Cloudflare attacks above 1 Tbps and the 2024 hourly rate, are labeled where they appear.