Attack on availability (DDoS)

Attack on the availability of websites or other internet services. These services are overloaded by a large number of requests.

A DDoS attack is a targeted attempt to disrupt the availability of a computer system. The attacker creates heavy network traffic by sending thousands of requests at once, which overwhelms the system. If your systems are targeted in a DDoS attack, the best approach is to give the attacker the impression that their efforts are ineffective. If your systems remain available for long enough, the attackers will eventually give up. We recommend contacting your internet service provider, as they are best placed to help.

Specific measures

Contact your internet service provider to discuss appropriate defensive measures.
Analyse the attack and define a defence strategy.
Check your publicly available email addresses for any extortion emails. Do not pay the ransom under any circumstances.
Consider partially isolating your network from the internet to maintain minimal operations.
Log the attack (e.g. netflows, server logs and email exchanges with the extortionists). These records are important for later analysis and for any potential criminal complaint.
Make sure you have minimal external communication channels available, for example a static website where you can inform customers and provide alternative contact options (e.g. by phone, fax or email).
Be prepared for the attacker to adapt to your defensive measures and use new tactics. If this happens, analyse the DDoS attack again and take appropriate countermeasures.
Please report the incident to the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian). The NCSC is not a law enforcement agency and cannot conduct investigations.

Preventive measures

Discuss DDoS protection options with your internet service provider in advance.
Define processes that can be activated in the event of an attack, particularly if your business relies heavily on its website.
Identify and protect business-critical IT applications that generate a significant proportion of your revenue (e.g. online shops).

How the NCSC can help

Your report via the online form helps the NCSC identify trends. This makes it possible for the NCSC to raise public awareness in a targeted way.

Further Information

DDoS attack - what next?