Cloudflare reports 519% surge in major DDoS attacks

Cloudflare recorded a sharp rise in large-scale flooding attacks during the first half of 2026. The findings also show how geopolitical events can quickly translate into digital disruption.

According to the official Cloudflare DDoS Threat Report H1 2026, the company mitigated 935 network-layer DDoS attacks exceeding 1 Tbps during the first six months of the year. The number of attacks above that threshold increased 519% between the first and second quarters.

A 1 Tbps attack directs more than one terabit of traffic per second at its target. The goal of these attacks is to overwhelm networks and online services with so much traffic that they become slow, unstable or unavailable to legitimate users.

Flooding attacks continue to grow

Cloudflare also reported strong growth in other types of flooding attacks.

DNS floods rose from 25.7% to 40% of network-layer attacks between Q1 and Q2. CLDAP floods also increased sharply and became the third most common network-layer attack vector in the second quarter.

Hyper-volumetric DDoS attacks above 1 Tbps surged 519% between the first and second quarters of 2026.

Geopolitics changes who gets attacked

The report also shows that attack patterns can shift rapidly during geopolitical crises.

Cloudflare said that after Israel and the United States launched strikes against Iran on February 28, researchers recorded 149 hacktivist DDoS claims against 110 organizations across 16 countries within 72 hours. Almost 48% of the targeted organizations were in the government sector. The government sector subsequently moved from 29th place among targeted industries in Q1 to ninth in Q2.

A similar pattern appeared around another major international event. Turkey more than doubled its share of global DDoS attack traffic and became the third most-attacked country in Q2 as activity increased around preparations for the NATO Summit in Ankara.

For organizations across the Middle East, the findings show that service availability is becoming part of the wider digital resilience challenge. Governments, financial institutions, media organizations and businesses increasingly depend on always-available digital services. In a region exposed to geopolitical tensions, disruption in the physical world can also trigger rapid changes in cyber activity.

Ercan Aydin, Associate Vice President for Middle East, Türkiye and Africa at Cloudflare, said organizations in the region cannot treat availability as a purely technical concern. “The surge in hyper-volumetric attacks, alongside the growing use of DNS-based vectors, reinforces the need for always-on, intelligent protection that can detect and mitigate attacks before they impact critical services,” Aydin said.