Executive Summary
Publication Date: August 14, 2026
On August 13 and 14, 2026, the Threema secure messaging service experienced a significant disruption due to a series of large-scale Distributed Denial of Service (DDoS) attacks. These attacks targeted both Threema and its colocation partner, Nine, resulting in several hours of complete unavailability and intermittent service interruptions. The attacks were characterized by their scale, adaptability, and persistence, requiring the rapid deployment of enhanced DDoS protection measures. No data breach or compromise of security occurred, and Threema OnPrem customers remained unaffected throughout the incident.
Incident Timeline
The disruption began on Tuesday, August 13, 2026, at 7:30 p.m. CEST, when Threema became unavailable due to the onset of DDoS attacks. The main service remained completely inaccessible until 11:30 p.m. CEST, totaling four hours of downtime. During this period, the system status page was also temporarily taken offline due to a separate technical issue. On Wednesday, August 14, 2026, the attacks persisted, causing intermittent and brief service interruptions throughout the morning. By 12:23 p.m. CEST, normal operations were restored and all services were fully operational. Final stability tests for new DDoS protection mechanisms were completed, and at 6:05 p.m. CEST on August 14, 2026, the enhanced protection was activated in the production environment.
Technical Root Cause
The root cause of the disruption was a series of large-scale, adaptive DDoS attacks directed at both Threema and its colocation partner, Nine. The attackers continuously modified their methods, sources, and attack patterns, making defense efforts particularly challenging. The attacks were designed to overwhelm the infrastructure with excessive traffic, targeting service availability rather than attempting to breach security or access data. The sophistication and resources behind the attacks suggest the possible involvement of state actors.
Service Impact Analysis
The primary impact was the complete unavailability of the Threema main service for four hours on Tuesday evening, followed by intermittent, brief service interruptions on Wednesday morning. The disruptions affected both business and private users of Threema. However, Threema OnPrem customers, who operate self-hosted instances, were not affected and experienced no interruptions. The attacks did not result in any data loss, data breach, or compromise of user security.
Customer Impact
Customers experienced significant inconvenience due to the temporary unavailability and instability of the Threema service. Communication regarding the incident was provided through Threema’s social media channels as information became available. Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers responded to individual inquiries with updates on the situation. Threema OnPrem customers were not impacted and maintained uninterrupted service.
Response and Recovery
Threema’s existing DDoS defense mechanisms were actively adapted in real time to counter the evolving attack patterns. In response to the scale and persistence of the attacks, additional specialized DDoS protection was implemented to filter malicious traffic upstream, thereby reducing the load on Threema’s infrastructure. Final stability tests for the new protection mechanism were conducted, and the enhanced DDoS protection was activated in the production environment at 6:05 p.m. CEST on August 14, 2026. Throughout the incident, Threema communicated updates via official channels and committed to expanding its status page to include an incident history and RSS feed for independent system updates.
Business Impact
The incident resulted in the temporary unavailability and instability of the Threema main service, affecting both business and private users. There was no impact on Threema OnPrem customers, and no data breach or compromise of security occurred. The disruption highlighted the increasing sophistication and resourcefulness of modern DDoS attacks, underscoring the need for continuous investment in advanced protective measures.
Lessons Learned
The incident demonstrated the importance of adaptive and layered DDoS protection strategies, especially in the face of highly adaptive and resource-intensive attacks. Threema recognized the need for rapid deployment of enhanced protection mechanisms and the value of clear, timely communication with customers during service disruptions. The company also identified the necessity of maintaining robust status communication channels, including plans to expand the status page with incident history and RSS feed capabilities for improved transparency and customer awareness.
References
Official Statement: https://threema.com/en/blog/outage-august-2026
About Rescana
Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform designed to help organizations identify, assess, and mitigate risks across their vendor ecosystem. Our platform delivers actionable insights and continuous monitoring to support robust risk management strategies. For more information or inquiries, we are happy to answer questions at info@rescana.com.
