Large-Scale DDoS Attacks Disrupt Threema Messenger Service

Swiss messenger Threema, positioning itself as a secure alternative to popular platforms, faced a series of powerful DDoS attacks that led to significant service disruptions. The incidents began on Tuesday evening and continued until Wednesday morning, affecting users in several countries.

According to the company, the attacks were highly intense and featured constantly changing vectors, complicating their mitigation. Threema uses its own server infrastructure located in Switzerland, but part of the load also impacted its colocation partner, Nine. It remains unclear whether the attack specifically targeted Threema or affected multiple targets simultaneously.

Users reported delays in sending messages and periodic service unavailability, despite the official status site showing no issues. The company acknowledged that standard protective measures failed to counter the attack due to its duration and variability. For corporate clients using Threema Work, updates were provided through direct communication channels.

In response to the incident, Threema implemented additional DDoS protection mechanisms that filter malicious traffic at the provider level. This should reduce the load on the infrastructure and minimize the risk of future disruptions. The company also noted that clients using local versions of Threema On-Prem were unaffected, as their operations do not rely on external servers.