DDoS Attacks in Europe Reach Unprecedented Scale in 2025, Link11 Report Reveals Frankfurt, Germany – March 2, 2026 – DDoS attacks in Europe surged to record levels in 2025, evolving from isolated disruptions into a persistent threat to digital infrastructure, according to Link11’s European Cyber Report 2026. The findings highlight a 75% year-over-year increase in documented attacks, following a 137% spike in 2024, cementing DDoS as a structural burden for businesses and critical services. Key statistics underscore the escalation: - Volume: Three attacks exceeded 1 Tbit/s, with the largest peaking at 1.33 Tbit/s over 120 million packets per second. A coordinated campaign totaled 509 terabytes of data, equivalent to the daily traffic of a 120,000-person city. - Duration: The longest attack lasted 12,388 minutes (over eight days), while active DDoS threats were detected 88% of the time or 322 days per year making sustained attacks the new norm. - Persistence: 70% of targeted organizations faced follow-up attacks, averaging 2.8 additional incidents per initial strike, an 80% increase from 2024. Attackers are adopting hybrid tactics, combining high-volume strikes with low-and-slow application-layer assaults to evade defenses. These methods test protective measures in real time, often mimicking legitimate traffic to degrade performance without triggering alarms. Jens-Philipp Jung, Link11’s CEO, described the shift as a "paradigm change," noting that DDoS is no longer a sporadic event but a permanent strategic threat to digital business models. The report emphasizes the need for always-on DDoS protection and Web Application & API Protection (WAAP), as modern attacks increasingly target Layer 7. AI-driven detection and automated mitigation are critical to countering adaptive threats, while integration into business continuity plans is now essential for maintaining operational stability. With attacks directly impacting revenue, reputation, and regulatory compliance, the findings signal a fundamental shift in cybersecurity priorities from reactive measures to proactive, architecture-level resilience.