A DDoS attack targeting a bank lasted more than eight days in the third quarter of 2026, highlighting the challenges financial institutions face in maintaining the availability of critical digital services.
According to Qrator Labs' latest global report, fintech remained the most frequently targeted sector, accounting for 31.3% of all recorded DDoS attacks observed in Q3 2026.
The 200-hour attack was more than 2.5 times longer than the longest incident recorded in the previous quarter, which lasted 79.9 hours. It also significantly exceeded the maximum attack duration observed throughout 2025, when the longest incident lasted 119.2 hours.
With 31.3% of all DDoS attacks, fintech was well ahead of other industries in Q3 2026. E-commerce (19.0%) and information and communication technology (18.2%) followed at a considerable distance. Together, these three sectors accounted for more than two-thirds of all observed attacks.
Meanwhile, large DDoS botnets are growing again after shrinking sharply earlier this year. The largest botnet Qrator Labs observed reached 3.56 million devices in Q3 2026, up around 70% from 2.09 million in Q2. The decline followed an international law enforcement operation targeting major botnets, but the rapid rebound suggests that its impact may have been short-lived.
For Cyprus, a hub for online trading, brokerage and financial services, these findings come amid growing regulatory attention to operational resilience. At the 6th Cyber Security Conference in September 2026, Christos Meletiou of the Central Bank of Cyprus stressed that financial institutions must go beyond formal compliance with the EU’s Digital Operational Resilience Act (DORA) and demonstrate that their security and recovery mechanisms work in practice.
Also in September, the Cyprus Securities and Exchange Commission (CySEC) introduced new reporting requirements under DORA. Investment firms, crypto-asset service providers, trading venues, and other regulated financial entities that experience major ICT incidents must now calculate and report the resulting annual costs and losses. The new rules require affected firms to quantify the financial impact of serious disruptions and submit their findings to the regulator.
“Financial institutions are particularly attractive to cybercriminals because they deal with money. But attackers rarely distinguish between business models. Even a payment provider that simply processes transactions and earns a commission may be perceived as a lucrative target," said Andrey Leskin, Chief Technology Officer at Qrator Labs. "DDoS attacks are often used for extortion, but they can also serve as a distraction, allowing attackers to conceal intrusions and prevent security teams from responding in time.”
According to Leskin, the resilience of the attack infrastructure itself presents an additional challenge.
“Even when international law enforcement efforts, which remain few and far between, disrupt major botnets, their operators can rebuild the infrastructure within months. Millions of poorly secured connected devices remain available for attackers to exploit because they receive few or no security updates, and AI tools are making it increasingly easy to compromise them at scale. As long as attackers can exploit these devices to rebuild their networks, financial institutions must be prepared for prolonged and potentially repeated attacks."
For financial organisations, these trends underscore the importance of treating DDoS protection as part of broader operational resilience- ensuring that critical services can remain available even during sustained attacks, rather than focusing solely on preventing individual incidents.
