Cloudflare reports 23.2 million network DDoS attacks for the first half of 2026. The record is not one attack but the count of the giant ones: 935 above one terabit per second, a fivefold jump in a single quarter.
- Per Cloudflare data, 23.2 million network DDoS attacks were absorbed in H1 2026 - roughly 5,300 per hour on average.
- Mega-attacks above 1 Tbps number 935, up 519% between Q1 and Q2. DNS floods reach 40% of network attacks.
- Media is the most attacked sector; government jumped from 29th to 9th place.
935 times in six months, someone pulled a one-terabit-per-second trigger. A year ago an attack of that class came with a press release. Now it is a Tuesday.
The numbers come from the shield itself, so read them as its point of view: Cloudflare counts what passes through its own network. The trend does not depend on the counting, though. The giant attack got cheap because the armies of hijacked devices - the botnets - keep growing while their rent keeps falling.
The DNS flood deserves its own minute. It does not hit your site, it hits the phone book people use to find you. A site with a healthy server and a drowned DNS is exactly as invisible as a site that is down. Ask your provider what stands in front of the DNS, not just in front of the site.
The background changed. Plan for this one, not for last year's.