DDoS attacks surge by 82% as IoT & AI fuel threats

Distributed denial of service (DDoS) attacks have surged by 82% from 2023 to 2024, according to a report released by the Zayo Group.

The report highlights that the number of attacks escalated from 90,000 incidents in 2023 to 165,000 in 2024. The primary drivers behind this increase are the proliferation of Internet of Things (IoT) devices and cyber criminals' adoption of artificial intelligence (AI), which has allowed for faster and more sophisticated attacks.

Max Clauson, Senior Vice President of Network Connectivity at Zayo, noted, "We're seeing attackers use larger botnets of compromised IoT devices and AI to drastically increase the scale of attacks. As the sophistication of DDoS attacks continues to grow, cybercriminals are finding ways to exploit cloud services, higher bandwidth availability, and new vulnerabilities in software and network protocols. Both the public and private sector need to invest heavily in DDoS mitigation to continue to protect critical infrastructure and ensure long-term data security."

The report provides detailed insights by industry, revealing that the telecommunications sector remains the most frequently targeted, accounting for 42% of all DDoS incidents in 2024. This represents a decrease from 48% in 2023, suggesting that other industries are becoming increasingly vulnerable.

Finance is reported to have experienced the largest year-over-year growth in attack volume among all sectors, with its share rising from 3.5% of all attacks in 2023 to 7% in 2024.

Cloud and Software as a Service (SaaS) companies also experienced a notable increase. Attack rates grew to 11% of all incidents, amounting to over 19,000 attacks, most of which occurred in the latter half of 2024.

The healthcare sector saw a substantial 223% increase in attacks between the two years, pointing to heightened risk in this industry that often handles critical and sensitive data.

Manufacturing has not been spared. The size of attacks has increased by 257%, making it a growing target for cyberattacks.

The financial impact of these attacks is significant. The typical attack lasts 39 minutes and costs businesses approximately USD $6,000 per minute. This results in average losses of nearly USD $234,000 per incident. Attack timings are often strategically chosen to coincide with business hours to maximise disruption.

There is an anticipated rise in the availability of DDoS-as-a-Service, which would allow individuals with limited technical expertise to execute attacks, potentially increasing the frequency and variety of these cyber threats.

The report underscores the harsh reality that DDoS attacks pose serious threats to organisations across various sectors, irrespective of their size. The financial, operational, and reputational damages can be substantial, necessitating the diversion of vital resources to counter these threats.