DDoS Attacks in Russia Up 140% This Year, Fintech the Main Target
In short: On October 13, 2026, cybersecurity provider Curator released data showing DDoS attacks in Russia rose 140.7% year-over-year in January–September 2026. Attacks exceeding 1 Tbps hit 20 incidents, up from just one in all of 2025, and fintech now accounts for 41.7% of all attacks, up from 24.4% a year earlier. One bank endured a record 200-hour continuous attack in Q3. For an ordinary bank customer, this isn't about stolen money directly — it's about service outages and a spike in "your bank" phishing around the disruption.
What happened
According to Curator's report, the number of DDoS attacks on Russian companies rose 140.7% in the first nine months of 2026 compared with the same period in 2025. Intensity spiked too: 20 attacks exceeded 1 Tbps, versus a single such case in all of 2025. Attacks on banks specifically rose 7.4x year-over-year, and the longest Q3 attack ran for a record 200 consecutive hours (up from 119.2 hours a year earlier) — more than eight straight days of sustained load on one service. We've covered why banks sometimes restrict access through a VPN in our piece on why a bank app might not work over a VPN.
Attackers focused heavily on the financial sector: fintech accounted for 41.7% of all DDoS incidents in January–September 2026, up from 24.4% a year earlier. IT and telecom came second at 21.7% (versus 14.4% in 2025). E-commerce's share actually fell, from 23.4% to 12.8% — a clear pivot toward money and core infrastructure rather than online storefronts.
Why banks and fintech specifically
The shift toward the financial sector lines up with findings from other industry players: according to security firm Garda, fintech's share of DDoS attacks rose sixfold year-over-year in Q2 2026 alone. The logic is straightforward — knocking a banking app or site offline, even briefly, hurts a business and its customers far more than a temporary storefront outage, which raises the odds of extracting a ransom to stop the attack or simply maximizing damage to a target.
What it means for everyday users
A DDoS attack on its own doesn't steal money or breach your personal account — it floods the bank's servers with traffic, making the app or site slow or temporarily unreachable. The direct risk to a customer isn't a fraudulent withdrawal; it's not being able to make a payment, check a balance, or lift a card restriction exactly when you need to.
The more dangerous side effect is secondary: mass outages are reliably followed by a wave of phishing. Scammers send messages "from the bank" about "maintenance," ask you to "confirm a transaction" via a link, or push a fake "backup app" — exploiting the anxiety a real outage has already created. We cover the basics of safe online banking in our guide on secure online banking.
How to protect yourself
- If your banking app or site isn't responding, don't click links in emails or texts offering to "fix the problem" — open the app directly or call the number on the back of your card.
- Turn on two-factor authentication and push confirmation for transactions — it won't stop an attack on the bank's servers, but it limits the damage if you're also being targeted by phishing in parallel.
- Don't panic or rush to move money to a "safe account" on a stranger's advice — that's a classic scam that activates precisely around real news of outages and attacks.
- Keep your banking app updated: some defenses against overload scenarios and fraud ship through app updates.
The DDoS attack itself happens on the bank's infrastructure, and nothing on your home device changes that. But while you're using a banking app over public Wi-Fi at a café or airport, LiMP VPN encrypts your own traffic and hides it from others on the same network — that covers the network side of the risk, not the server overload itself. Plans from 69 ₽/month, a no-logs policy: LiMP VPN pricing.