Three Days in August: What a DDoS Attack Exposed in Our Network

In August 2026 a sustained DDoS campaign hit a customer and spilled into the provider network for three days, forcing an emergency response and a full internal postmortem. The report reconstructs the timeline of the incident, describes the attack vectors and measurable impact on services, and documents operational pain points: overloaded ingress points, insufficient edge filtering and rate-limiting, single points of failure in routing and peering, gaps in monitoring and alerting, and unclear escalation runbooks that slowed mitigation. It also covers customer-facing consequences and how upstream providers and partners factored into the outage.

The write-up lays out concrete findings and the remediation path: immediate mitigations taken during the event, deployment of stronger DDoS protection and traffic scrubbing, tighter network segmentation and rate controls, improved observability and synthetic checks, clarified incident playbooks and communication procedures, and adjustments to provider relationships and SLAs. The takeaway is explicit: the attack exposed both technical and process weaknesses, and the changes implemented aim to harden network edge defenses, reduce blast radius, and accelerate future incident response to prevent a repeat.