March 2026 recorded 2,815 DDoS attacks against DigiCert UltraDDoS Protect, a 5% increase from February. However, the true story for the month is that the largest attack hit 3.15 Tbps with 277.6 million packets per second, a 444% jump in peak throughput from the prior month, and mega attacks exceeding 100 Gbps grew 194%. Mean attack size followed, with average Gbps up 159% and average packet rate up 306%. This means that March was not a heavier version of February but instead was a different order of magnitude.
The single most consequential day was March 30, which produced 295 attacks, nearly double any other day in the month, directed almost entirely at one Financial Services provider. That is the same pattern seen in prior months: malicious actors concentrating volume against a specific target in a short window rather than distributing pressure across the period. The practical implication is that a single campaign event can define the risk profile for an entire month regardless of what the surrounding weeks look like.
IT/Technical Services accounted for 48.34% of attacks, Financial Services 22.19%, and Communication Service Providers 20.23%. Those sectors have led this list with enough consistency that it reflects deliberate targeting preference rather than random distribution. Most attacks used a single vector, with Total Traffic and UDP leading, which confirms that sophistication is not what makes these events effective. Volume aimed at the right target is. Saudi Arabia ranked second among targeted countries at 14.07%, consistent with the sustained hacktivist and state-adjacent DDoS activity directed at Middle East infrastructure throughout the regional conflict.
By most measures, March was the most severe month in recent reporting. Peak attack scale climbed dramatically across nearly every metric, focused targeting of high-value providers continued without interruption, and the appearance of two Tsunami-class events in a single month is not something that can be attributed to routine variation. DigiCert mitigated every observed attack with no service degradation to our customer base, which reflects the depth of the platform’s mitigation capacity even as attack sizes push into territory that would overwhelm less capable infrastructure. The growth in Tsunami-class events and the persistence of focused Financial Services targeting are trends worth monitoring through Q2, particularly given the broader geopolitical environment continuing to drive hacktivist activity against Western and conflict-adjacent infrastructure.
Stats at a Glance
- Total Number of Attacks: 2,815 (a 5% increase compared to February 2026)
- Total number of hours of downtime avoided: ~ 1,725.02 Hours (a 81.71% increase compared to February 2026)
- Number of Mega Attacks (100+ Gbps): 50 (a 194.12% increase compared to February 2026)
- Largest DDoS Attack (Gbps): 3.15 Tbps (a 444.52% increase compared to February 2026)
- Largest DDoS Attack (million packets-per-second): 458.42Mpps (a 48.08% increase compared to February 2026)
- Longest DDoS Attack: 2.13 days (a 3.90% increase compared to February 2026)
- Average DDoS Attack (Gbps): 10.27 Gbps (a 159.34% increase compared to February 2026)
- Median DDoS Attacks (Gbps): 0.37 Gbps (a 76.19% increase compared to February 2026)
- Average DDoS Attack (packets-per-second): 6,180.53 Kpps (a 306.09% increase compared to February 2026)
- Median DDoS Attack (packets –per second): 81.47 Kpps (a 221.51% increase compared to February 2026)
- Average Duration: 36.87 Minutes (a 73.51% increase compared to February 2026)
- Median Duration: 7.92 Minutes
- Unique vs Carpet Bombing: 90.99% Unique / 9.99% Carpet Bombing
- Top Three Industry Targeted: IT/Technical Services (48.34%), Financial Services (22.19%), Communication Service Providers (20.23%)
