Threema, the Swiss secure messaging service, experienced significant communication disruptions this week due to a series of large-scale distributed denial-of-service (DDoS) attacks. The incidents, which began on Tuesday evening, August 13, 2026, caused intermittent outages for users of its cloud-based service, though customers utilizing Threema On-Prem deployments, which run on their own infrastructure, remained unaffected.
The company initially attributed the problems to a network issue at its colocation provider, Nine. However, Threema later confirmed that both its own infrastructure and that of its colocation partner were targeted by sophisticated DDoS attacks. These attacks were characterized by constantly changing methods, sources, and patterns, making mitigation efforts particularly challenging.
On Tuesday, the service was unavailable for approximately four hours, from 7:30 p.m. to 11:30 p.m. CEST. Intermittent disruptions continued into Wednesday morning, with users in various countries reporting issues even after Threema’s status page indicated service restoration. Normal operations were eventually restored at 12:23 p.m. CEST on Wednesday.
Threema communicated the service disruptions primarily through social media channels. Threema Work business customers received updates via email, and account managers provided information in response to inquiries. A technical issue unrelated to the attacks initially prevented the status page from being updated, leading to its temporary removal until the problem was resolved.
In response to the attacks, Threema implemented additional upstream DDoS protection on August 14, designed to filter malicious traffic before it reaches their infrastructure. The company also announced plans to enhance its status page in the coming days. These improvements will include an incident history and an RSS feed, offering users and administrators an independent channel for receiving system updates.
Threema is a paid messaging service known for its strong focus on privacy and security, positioning itself as an alternative to services like WhatsApp or Signal. The company apologized for the inconvenience caused by the prolonged disruptions.
