Threema, the Swiss-based secure messaging service, experienced significant disruptions earlier this week due to a series of large-scale distributed denial-of-service (DDoS) attacks. The incidents, which began on Tuesday evening, August 13, 2026, and continued into Wednesday morning, affected the availability of the end-to-end encrypted platform for many users.
The company confirmed that the attacks were challenging to defend against due to the threat actor's persistent efforts to change attack patterns and circumvent mitigation measures. These attacks targeted both Threema's infrastructure and that of its colocation partner, Nine. It remains unclear whether Threema was the primary target or if the attacks were part of a broader campaign against multiple entities.
Initial reports from users on Tuesday around 6 PM UTC indicated service interruptions, with some noting their Threema status showing "Connecting" instead of "Connected" and messages experiencing significant delays. Approximately an hour later, Threema attributed the issue to a network outage at its colocation partner. By about 9 PM UTC, the company stated it was working to restore services after the partner reported the network issue resolved.
However, on Wednesday, users in Switzerland, India, and China continued to report service outages, despite Threema's status page initially showing no problems. The company later confirmed it was under DDoS attack and warned of intermittent outages. Threema acknowledged that the attacks rendered its service temporarily unavailable or only partially available during the affected period.
Organizations utilizing Threema On-Prem, which operates on their own infrastructure, were unaffected by the disruptions. Business customers using Threema Work were notified via email on Wednesday morning about the unstable service conditions, and account managers provided updates in response to inquiries.
A separate technical issue also prevented Threema from updating its system status page, leading the company to take it offline until the problem was resolved.
In response to the incident, Threema has implemented specialized DDoS protection as an additional measure. This new defense is designed to filter attack traffic upstream, thereby reducing the load on its core infrastructure and preventing similar disruptions in the future.
