Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications.
Organizations using Threema On-Prem did not experience any issues because they rely on their own infrastructure.
In a post-mortem report on Friday, the end-to-end encrypted instant messaging service said that the attacks were difficult to defend against because the threat actor constantly changed patterns.
Threema is a paid messaging application developed by the Swiss technology company of the same name, with a heavy focus on security and privacy.
The service relies on its own server infrastructure in various locations in Switzerland and promises “no ads, no profiling, no hidden data analyses.”
On Tuesday around 6 PM UTC, users started to report service interruptions. The company responded about an hour later, saying that based on the information available at the time, the cause was “a network outage on our colocation partner’s side.”
“Now Threema network status saying ‘Connecting’ instead of ‘Connected,’ welp… 10mins later, now it’s back to saying ‘Connected,’ yet msgs are still very much not sending right away & very delayed,” one user complained.
About three hours later, Threema said it was working to restore all of its services after its partner reported that the network issue had been resolved.
The next day, users in Switzerland, India, and China continued to report that the service was down, despite Threema’s status page showing no problems.
However, the company confirmed that it was being targeted by a series of DDoS attacks it was working to mitigate, and warned users that intermittent outages were likely to occur.
Threema explains that the attacks made its service “temporarily unavailable or only partially available on Tuesday evening and Wednesday morning.”
Typically, DDoS attacks are mitigated without any noticeable impact due to effective defenses that adapt to the attack’s patterns, Threema said.
The attacks this week were large-scale, though, and targeted both Threema and its colocation partner, Nine.
“It is not entirely clear whether Threema was the primary target or whether the attacks were directed at multiple targets,” the company notes.
Defending against the attacks proved challenging because they persisted for an extended period, while the threat actor continually changed its tactics to circumvent mitigation measures.
An unrelated technical issue prevented the company from updating the current system status page, and the company decided to take it offline until the problem was fixed.
“Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers provided information on the current situation in response to inquiries.”
To avoid similar incidents, the Swiss company has implemented “specialized DDoS protection as an additional measure” to filter attack traffic upstream and reduce the load on its infrastructure.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
