A DDoS attack (Distributed Denial of Service) is a digital traffic jam launched on purpose: thousands or millions of infected devices — a botnet — flood a website or online service with more requests than it can handle until it slows to a crawl or crashes completely. Nobody breaks in and nothing is stolen; the goal is purely to take you offline, and it is the one attack where the damage happens entirely in public, in front of your customers.
TL;DR
- A DDoS attack floods your servers with junk traffic from a botnet until legitimate customers cannot get through.
- The attack travels over the internet and needs no one at your company to click anything — though staff response in the first hour shapes the outcome.
- Modern DDoS protection services (Cloudflare, AWS Shield, Akamai) absorb floods before they reach your infrastructure.
- Attackers use DDoS to extort, distract, or compete — online retail and professional services are the most targeted sectors.
- Cyber Aware training turns staff into the response layer: recognising symptoms, reporting fast, and not switching off security during a crisis.
What is a DDoS attack?
A normal website request comes from a customer; a DDoS flood comes from thousands of hijacked machines. The attacker has pre-infected a botnet — home routers, IoT gadgets, hacked servers — and commands them all to hammer one target simultaneously. The target's bandwidth, memory or application capacity exhausts, and real visitors get timeouts or error pages.
The D in DDoS is the crucial part: the flood comes from many sources at once, so blocking one address does nothing. The architecture is why this attack class defeats simple firewalls and why dedicated filtering services exist.
Types of DDoS attacks
- Volumetric attacks saturate raw bandwidth — UDP floods, amplification attacks that multiply small requests into huge response traffic.
- Protocol attacks exhaust connection tables and load balancers — SYN floods, Ping of Death, Smurf attacks.
- Application-layer attacks target the software itself: HTTP floods, slow HTTP attacks that hold connections open. These are hardest to detect because the traffic looks legitimate — each request is normal; the sheer volume of them is not.
Volumetric attacks are the loudest and easiest to filter. Application-layer attacks are the stealthiest and the reason layered defence matters in 2026.
Why attackers run DDoS attacks
- Extortion. "Pay us or your website stays down" — the direct extortion model, often aimed at e-commerce before a peak season.
- Distraction. A loud DDoS pulls IT attention while a quieter intrusion — credential theft, payment fraud — happens elsewhere in the network. This combination is the most dangerous for small businesses.
- Competition and rivalry. Some floods target a rival's online storefront during a product launch or a busy trading day.
- Hacktivism and state actors. Ideological or geopolitical targets get flooded for political statements.
The distraction motive is worth naming for Australian businesses: the 2024-25 ASD threat report logged more than 84,700 cybercrime reports — one every six minutes — and small businesses self-reported an average cost of $56,600 per incident (ASD Annual Cyber Threat Report 2024-25). A flood that distracts your team while an intruder steals payment records is exactly the scenario where training pays for itself.
Signs you are under DDoS attack
- Website or app suddenly unreachable, or pages loading at dial-up speed.
- Timeouts, 503 errors, or connection refused messages from your hosting provider.
- Traffic graphs spiking far beyond normal peaks with no marketing campaign behind it.
- Unusual traffic source countries, or the same request pattern repeated thousands of times per second.
None of these alone proves a DDoS — a viral marketing moment can also spike traffic — but the error pattern and the request fingerprint usually give it away quickly.
How to stop DDoS attacks
- Put a DDoS protection service in front of your site (Cloudflare, AWS Shield, Akamai, Imperva). These platforms absorb floods at the network edge before they reach your servers — the single most effective control.
- Enable rate limiting and geo-blocking where your hosting supports them, to throttle suspicious request patterns.
- Keep a baseline of normal traffic so a flood is recognised in minutes, not hours.
- Separate critical infrastructure so a flooded website does not take down email, payment processing or internal systems.
- Have an incident response contact at your hosting or ISP, saved before an attack, not discovered during one.
- Train staff on the first-hour playbook — because during a flood, panic and improvised changes cause most of the avoidable damage.
The role of staff training in DDoS resilience
Technical controls absorb the flood; people decide how the business behaves around it. Three habits matter:
- Report early. A staff member who notices "the site is down for customers but fine on our internal network" and reports it saves response time.
- Do not disable security "to let traffic through" during an outage — the classic mistake that turns a DDoS into an actual breach.
- Watch for the distraction attack. While IT fights the flood, everyone else should stay alert to the quieter lures — "urgent invoice", "your site is compromised, click here" — that arrive alongside a real DDoS.
Cyber Aware's security awareness training covers these habits in monthly modules and pairs them with phishing simulations, so when a real incident lands, the reflexes are already there. A cyber security gap assessment shows whether DDoS protection, monitoring and response plans are actually in place before you need them.
FAQ
What is a DDoS attack in simple terms? Thousands of hijacked computers flood a website with traffic until real customers cannot get through. Nothing is stolen — the goal is purely to take the service offline.
How is a DDoS different from a DoS attack? DoS comes from one source and can be blocked at the firewall. DDoS (Distributed) comes from thousands of sources at once, which is why simple blocking fails and specialised filtering services exist.
What is a botnet? A network of infected devices — routers, cameras, laptops, servers — that an attacker controls remotely and can command as one. Botnets are the delivery mechanism for most DDoS floods.
Can a DDoS attack steal data? Not directly — the attack exhausts capacity rather than breaking in. The real risk is the distraction pattern: while IT responds to the flood, a separate intrusion can run unnoticed elsewhere.
How much does DDoS protection cost? Free tiers from Cloudflare and similar providers cover most small business needs; larger dedicated protection scales with traffic. For an Australian SMB, the entry-level protection is a rounding error next to the average $56,600 cost of a single cybercrime incident.
What should I do in the first ten minutes of a suspected DDoS? Do not change firewall rules or disable security. Contact your hosting provider or DDoS protection service, capture screenshots of the traffic patterns, and keep the rest of the business on normal security discipline.
One last thing
If your business runs any customer-facing online service, spend one hour this week confirming two things: that DDoS filtering is enabled at your edge, and that your team knows who to call at your hosting provider the moment the site goes down. Both are free. Both are what separate a bad afternoon from a lost trading week in 2026.
Related guides
- What is a botnet? — the hijacked-device networks that launch most floods.
- Human risk reporting — measure who reports incidents and who clicks, month by month.