On June 10, 2025, Akamai Technologies, Inc. (NASDAQ: AKAM) and the Financial Services Information Sharing and Analysis Center (FS-ISAC) unveiled a significant annual report detailing the alarming rise in distributed denial-of-service (DDoS) attacks targeting the global financial sector. The report, titled "From Nuisance to Strategic Threat: DDoS Attacks Against the Financial Sector," outlines the increasing sophistication and frequency of these cyber threats, highlighting their profound impact on customer trust, operational integrity, and profitability within financial services.

2. Key Findings and Trends

The report reveals that the financial services sector was the leading target for volumetric DDoS attacks in 2024, with a notable increase in attacks directed at application programming interfaces (APIs) and customer-facing websites. These attacks are characterized by their ability to mimic legitimate user behavior, making them particularly challenging to detect and mitigate.

Escalating Threat Landscape

Some of the critical findings from the report include:

Increased Frequency of Attacks: DDoS attacks against the financial sector have surged disproportionately compared to other industries. A significant spike in attacks was noted in October 2024, marking a trend of intensifying threats.

Adaptation by Cybercriminals: Criminals are leveraging higher bandwidths and more advanced computational resources, which allows for more adaptable and powerful DDoS campaigns at lower costs.

Application-layer Attacks: There has been a 23% increase in application-layer DDoS attacks against the financial sector from 2023 to 2024, driven by the expanding threat surface due to the adoption of APIs.

Emergence of DDoS-for-Hire Services: The report highlights the prevalence of DDoS-for-hire services that obscure the identities and motives of attackers, complicating mitigation efforts.

Geopolitical Influences: Ongoing geopolitical conflicts, particularly the tensions surrounding the Israel-Hamas and Russia-Ukraine situations, have catalyzed a rise in hacktivism, contributing to the surge of DDoS attacks.

Regional Insights

The report also provides a regional breakdown of DDoS activity, noting that the Asia-Pacific region experienced a dramatic increase, accounting for 38% of all volumetric DDoS attacks—up from just 11% in 2023.

3. The DDoS Maturity Model

To assist financial institutions in evaluating their defenses against DDoS attacks, Akamai and FS-ISAC developed a comprehensive five-level DDoS Maturity Model. This model outlines key characteristics, defensive capabilities, and associated risks, enabling financial firms to identify areas for improvement, prioritize investments, and enhance their overall resilience against cyber threats.

4. Expert Insights

Teresa Walsh, Chief Intelligence Officer and Managing Director for EMEA at FS-ISAC, emphasized the evolving nature of DDoS attacks, stating, "DDoS attacks are becoming increasingly sophisticated, evolving from simple network flooding to targeted, multidimensional assaults that exploit intricate vulnerabilities across the entire supply chain." She underscored the necessity for financial institutions to strengthen their infrastructure and foster a culture of vigilance and collaboration.

Steve Winterfeld, Advisory CISO of Akamai, echoed these sentiments, stating, "Threat actors will continue to leverage DDoS attacks to exploit the security of our institutions." He highlighted the importance of implementing robust mitigation strategies and adhering to fundamental cyber hygiene practices to defend against these evolving threats.

5. Conclusion

The joint report by Akamai and FS-ISAC serves as a vital resource for financial institutions navigating a perilous cyber landscape. With DDoS attacks escalating in frequency and complexity, it is imperative for firms to adopt advanced defensive strategies and foster a culture of continuous improvement in cybersecurity practices. The findings provide a clarion call for the financial sector to remain vigilant and proactive in its defense against these persistent threats.

Original press release