DDoS Attacks Silence Threema, Exposing Availability Gaps in Centralized Privacy Apps

The secure messaging service Threema suffered severe service disruptions in August 2026 following a series of large-scale distributed denial-of-service (DDoS) attacks. The incident underscores a persistent tension in secure communications: the trade-off between strict metadata privacy and system availability.

On Tuesday, August 11, the messenger became completely unreachable for four hours, from 7:30 p.m. to 11:30 p.m. CEST. The onslaught targeted both Threema’s own infrastructure and Nine, the Swiss colocation provider that supplies the service's server capacity. The scale of the attack was sufficient to knock the service's official status page offline, leaving users without real-time updates during the peak of the outage. While intermittent dropouts continued into Wednesday morning, Threema reported that normal operations finally resumed at 12:23 p.m. that day.

The Architecture of Privacy

Threema is a paid, Swiss-based application distinguished by its high privacy standards, notably its ability to function without requiring a phone number or email address. To minimize the exposure of metadata, Threema utilizes a centralized architecture. Unlike federated systems, where messages move across a network of independent servers, Threema’s hosted infrastructure relies on a primary data center. This design choice enhances confidentiality but creates a single point of failure; if the central hub is overwhelmed or disabled, the entire network for hosted users goes dark.

The Availability Gap

This outage highlights a critical vulnerability for centralized secure messengers. While Threema’s encryption ensures that the content of messages remains confidential, it cannot prevent an availability attack. The incident demonstrates that an adversary does not need to break sophisticated encryption to silence a secure channel; they only need to generate enough traffic to exhaust the target's capacity.

Threema confirmed that the incident affected service availability only, stating that no user data or system security was compromised. Notably, Threema OnPrem customers—organizations that host their own infrastructure—remained unaffected by the attacks, as their traffic did not flow through the targeted Swiss colocation provider.

The Defensive Struggle

The battle to restore service was described by Threema in a blog post as a "cat-and-mouse game," where both the attackers and the defenders continuously reacted to the other’s most recent actions. The company noted that attackers with state-level resources can often shift their methods faster than defenses can adapt.

Moving forward, the industry must grapple with how to maintain the metadata protections of centralized systems while building resilience against high-volume traffic attacks. For now, the Threema outage serves as a reminder that for secure communication to be effective, it must be both private and reachable.