Multiple large-scale DDoS attacks targeted the Threema secure messaging service and its colocation partner, causing service disruptions primarily on Tuesday evening and Wednesday morning. The attacks were difficult to mitigate due to the threat actor's constant changes in attack patterns and persistence over an extended period. Threema On-Prem customers were not affected as they use their own infrastructure. The company confirmed the attacks and implemented additional specialized DDoS protection measures upstream to better filter malicious traffic. The attacks caused temporary unavailability or partial availability of the service. An unrelated technical issue delayed status updates on the service status page. It remains unclear if Threema was the primary target or one of multiple targets.

The DDoS attacks caused severe disruptions to Threema's messaging service, resulting in temporary or partial unavailability and delayed message delivery for users. Organizations using Threema On-Prem were unaffected. The attacks impacted users in multiple countries including Switzerland, India, and China. The service's availability was intermittently degraded for several hours, affecting communication reliability. No data breach or compromise of message confidentiality was reported. The attacks targeted network availability rather than the security of the messaging platform itself.

Threema has implemented specialized DDoS protection upstream to filter attack traffic and reduce load on its infrastructure. Organizations using Threema On-Prem were not affected as they rely on their own infrastructure. Users and customers should monitor official communications for updates. No further specific mitigation actions are indicated by the vendor at this time.