Zayo: Average DDoS attack cost businesses nearly half a million dollars in 2023

DENVER, Colo., February 15, 2024  – Zayo Group, a leading global communications infrastructure provider, today released its bi-annual Distributed Denial of Service (DDoS) Insights Report, which found a significant increase in the intensity of DDoS attacks—and their impacts on businesses—in the second half of 2023.

According to new Zayo data, the average DDoS attack lasted 68 minutes in 2023. With unprotected organizations shelling out an average of $6,000 per minute of each attack, that totals a startling $408,000 average cost to businesses for DDoS attacks.

A key driver to this enormous cost was the steep rise in the duration of DDoS attacks throughout the year. The average length of attacks surged by more than 400% from Q1 to Q4 of last year — from an average of 24 minutes to 121 minutes — signaling a worrying trend from both security and cost perspectives.

The astonishing volume of DDoS attacks in the first half of 2023 – up 200% from all of 2022 – seemed to have contracted  in the second half of the year. Across all industries, comparing Q4 to Q1 2023, companies saw a 16% increase in attack activity.

The outlook isn’t exactly rosy, however: volumetric attacks are being replaced by multi-vector attacks, spreading destruction more widely by targeting individual IP addresses, email systems, databases or web browsers – which are much harder to detect.

"What we’re seeing is that cybercrime is only getting savvier,” said Anna Claiborne, Senior VP of Network Connectivity at Zayo. “AI is presenting itself as a double-edged sword in this space. On one side of the blade, criminals are using AI to increase the sophistication of attacks and circumvent traditional defense mechanisms; on the other, mitigation platforms are using AI to dynamically identify and defend against new and emerging threats. As DDoS remains a profitable model for cybercriminals, attacks will continue to be a brutal inevitability for businesses. But luckily, DDoS protection is also rising to the occasion."

Key Findings by Industry:

• Telecommunications companies experienced the most frequent attacks, comprising about 40% of total attack volume with nearly 13,000 attacks in the second half of 2023.
• Retail and healthcare companies experienced the largest attacks in the second half of the year, with an average attack size of 2.5 Gbps across companies in these two industries.
• Government entities once again experienced the longest attacks with the average duration increasing from 4 hours in first half of 2023 to 18 hours in the second half of 2023. This represents a 322% increase from the first to the second half of the year and a 1,141% increase from the beginning to the end of the year.
• Educational institutions accounted for 17% of all attacks last year, thanks in part to the ease and affordability of botnet-for-hire services combined with frequent gaps in the cybersecurity of the institutions.

Why it Matters:

DDoS attacks are here to stay – and cybercriminals are not discriminating over an organization’s size, industry or business model. These attacks cost organizations thousands of dollars per attack, not to mention reputational harm and customer churn – and many of the factors contributing to a vulnerable environment, such as increased digitization, political unrest and hybrid work, are not going away anytime soon.

The sheer sophistication of these attacks – which are meticulously planned to hit during a business’ busiest time of day and often utilize automation, like bots, to make it easier – makes it a crucial time for organizations to have advanced, forward-thinking DDoS protection. For every company, it is not a matter of if, but when.

“Most people on the internet aren’t plotting a DDoS attack, but the internet is a big place and Dark Web crime is the fastest growing business on earth,” said Eric O’Neill, National Security Strategist at Carbon Black. “We’re in an attacker’s market and they are leveraging sophisticated technologies and cutting-edge techniques to innovate the way they deceive, disrupt and destroy our most critical data. To stop the attackers from gaining the upper hand, we need DDoS protection that is as easy and effective as turning on a switch.”

To view the full report and learn more about how Zayo can help protect your business from cyber attacks, visit https://www.zayo.com/resources/ddos-insights-report-2023-review/.

Methodology

This report analyzed more than 103,000 threat detections and mitigations experienced by Zayo customers in 2023. The data, spanning 14 industries and regions across North America and Western Europe, covers the period from January 1 to December 31, 2023. Notably, 72,000 of these attacks occurred in the first half of 2023, and 31,000 occurred in the second half.