COMMENTARY: Distributed-Denial-of-Service (DDos) attacks keep setting records, but none of the biggest ones have targeted an election.
In November 2025,
Microsoft reported that Azure had mitigated a 15.72 terabit-per-second attack, the largest cloud
DDoS attack yet seen. That record did not last. A 31.4 terabit-per-second flood (tied to the same Aisuru botnet) was reported by
Cloudflare before the year was out.
[
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
These record-breaking attacks have set the tone for how the industry talks about DDoS risk everywhere, elections included. However, focusing on the attacks’ size may miss the key point.
Size was never the variable
Many assume that the next record-breaking attack will finally take an election system down. Fifteen years of DDoS attacks on elections argue otherwise. Trace the incidents that actually knocked something offline, and we’ll see that the size of the attack doesn’t matter.
Back in October 2011, an aide to a
South Korean lawmaker orchestrated an attack against the National Election Commission's website during a Seoul mayoral by-election, timed for the morning hours when younger voters, who leaned toward the opposition, typically checked their assigned polling locations before work. The attack ran on a handful of hijacked connections, unremarkable by any measure. It needed about two hours to do its job. Nobody had built the system to withstand that kind of pressure and by the time it came back online, the voters it targeted had started their workday. The aide was later convicted, and the lawmaker resigned.
Five years later, a different kind of warning arrived. On October 21, 2016, the
Mirai botnet took down Dyn, a DNS provider a large share of the internet depended on. Dozens of sites including X (then Twitter) and Reddit went dark for hours. Dyn was not election infrastructure, but with the vote three weeks away, security expert Stephen Gates told
Fox News a similar outage could hit voter registration systems and polling centers directly, saying that any “delays in reporting could seriously impact people's desire to vote and even worse, trust the results.” The attack was not the largest, yet it took down infrastructure nobody had validated would hold – and that’s exactly what made the warning land.
By 2018, the pattern reached campaigns with far smaller budgets than a DNS provider. Bryan Caforio's
California congressional campaign apparently lost its website to an attack that was unremarkable. Yet, it still disrupted fundraising because nothing about the campaign's infrastructure had been built or tested to expect it.
This pattern held outside the U.S., too.
North Macedonia's State Election Commission website went offline for three hours during vote counting in July 2020. Back in the U.S.,
Colorado and Kentucky lost state government sites to the pro-Russian group KillNet in the run-up to the 2022 midterms, after KillNet publicly listed a dozen states as targets. That same year, several state sites in
Mississippi went intermittently inaccessible on Election Day.
None of these attacks were remarkable in their sophistication. But each produced the same result: an online service people needed in that exact moment was not available.
Massive attack, minimal impact
Moldova's September 2025 parliamentary election stands as the closest thing to an exception, and it proves the same rule from the other direction. Attackers built a botnet from thousands of compromised home routers and directed more than 16 million attack sessions at the country's central election infrastructure. It was, by volume, the largest coordinated effort on this list. It also failed, because Moldova's systems had been hardened and tested against exactly this kind of scenario in advance.
Attackers going after election infrastructure are rarely trying to alter a result. Vote-counting systems are typically air-gapped, audited, and better defended than the public-facing sites around them.
The actual target is confidence. A donation page timing out, a results page stalling, or a state site that isn’t working well on Election Day may not change a single vote but it’s enough to make the process look unreliable. A small attack against an untested target may accomplish that more effectively than a large attack against a hardened target, and that’s exactly why size was never the variable that mattered.
What election security teams should check now
Fifteen years in, the industry still tends to focus on the record-breaking DDoS attacks. Ahead of the U.S. midterms, security teams should confirm, under realistic conditions, that the specific systems voters will rely on this cycle (registration lookups, polling place finders, results feeds, county sites) would hold against vectors most likely used against them and know when this was last checked.
History suggests that the ability to keep election systems online has less to do with the size of the DDoS attack a target faced. It’s actually got much more to do with whether anyone found out before an attacker did, and what a much smaller attack might do to disrupt an election.
Matthew Andriani, founder and CEO, MazeBoltSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
