DKDKCISSP
Cloud & Identity

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

A regulator has issued a formal reprimand against Cloudflare, without a fine attached.

DKCISSP News DeskThe Hacker News31 Oct 2026, 10:26 am1 min read
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Image courtesy of The Hacker News. Original report
DKCISSP REPORT

A regulator has issued a formal reprimand against Cloudflare, without a fine attached.

Any organization in the same sector or handling data the same way Cloudflare does is now looking at the same regulatory standard, not just Cloudflare.

The fine or reprimand here matters less for the amount than for what it confirms a regulator will actually act on -- every organization in the same position just got a preview of its own exposure.

Cloudflare has responded to the finding without a fine being imposed.

Review your own compliance posture against whatever standard this regulator just enforced, since this finding is the clearest signal yet of what actually gets acted on.

Don't assume a reprimand without a fine means low risk -- the finding of fault is what sets the precedent, not the dollar amount.

What happened

A regulator has issued a formal reprimand against Cloudflare, without a fine attached.

Who is affected

Any organization in the same sector or handling data the same way Cloudflare does is now looking at the same regulatory standard, not just Cloudflare.

Why it matters

The fine or reprimand here matters less for the amount than for what it confirms a regulator will actually act on -- every organization in the same position just got a preview of its own exposure.

Response

Cloudflare has responded to the finding without a fine being imposed.

What security teams should do

Review your own compliance posture against whatever standard this regulator just enforced, since this finding is the clearest signal yet of what actually gets acted on.

Don't assume a reprimand without a fine means low risk -- the finding of fault is what sets the precedent, not the dollar amount.

MORE IN CLOUD & IDENTITY

More cybersecurity reporting

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity DataThe Hacker News · 31 Oct 2026, 5:31 pmSS7 and Diameter Attacks: How Signaling Flaws Expose Your PhoneBleepingComputer · 30 Oct 2026, 7:30 pmGoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session DecryptionThe Hacker News · 27 Oct 2026, 7:29 pmUnpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other ServersThe Hacker News · 27 Oct 2026, 11:31 am