Zayo Data Reveals Average DDoS Attack Cost Businesses Nearly Half a Million in 2023

By Business Wire On Feb 16, 2024

New Zayo report analyzes trends in Distributed Denial of Service attacks from 2023, with new insights from the second half of the year

Zayo Group, a leading global communications infrastructure provider, released its bi-annual Distributed Denial of Service (DDoS) Insights Report, which found a significant increase in the intensity of DDoS attacks – and their impacts on businesses – in the second half of 2023. According to new Zayo data, the average DDoS attack lasted 68 minutes in 2023. With unprotected organizations shelling out an average of $6,000 per minute of each attack, that totals a startling $408,000 average cost to businesses for DDoS attacks.

“What we’re seeing is that cybercrime is only getting savvier”

A key driver to this enormous cost was the steep rise in the duration of DDoS attacks throughout the year. The average length of attacks surged by more than 400% from Q1 to Q4 of last year – from an average of 24 minutes to 121 minutes – signaling a worrying trend from both security and cost perspectives.

The astonishing volume of DDoS attacks in the first half of 2023 – up 200% from all of 2022 – seemed to have contracted in the second half of the year. Across all industries, comparing Q4 to Q1 2023, companies saw a 16% increase in attack activity. The outlook isn’t exactly rosy, however: volumetric attacks are being replaced by multi-vector attacks, spreading destruction more widely by targeting individual IP addresses, email systems, databases or web browsers – which are much harder to detect.

“What we’re seeing is that cybercrime is only getting savvier,” said Anna Claiborne, Senior VP of Network Connectivity at Zayo. “AI is presenting itself as a double-edged sword in this space. On one side of the blade, criminals are using AI to increase the sophistication of attacks and circumvent traditional defense mechanisms; on the other, mitigation platforms are using AI to dynamically identify and defend against new and emerging threats. As DDoS remains a profitable model for cybercriminals, attacks will continue to be a brutal inevitability for businesses. But luckily, DDoS protection is also rising to the occasion.”

Key Findings by Industry:

Telecommunications companies experienced the most frequent attacks, comprising about 40% of total attack volume with nearly 13,000 attacks in the second half of 2023.
Retail and healthcare companies experienced the largest attacks in the second half of the year, with an average attack size of 2.5 Gbps across companies in these two industries.
Government entities once again experienced the longest attacks with the average duration increasing from 4 hours in first half of 2023 to 18 hours in the second half of 2023. This represents a 322% increase from the first to the second half of the year and a 1,141% increase from the beginning to the end of the year.
Educational institutions accounted for 17% of all attacks last year, thanks in part to the ease and affordability of botnet-for-hire services combined with frequent gaps in the cybersecurity of the institutions.

Why it Matters:

DDoS attacks are here to stay – and cybercriminals are not discriminating over an organization’s size, industry or business model. These attacks cost organizations thousands of dollars per attack, not to mention reputational harm and customer churn – and many of the factors contributing to a vulnerable environment, such as increased digitization, political unrest and hybrid work, are not going away anytime soon.

The sheer sophistication of these attacks – which are meticulously planned to hit during a business’ busiest time of day and often utilize automation, like bots, to make it easier – makes it a crucial time for organizations to have advanced, forward-thinking DDoS protection. For every company, it is not a matter of if, but when.

“Most people on the internet aren’t plotting a DDoS attack, but the internet is a big place and Dark Web crime is the fastest growing business on Earth,” said Eric O’Neill, National Security Strategist at Carbon Black. “We’re in an attacker’s market and they are leveraging sophisticated technologies and cutting-edge techniques to innovate the way they deceive, disrupt and destroy our most critical data. To stop the attackers from gaining the upper hand, we need DDoS protection that is as easy and effective as turning on a switch.”

[To share your insights with us as part of editorial or sponsored content, please write to sghosh@martechseries.com]