CYBERSECURITY | Telecoms, entertainment account for 45% of DDoS attacks in the Philippines
In a report released in October, StormWall said telecommunications accounted for 25% of recorded attacks, up 118% year over year, while entertainment accounted for 20%, with attacks increasing by 84%.
Telecommunications and entertainment companies accounted for 45% of distributed denial-of-service (DDoS) attacks recorded in the Philippines from January to August 2026, with telecoms experiencing the largest increase in attacks, according to cybersecurity firm StormWall.
In a report released in October, StormWall said telecommunications accounted for 25% of recorded attacks, up 118% year over year, while entertainment accounted for 20%, with attacks increasing by 84%.
Government agencies accounted for 15% of attacks, followed by finance at 13%, health care at 10%, retail at 9% and manufacturing at 8%. Attacks against financial institutions rose 63%, while retail experienced a 47% increase.
StormWall also reported that the average bandwidth of attacks targeting telecommunications companies grew fivefold over the period. More than 86% of the traffic consisted of transmission control protocol (TCP), user datagram protocol (UDP) and Internet Control Message Protocol (ICMP) floods, which can put direct pressure on network infrastructure.
The company said attack patterns were also changing. In August, application-layer attacks exceeding 100,000 requests per second were 3.7 times more frequent than the average in previous months. Meanwhile, the share of attacks lasting less than 15 minutes rose from 5% to 32.5%.
These shorter, high-intensity attacks can overwhelm application resources, database connections and computing capacity without generating exceptionally large volumes of network traffic, the report said.
“Attackers choose their tools based on the target. For a telecom operator or gaming platform, service availability is directly linked to revenue and customer experience, making these companies attractive targets for DDoS attacks,” said Ramil Khantimirov, StormWall CEO and co-founder.
He said organizations need to consider the speed, duration and type of traffic involved in attacks, rather than relying solely on network capacity when developing protection strategies.
StormWall also identified the Philippines as a significant source of attack traffic. The country ranked among the world’s top 15 sources of DDoS attack IP addresses in seven of the first eight months of 2026. In May, it ranked second globally, with about 2.03 million IP addresses recorded as sources of attacks. By August, the figure had dropped to about 220,000, placing the country 11th.
The company cautioned that the number of IP addresses does not directly represent the number of infected devices, since a single device can use multiple addresses. However, compromised routers, cameras, television set-top boxes and other internet-connected devices may be used to launch attacks without their owners’ knowledge.
StormWall’s findings also cited National Telecommunications Commission requirements introduced in 2025 covering internet traffic management and reporting by service providers.
