Qrator Labs: Cyprus Bank Hit by 200-Hour DDoS Attack in Third Quarter of 2026

Nicosia, Cyprus. A distributed denial-of-service (DDoS) attack on a bank in Cyprus continued for 200 hours in the third quarter of 2026, according to the cybersecurity company Qrator Labs. The case underlines the risks that prolonged cyberattacks pose to financial institutions and the need to keep critical digital services running during sustained disruption.

Duration of the attack

The incident went on for over eight days. That is far longer than any attack the company logged in 2025, and more than 2.5 times the length of the longest one seen in the preceding quarter.

Related: Bank of Cyprus Expected to Post €119 Million Third-Quarter Profit, Alpha Finance-AXIA Says

RelatedBank of Cyprus Expected to Post €119 Million Third-Quarter Profit, Alpha Finance-AXIA Says

Most targeted sectors

Qrator Labs’ latest global report shows that financial technology (fintech) was again the sector hit most often, with 31.3 per cent of all DDoS attacks recorded in the third quarter. E-commerce took 19 per cent of attacks and information and communication technology 18.2 per cent. Together, these three sectors made up over two-thirds of the observed incidents.

Relevance for Cyprus

The findings carry particular weight for Cyprus, which has built a position as a centre for online trading, brokerage and financial services. Firms there are increasingly expected to show that their systems can withstand serious cyber incidents and recover effectively.

Regulatory focus on resilience

The report appears as regulators pay closer attention to operational resilience and to compliance with the European Union’s Digital Operational Resilience Act (DORA), which obliges financial firms to manage risks linked to information and communication technology.

At the 6th Cyber Security Conference in September 2026, Christos Meletiou of the Central Bank of Cyprus said financial institutions must do more than formally comply with DORA. He stressed that they must show their security and recovery arrangements function in practice.

In the same month, the Cyprus Securities and Exchange Commission (CySEC) brought in new DORA reporting requirements. Investment firms, crypto-asset service providers, trading venues and other regulated financial entities that suffer major information and communication technology incidents must now calculate and report the annual costs and losses that result.

Under the rules, affected firms have to quantify the financial impact of serious disruptions and send their findings to the regulator. This adds to the pressure on institutions to grasp the consequences of incidents and keep effective response arrangements in place.

Growing scale of attacks

DDoS attacks are also becoming larger. Qrator Labs reported that the biggest botnet it observed in the third quarter comprised 3.56 million devices, an increase of around 70 per cent from 2.09 million in the second quarter.