DDoS attacks in Europe surged 137% in the past year. Here’s what Greek and Cypriot organisations face — and how OpenText cybersecurity, delivered by LeanIT, stops the flood.

For years, many organisations treated Distributed Denial of Service (DDoS) attacks as an annoyance — a spike in traffic, a slow website, a problem for someone else. In 2026, that assumption is dangerous. DDoS has become an industrialised, often extortion-driven attack on business continuity itself, and it is no longer aimed only at banks and telecoms giants.

The threat in numbers

2,200 DDoS attacks every hour globally during Q1 2024 — an average of more than one attempt per second.

10,251 attacks against Greek networks in the first half of 2024 alone.

The largest single attack recorded: 303.53 Gbps — enough to overwhelm most unprotected internet links.

Average attack duration: just 20.5 minutes. Short, sharp bursts are designed to slip past slow detection and cause maximum disruption before a response begins.

Why 2026 is different

Three shifts have moved DDoS from IT nuisance to board-level risk. First, scale: botnets built from compromised IoT devices and rented “attack-for-hire” services make volumetric attacks cheap and repeatable. Second, targeting: attackers increasingly go after smaller organisations — professional services, distributors, e-commerce — precisely because they are less defended. Third, motive: attacks now arrive with extortion notes, or as cover for intrusion elsewhere in the network. A DDoS is often not the end goal; it is the distraction.

Regulation has raised the bar

In Europe, the NIS2 Directive — in force since November 2024 and transposed across member states — widened the scope of entities that must demonstrate cyber resilience, strengthen risk management and report significant incidents. In Greece, the National Cybersecurity Authority (NCSA) and Law 5086/2024 set out the national framework for compliance. In practical terms: resilience is no longer optional, and “we recovered quickly” is not the same as “we were prepared”. Organisations now need evidence — of protection, of detection, of tested recovery.

What effective protection looks like

Stopping a modern DDoS attack requires layers, not a single product:

Resilient architecture — capacity, redundancy and routing designed to absorb abnormal traffic without collapsing.

Threat intelligence and DNS-level protection — identifying malicious sources before they reach your services.

Continuous detection and response — SIEM-driven monitoring that correlates signals, spots anomalies early and triggers a rehearsed playbook.

Application-layer defence — because many attacks now mimic legitimate user behaviour; application security and web protection must work together.

Backup and recovery that is tested — mitigation buys time; recovery guarantees continuity. If systems do go down, RTO and RPO decide the business impact.

This is where OpenText cybersecurity capabilities — from threat intelligence and DNS protection to enterprise detection, application security and resilient backup — come together under one operational framework.

How LeanIT helps

As a Premier Partner of OpenText, SUSE and Rocket Software, LeanIT designs, implements and supports enterprise-scale cybersecurity for organisations in Greece and Cyprus. We start with your exposure and obligations — NIS2, Law 5086/2024, sector rules — then build protection that is proportionate, tested and documented. And because attacks do not respect business hours, our local teams provide the support and expertise to respond when it matters.

LeanIT is dedicated to providing enterprise-scale cybersecurity solutions with the utmost professionalism — safeguarding your business continuity.

Editor’s note: partner references updated — Rocket Software (which now owns Vertica) is part of LeanIT’s partner portfolio alongside OpenText and SUSE.

Sources: industry DDoS reporting 2024–2025; NIS2 Directive (EU) 2022/2555; Greek Law 5086/2024 and NCSA guidance. Figures reflect the data set used in LeanIT’s analysis — please confirm before publication if newer figures are preferred.