Seravo Status

Postmortem: ## DDoS attack at FI-Haarla

On Tuesday, October 6, 2026, Seravo's server cluster FI-Haarla became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users.

The attack started at 9:00 (UTC+3). During the attack most of the websites hosted in FI-Haarla experienced degraded service, but there was no other security threat to the sites. Visitors saw connection timeouts or HTTP502 errors when trying to visit the sites. The affected parties and relevant authorities have been informed, and no customer action is required.

As part of our response, we encountered difficulties deploying the tools needed to mitigate the attack. We’ll review and improve our process to help prevent similar issues in future incidents.

The attack ended at approximately 10:47, after which we continued to monitor the situation. The incident was marked as resolved on our end at 12:49.

We apologize for the inconvenience caused by this attack.

Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example.

Timeline (UTC+3)

• 09:00 DDoS starts
• 09:02 DDoS detected, response initiated
• 09:10 Blocks implemented
• 09:31 More actions taken to mitigate the attack traffic
• 10:00 Issue encountered in tooling, fixes implemented
• 10:26 Tooling proves not to have the desired effect
• 10:33 Further action to mitigate the attack
• 10:47 Traffic suppressed, sites start recovering from DDoS

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are currently investigating this issue.