Telecommunications companies accounted for one-quarter of distributed denial-of-service (DDoS) attacks recorded in the Philippines from January to August 2026, with incidents targeting the sector increasing by 118 percent year over year, according to cybersecurity firm StormWall.
Telecommunications and entertainment together represented 45 percent of all recorded attacks during the eight-month period, highlighting the exposure of industries whose operations depend heavily on the availability of online services.
StormWall’s analysis found that telecommunications was the most targeted sector, accounting for 25 percent of attacks. Entertainment followed at 20 percent, with attacks in the sector rising by 84 percent compared with the same period in 2025.
Government agencies accounted for 15 percent of attacks, followed by financial services at 13 percent, health care at 10 percent, retail at 9 percent and manufacturing at 8 percent.
The findings point to growing risks for telecommunications operators, whose service disruptions can affect not only their own operations but also subscribers, businesses and digital platforms that rely on their networks.
Attacks on telecom infrastructure intensify
StormWall reported that the average bandwidth of attacks targeting telecommunications companies grew fivefold over the period, while more than 86 percent of attack traffic consisted of transmission control protocol (TCP), user datagram protocol (UDP) and Internet Control Message Protocol (ICMP) floods.
These techniques overwhelm network resources with traffic, potentially degrading connectivity or making services unavailable. The figures suggest that attackers are placing increasing pressure on network infrastructure rather than focusing exclusively on individual applications, the company said.
The findings come as the National Telecommunications Commission continues to oversee network service quality and reporting requirements. StormWall cited requirements introduced by the regulator in 2025 covering internet traffic management and reporting by service providers.
Financial services also experienced a substantial increase in attacks, with incidents rising by 63 percent year over year. Retail attacks increased by 47 percent, while government-targeted attacks rose by 28 percent.
Health care recorded an 8 percent increase, and manufacturing attacks grew by 31 percent.
Shorter attacks deliver heavier loads
StormWall also identified a change in attack patterns. In August, the number of application-layer attacks exceeding 100,000 requests per second was 3.7 times the average recorded in previous months.
At the same time, the proportion of attacks lasting less than 15 minutes rose from 5 percent to 32.5 percent.
Application-layer attacks target the resources that process requests for websites, application programming interfaces and other online services. Even without generating exceptionally high volumes of network traffic, these attacks can exhaust computing resources, database connections and application capacity.
The shift toward shorter, more intense attacks means organizations cannot assess resilience solely by the capacity of their internet connections, StormWall said. Security measures must also account for the duration, intensity and type of traffic involved.
“Attackers choose their tools based on the target. For a telecom operator or gaming platform, service availability is directly linked to revenue and customer experience, making these companies attractive targets for DDoS attacks,” said Ramil Khantimirov, StormWall chief executive officer and co-founder.
“At the same time, attack patterns are changing: attacks are becoming shorter and more intense. Organizations therefore need to consider not only traffic volume, but also the speed, duration, and type of traffic load when building their protection strategies,” he added.
Philippines also emerges as a source of attack traffic
The report also identified the Philippines as a significant source of IP addresses associated with DDoS attacks worldwide.
The country ranked among the world’s top 15 sources of attack traffic in seven of the first eight months of 2026. In May, StormWall recorded approximately 2.03 million IP addresses associated with attacks originating from the Philippines, placing the country second globally.
By August, the figure had fallen to about 220,000, moving the Philippines to 11th place.
StormWall cautioned that the number of IP addresses should not be equated directly with the number of infected devices. Network address translation, dynamic addressing and mobile network configurations can allow a single device to use multiple IP addresses.
Nevertheless, the company said compromised routers, security cameras, television set-top boxes and other internet-connected devices could be used to launch attacks against organizations worldwide without their owners’ knowledge.
The figures are based on StormWall’s own monitoring and analysis. The data underscores the dual challenge for Philippine telecommunications providers: defending their networks against attacks while helping address compromised devices that may contribute to attacks originating from the country.
