Feedly suffers DDoS attack as perpetrator tries to extort money [Update: The attack has been neutralized]
Update from Feedly: “We're making some changes to our infrastructure that will allow us to bring Feedly back online. However, these things take some time to put into place …
Context & Ripple Effects
Feedly is one of the biggest winners of the Google Reader shutdown — more than 500,000 Reader users migrated over within two days of the announcement in March 2013 — so an outage now puts a much larger audience at stake than the RSS startup of old. The company says it is rebuilding parts of its infrastructure to bring the service back and has neutralized the attack.
The extortion angle follows a pattern already documented this year: in April, the New York Times reported that startups including Meetup, Basecamp, Vimeo, and Bit.ly were hit with DDoS attacks after ransom demands, and Krebs on Security reported in February on 200-400 Gbps attacks becoming the 'new normal' in scale. The pickup here is unusually wide — ZDNet, TechCrunch, Ars Technica, Gigaom and others all covered it within a day.
First-order effects
- Feedly's users lose access to their reading queue while the company re-architects infrastructure under pressure — an availability hit borne directly by customers who chose Feedly as their Reader replacement.
- The unidentified perpetrator gains nothing if the neutralization holds, but the attack demonstrates that even a mid-size startup can be held hostage by rented bandwidth far larger than its own.
Second-order effects
- Other consumer web startups now have to price DDoS mitigation into their baseline infrastructure rather than treating it as an incident response — the April ransom wave plus this attack makes 'will we be extorted?' a budget line, not a hypothetical.
- Mitigation providers and CDNs see demand rise from exactly this tier of company, shifting security spending from perimeters to scrubbing services.
Third-order effects
- If ransom-driven DDoS keeps paying, extortion becomes a standing tax on independent web services — pushing smaller players toward shared mitigation platforms or larger hosting, concentrating where consumer services run.
- Attack-for-hire capacity at the 200-400 Gbps scale reported in February means the constraint moves from attacker capability to victim resilience, making uptime guarantees a competitive differentiator for services like Feedly.
The trend: DDoS is maturing from vandalism into an organized extortion business aimed at consumer web startups, forcing every subscription service to treat attack resilience as core product infrastructure.