Largest online DDoS service vDOS hacked, with details of customers and targets revealed; service earned $600K+ for 150K+ DDoS attacks over past two years
vDOS — a “booter” service that has earned in excess of $600,000 over the past two years helping customers coordinate more than 150,000 …
Context & Ripple Effects
vDOS sits at the commercial end of a booter market that had already been normalized by Lizard Squad selling attacks from $6 to $500 in 2014 — subscription-priced DDoS with customer support. What changed with this breach is that the service's own ledgers are now public: over $600K in earnings, 150K+ attacks, and named customers and targets.
The leak matters because it converts an anonymous marketplace into evidence. It also lands on Brian Krebs' desk at a moment when his own site would soon absorb a record 620Gbps sustained attack, underscoring how personal the booter economy's antagonisms run.
First-order effects
- vDOS customers who paid for attack subscriptions are now identifiable from leaked records, facing exposure to victims, researchers, and eventually law enforcement.
- Organizations listed as targets gain concrete attribution data for attacks they previously experienced as anonymous traffic floods.
Second-order effects
- Rival booter operators must reckon with the same vulnerability class — a hacked stressor service leaking its user base becomes the template, and the pattern culminates in the WebStresser shutdown with its 136K users exposed to police.
- Law enforcement gains a proven playbook: purchase records plus target lists turn bulk takedowns into routine work, later scaled up when the DOJ seized 48 booter sites and charged six operators.
Third-order effects
- If leaks keep converting booter customer lists into prosecutions, DDoS-for-hire retreats from open web storefronts into invite-only underground channels, raising acquisition costs for buyers.
- As cheap rented firepower persists regardless, the defensive side industrializes — the arms race visible in Cloudflare absorbing hyper-volumetric attacks past 71M rps becomes the durable market response.
The trend: DDoS-for-hire is being squeezed out of the open market by a leak-and-prosecute cycle, pushing attack capacity underground while mitigation vendors scale to meet ever-larger residual floods.