GitHub hit with the largest ever DDoS attack of 1.35Tbps on Feb. 28; attacker abused publicly accessible memcached instances, taking the site down for 6+ mins
ON WEDNESDAY, AT about 12:15pm ET, 1.35 terabits per second of traffic hit the developer platform GitHub all at once.
Context & Ripple Effects
The record for volumetric DDoS had been climbing steadily before this hit: Arbor Networks counted a 400Gbps attack as the world's largest in early 2015, and Brian Krebs' site took a record 620Gbps sustained assault in late 2016. The Feb. 28 strike on GitHub more than doubles that figure in one shot, and the mechanism is new — not a botnet but thousands of publicly accessible memcached servers tricked into amplifying traffic toward the target.
That amplification technique is what makes this a turning point rather than just another record: anyone running an exposed memcached instance becomes an unwitting weapon, so attack size decouples from attacker resources. The trajectory holds — by mid-2025 Cloudflare was mitigating a 7.3Tbps attack, five times GitHub's record, in under a minute.
First-order effects
- GitHub's site went dark for over six minutes starting around 12:15pm ET, interrupting every developer, CI pipeline, and API client depending on the platform at that moment.
- Operators of the misconfigured memcached servers face immediate cleanup pressure, since each one is both a liability and a traceable participant in the attack.
Second-order effects
- Hosting providers and network operators get pushed to lock down or rate-limit open UDP services, because leaving them exposed now carries collective cost — the attack's power came from other people's infrastructure.
- Mitigation economics shift toward high-capacity scrubbing networks: GitHub absorbed the hit without a prolonged outage, validating the anycast-distribution model that firms like Cloudflare later scaled to multi-terabit events.
Third-order effects
- If the record curve from 400Gbps to 1.35Tbps to 7.3Tbps keeps its slope, volumetric DDoS becomes a commodity threat that only platforms with globally distributed absorption capacity can ride out — concentrating availability risk in a handful of mitigation providers.
- For GitHub specifically, the episode foreshadows a broader fragility: eight years later the platform still lost nearly eight hours to a capacity failure when peak traffic overwhelmed a single data-center component, showing that scale itself — attacked or not — is the standing availability problem.
The trend: Volumetric DDoS is scaling faster than defensive baselines, driven by abused third-party infrastructure, which pushes platform availability to depend on a few terabit-scale scrubbing networks.