Case study · Retail & e-commerce

1.2 terabits per second hit at peak Black Friday. Shoppers never noticed.

At the busiest revenue minute of the year, a record-breaking distributed denial-of-service attack slammed a national retailer's storefront. S-Security absorbed every packet at the edge — checkout stayed up, carts kept converting, and not a dollar was lost.

Client: National retailer Industry: E-commerce Outcome: Zero downtime
0
Peak attack volume
0s
Storefront downtime
0
Revenue protected
0
Time to mitigation
The challenge

The one day downtime is unforgivable

For a national online retailer, Black Friday isn't a busy day — it's the day. A double-digit share of annual revenue can flow through the checkout in a single afternoon. Every minute of downtime during peak isn't just lost sales; it's abandoned carts, broken customer trust, and a story that lands on the evening news.

Attackers know this. DDoS extortion crews deliberately time their assaults to the moments when an outage hurts most — and then demand payment to make it stop. This retailer was hit with a multi-vector volumetric flood that peaked at 1.2 Tbps, combining UDP reflection, a SYN flood, and a Layer-7 HTTP request storm aimed squarely at the checkout API.

  • A 1.2 Tbps multi-vector flood — among the largest attacks of the year.
  • Layer-3/4 volumetric traffic designed to saturate upstream bandwidth.
  • A Layer-7 application flood crafted to exhaust checkout and search servers.
  • Precise timing — launched within minutes of the retailer's peak traffic hour.
Bandwidth alone can't win. No single data center can absorb 1.2 Tbps. Surviving a modern volumetric attack requires globally distributed scrubbing capacity that filters malicious traffic close to its source — long before it ever reaches the origin.
The approach

Filtered at the edge, before it ever reached the store

The retailer runs behind S-Security's always-on DDoS protection, with traffic routed through a global anycast scrubbing network and Layer-7 defenses tuned to its checkout flow.

Attack ramps

Inbound traffic to the storefront spiked from a normal baseline toward terabit scale in seconds, fanning in from a botnet of compromised devices across more than a hundred countries.

Auto-mitigation engages

Anycast routing pulled the flood into the nearest scrubbing centers worldwide. Volumetric filters dropped reflection and SYN traffic at the edge within three seconds — no human in the loop required.

Layer-7 defense adapts

As the attackers shifted to application-layer HTTP floods against checkout, behavioral rate-limiting and challenge logic separated real shoppers from bots while letting genuine purchases sail through.

SOC tracks the campaign

Our analysts watched the attack evolve in real time, tuning policies as vectors changed and keeping the retailer's on-call team continuously briefed — while the storefront stayed fully online.

Attack exhausted

After hours of failing to make a dent, the botnet traffic tapered off. Clean traffic continued uninterrupted the entire time. The retailer's team confirmed: not one customer complaint about availability.

The outcome

The biggest sales day of the year, fully protected

The headline number is the one that didn't change: revenue. The retailer finished Black Friday with record sales and zero availability incidents. The attack that was supposed to hold the business hostage was filtered out so cleanly that the marketing team didn't even know it had happened until the post-event security briefing.

  • Zero seconds of storefront downtime across the entire attack window.
  • 100% of revenue protected — every cart that wanted to convert, did.
  • No ransom, no negotiation — the extortion attempt simply failed.
  • Sub-second impact on real users — legitimate shoppers saw normal page-load times throughout.

After the event, S-Security delivered a full attack report and refined the retailer's Layer-7 baselines ahead of the holiday season, ensuring even larger floods would be a non-event. For a business where uptime equals revenue, that confidence is the whole product.

"We were under the largest attack of the year during the most important hour of the year — and our customers never felt a thing. S-Security turned a potential catastrophe into a footnote in a report. The board finally understands our risk posture, and renewal was the easiest decision we made all year."
Priya Nair
Priya NairCISO · National Retailer
How we did it

The services behind this outcome

DDoS Protection

Always-on, globally distributed scrubbing that absorbs terabit-scale floods at the edge.

Explore DDoS Protection

Managed Detection & Response

24/7 SOC analysts who track evolving attack campaigns and tune defenses in real time.

Explore MDR

Cloud & Workload Security

Resilient, autoscaling architecture and posture management for high-traffic e-commerce estates.

Explore Cloud Security
Is your storefront ready for peak?

Don't let a botnet decide your best sales day

Get a free resilience assessment and stress-test your edge before the holiday season. We'll show you exactly how your storefront holds up under a terabit-scale flood.

Request a Demo Talk to Sales