Very many availability attacks have an extremely simple goal. They want to quickly block legitimate users' access to a given service. The attackers do not try at all to steal money or to encrypt valuable databases. In March 2026, these malicious actions hit Romania in a continuous wave. DNSC immediately warned both the public and private sectors about the situation. State institutions and ordinary companies fell victim to this huge wave. It all took place against a backdrop of strong geopolitical tensions in our region. The hackers wanted to demonstrate the vulnerability of our public communication systems. For a simple technical auditor, the identity of the hacker is not the main problem. The most important thing is to understand the risk your company is exposed to. This risk depends on the sector you operate in, not on the size of the company. The classic excuse "why would they attack us" no longer holds any validity. Anyone can easily become a purely collateral victim today.
What do the figures and official statements from 2026 show?
The head of DNSC spoke openly in an interview given to Digi24 television in March. He clearly described a wave of absolutely recurring and persistent attacks. The goal was to completely undermine citizens' trust in working platforms. People were supposed to believe that the state can no longer protect them digitally. The platforms belonging to the Ministry of Foreign Affairs suffered exactly the same harsh treatment in March. There is no fully public and official list of all the affected companies. We are talking about a genuine large-scale phenomenon, not a single isolated incident. In September 2026, the Government officially announced the reported figures on cyber incidents. More than 23,500 attacks have already been recorded since the beginning of the current year. By comparison, the whole of 2025 counted only 13,739 officially declared attacks. Although part of this reflects higher reporting by victims, the increase remains alarming. Any business is exposed when the online environment becomes so volatile and dangerous.
How does an ordinary company experience the arrival of such a cyber wave?
This phenomenon does not appear in isolation in the system, but follows a predictable pattern over time. The attacks first hit big targets and then spread to hosting providers. In the first week, numerous news stories suddenly appear about sites going down en masse. You read the information, but calmly assume it affects only other people. You are convinced your business is too small to attract attention. The second week brings strange problems on your company's web hosting server. Your site runs terribly slowly for several hours, although nobody can explain the cause. You do not connect the two completely separate events and carry on as normal. Only in the third week do your important customers call you in desperation. They complain vehemently that they cannot access your public information on the internet. Only then do you ask yourself the truly important question: "Are we victims too?". Unfortunately, absolutely nobody in the company analyses the logs left behind in the system afterwards. So the organisation's risk assessment remains unchanged and useless.
| Characteristics of ransomware attacks (targeted) | Characteristics of availability attacks (in waves) |
|---|---|
| The target is chosen precisely for what it holds. | The target is hit simply because it is easy to reach. |
| The negative impact stays locked inside the company. | The negative impact destroys visibility and public perception. |
| The probability depends on network mistakes. | The probability depends on context, web provider and sector. |
Where do risk assessments fail completely in everyday practice?
According to all modern regulations, including the NIS2 act recently approved in Romania, assessment is essential. This legislative act imposes clear measures on all entities considered to be of major importance. In very many Romanian companies, the probability of an attack is often calculated in a purely static way. A form signed two years ago states that you have an extremely low cyber risk. Obviously, absolutely nobody reviewed the document when the wars and the DDoS attacks appeared. The digital environment has changed, but your paperwork has remained stuck in the past. Also, website availability is not treated as a fully independent and valuable asset. Companies audit computers and physical servers, but forget about the continuity of their own virtual storefront. The most fatal mistake remains blind trust in your web provider. If it falls victim to a concentrated cyberattack, all its customers go down instantly with it. Most administrators have no idea whether the hosting offers shields capable of anti-DDoS protection. On top of all this, modern companies suffer from a serious lack of a reaction threshold. If the site is down for a whole hour, they never trigger any immediate alert.
What are the consequences of ignoring the new geopolitical context?
A massive cyberattack on national infrastructure always causes huge collateral damage. Tensions in the region attract extremely well-organised cybercrime groups. These groups use huge networks of infected computers to generate fake traffic. When this traffic hits Romania, it floods the country's main internet highways. Internet providers are forced to filter this information heavily in order to withstand the shock. In this chaotic process, your legitimate customers' traffic is suddenly thrown into the bin. You lose sales, you lose contracts and you completely destroy your public image in front of partners. If you do not understand that you are part of this fragile ecosystem, you will certainly suffer financial losses.
What can you do in practice during this week?
Take the old corporate risk assessment file and find the chapter reserved for the availability section. If that section dates from 2025 or much earlier, it must be replaced entirely today. Ask your maintenance provider clearly, in writing, about the existence of protective barriers against complex attacks. Find out from them exactly what happened to the other accounts in the spring of 2026. Create a fixed rule: "If the platform takes more than 10 seconds to load, report to the director". Subscribe free of charge to all the government technical alerts frequently sent through public channels. When the newspapers announce a new campaign, always analyse the logs, even if you do not feel anything is wrong. Do not wait for the hackers to warn you that you have become a sure victim. We quickly implement cybersecurity solutions perfectly adapted to any modern online scenario. These solutions are fully aligned with the new regulations in European and national legislation currently in force. Use the contact form and request the most reliable IT audit for companies today.