Availability issues in cluster fi-haarla

Update timeline

1. investigating Oct 06, 2026, 06:11 AM UTC

   We are currently investigating this issue.

2. monitoring Oct 06, 2026, 07:47 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Oct 06, 2026, 09:49 AM UTC

   This incident has been resolved.

4. postmortem Oct 07, 2026, 12:11 PM UTC

   ## DDoS attack at FI-Haarla On Tuesday, October 6, 2026, Seravo's server cluster FI-Haarla became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users. The attack started at 9:00 \(UTC\+3\). During the attack most of the websites hosted in FI-Haarla experienced degraded service, but there was no other security threat to the sites. Visitors saw connection timeouts or HTTP502 errors when trying to visit the sites. The affected parties and relevant authorities have been informed, and no customer action is required. As part of our response, we encountered difficulties deploying the tools needed to mitigate the attack. We’ll review and improve our process to help prevent similar issues in future incidents. The attack ended at approximately 10:47, after which we continued to monitor the situation. The incident was marked as resolved on our end at 12:49. We apologize for the inconvenience caused by this attack. Seravo provides real-time updates on all disruptions at [status.seravo.com](http://status.seravo.com). We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 09:00 DDoS starts * 09:02 DDoS detected, response initiated * 09:10 Blocks implemented * 09:31 More actions taken to mitigate the attack traffic * 10:00 Issue encountered in tooling, fixes implemented * 10:26 Tooling proves not to have the desired effect * 10:33 Further action to mitigate the attack * 10:47 Traffic suppressed, sites start recovering from DDoS