Bluesky said a recent disruption to its service was caused by a Distributed Denial of Service attack (DDoS attack). The social media platform said attackers flooded its systems with a huge amount of unwanted traffic, making it difficult for normal users to access the service.
The Bluesky users experienced problems and lost access to the platform. The company said its engineers worked to fight this attack and re-establish normal service.
A DDoS attack doesn’t mean hackers have stolen user information. Instead, attackers send an unusually large number of requests to a website or online service. That’s to overload the system so that genuine users struggle to access it.
It’s similar to thousands of people calling an individual phone number at the same time. The line gets so busy that the genuine callers cannot get through.
What happened to Bluesky?
Bluesky said its team had intermittent outages at about 11:40 pm Pacific time on April 15. Engineers then worked through the night after finding a sophisticated DDoS attack that became more intense during the following day.
Users reported problems with some parts of the platform. Some of them had feed interruptions, notifications, threads and search were interrupted, for example.
The attack lasted for about 24 hours, the reports said. Some users were able to access Bluesky but others were error-prone or unable to use Bluesky normally.
Bluesky said it had not been able to find any evidence that the attack provided anyone unauthorized access to private user information. This distinction matters because a DDoS attack primarily targets the availability of a service instead of directly trying to steal data.
The incident seems to have been focused on disrupting access to Bluesky.
But it is now a favorite alternative to larger social networks and users are looking for an alternative to X. Bluesky was first launched by Twitter in 2019 as a project and later developed as a firm. The former CEO of Twitter Jack Dorsey was behind the project and was a supporter and funding for its development. He left Bluesky’s board in 2024.
Because of this history, Bluesky is sometimes called an X rival of Dorsey even though he no longer runs the platform.
The latest attack shows the security problems social media companies face as they grow; their platforms are rapidly growing.
DDoS attacks can be huge
DDoS attacks are carried out by sending a high amount of traffic to a target. The attackers typically use many devices or systems to generate the traffic at the same time.
The website or service has to deal with a huge number of requests. If the volume becomes too large, the servers and network infrastructure can struggle to respond to legitimate users.
That is why users can see a website slow, fail to load or stop working completely during a huge DDoS attack.
In such attacks social media platforms and gaming services can be affected, as well as banks, government websites and online businesses.
For Bluesky, the attack affected some of the platform’s core functions. Users rely on feeds to see posts, notifications to follow activity and search for accounts and content. Interruptions to these features make the whole platform difficult to use.
Bluesky's engineers had to identify the unusual traffic, separate it from legitimate users and put measures in place to alleviate the impact.
The platform has had other outages in the past but this one was more notable because the company directly tied the disruption to a DDoS attack.
Moreover, the identity of the attackers has not been confirmed by Bluesky. Some groups have claimed responsibility for attacks on social media platforms but this doesn’t always mean who actually carried out the attack. Reports about the earlier Bluesky attack mentioned a group called 313 Team but their claims have not been independently confirmed.
Bluesky’s experience also speaks to the difficulties faced by smaller social media companies. Large platforms have huge infrastructure and security teams, but even big tech companies face DDoS attacks all the time.
With Bluesky growing, having the service available during attacks becomes even more important.
Users do not require anything special when they are under attack from a DDoS attack. So when the service is down, the customer should wait for the company to restore access. Users should be careful not to click on links that claim to offer a quick fix for an outage because attackers may also exploit big events to spread scams or malicious software.
The latest incident shows us that visiting online platforms is much more than simply an internet connection. Companies have to constantly protect their infrastructure from hackers to overwhelm their systems.
Bluesky says the good news is that the company was able to identify the attack and work on restoring normal service. It also said it hadn’t found evidence of unauthorized access to private user data during the incident.
As bad as it may have frustrated users, it also demonstrates the necessity for security systems in online platforms as they reach ever more people.
Since it was launched, Bluesky has exploded in popularity and as such is more of a target for anyone looking to disrupt a huge social network.
But at present, the company says it has taken care of the problems. The incident nevertheless highlights a growing challenge for Bluesky and other social media platforms: keeping their services available when attackers deliberately try to overwhelm them with junk traffic.
