Financial Services at Risk: DDoS Attacks Are Bigger, Longer, and More Complex, Akamai Research Finds

Akamai (NASDAQ: AKAM) released its May 20, 2026 State of the Internet Security report focused on financial services.

Rhea-AI Summary

Akamai (NASDAQ: AKAM) released its May 20, 2026 State of the Internet Security report focused on financial services. The research finds cybercriminals and pro-Iran hacktivists increasingly using AI-driven DDoS and bots against banking, payments, APIs, and applications, with median DDoS duration up 738% since 2024.

Key data points include high rates of API incidents, banking-focused web and API attacks, widespread ransomware exposure, a 147% surge in advanced bot activity, and distinct regional attack patterns.

Argus May 20 session

+1.56% close to close 2.8x rel. volume Open Argus

Details

News Market Reaction – AKAM

On May 20, the day this news came out, AKAM closed 1.56% above the previous close. That session’s volume was 2.8x the stock’s average daily volume.

Data tracked by StockTitan Argus for the May 20 session.

Key Figures

DDoS duration increase: 738% API incidents prevalence: 96% Web attacks at banking: 60% +5 more

DDoS duration increase

738%

Median duration increase for Layers 3 and 4 DDoS attacks since 2024

API incidents prevalence

96%

Financial service leaders reporting at least one API incident in past 12 months

Web attacks at banking

60%

Share of total web attacks in 2025 targeting banking

API incursions at banking

83%

Share of API endpoint incursions in 2025 targeting banking

Ransomware exposure

Nearly 80%

Financial institutions facing ransomware attacks in past two years

Advanced bot surge

147%

Increase in advanced bot activity in late 2025

Malicious scraping share

96%

Share of site traffic from malicious scraping bots in one case study

EMEA DDoS share

62%

EMEA share of Layers 3 and 4 DDoS attacks on financial services

Historical Context

5 past events · Latest: May 19

5 events

1. May 19

   AI product launch

   24h Move

   -6.3%

   Introduced AI Brand Presence to optimize content for AI search and agents.

2. May 18

   Convertible note offering

   24h Move

   -6.3%

   Announced $1.3B 2030 and $1.3B 2032 0% convertible senior notes.

3. May 14

   AI security acquisition

   24h Move

   -3.4%

   Planned $205M LayerX acquisition, dilutive to 2026 non-GAAP EPS by $0.12.

4. May 07

   Q1 2026 earnings

   24h Move

   +26.6%

   Reported $1.074B revenue, strong security growth and large CIS commitment.

5. May 05

   API security launch

   24h Move

   +11.5%

   Launched Security Posture Center and code-to-runtime mapping for APIs.

24h Move is the share-price change in the day after each event; other market factors may also have contributed.

Key Terms

ddos, api, layer 4, layer 7, +3 more

7 terms

ddos technical

"distributed denial-of-service (DDoS) attacks, Akamai (NASDAQ: AKAM) reveals"

A DDoS (distributed denial-of-service) attack is when many compromised computers or devices artificially flood a company's online systems with traffic so legitimate users cannot access websites, apps, or services. For investors, DDoS episodes can disrupt sales, damage customer trust, and expose weaknesses in a company's security — like a traffic jam that shuts down a city's main highway, revealing costs and operational risks that can affect revenue and stock value.

api technical

"web and API (Layers 3 and 4) distributed denial-of-service (DDoS) attacks"

An API, or Application Programming Interface, is a set of rules that allows different software programs to communicate and work together smoothly, much like a waiter translating your order into the kitchen and then bringing your meal back. For investors, APIs are important because they enable real-time access to financial data, trading systems, and other digital services, making it easier to make informed decisions quickly and efficiently.

layer 4 technical

"web and API (Layers 3 and 4) distributed denial-of-service (DDoS) attacks"

Layer 4 is the part of a computer network that controls how data is delivered between one device and another, managing the rules for starting, keeping, and ending connections so messages arrive whole and in order. Think of it like highway lanes and traffic lights that regulate vehicle flow to prevent jams and collisions. For investors, Layer 4 matters because its performance and reliability directly affect the speed, uptime, and security of online services, which can influence customer satisfaction, operating costs, and regulatory risk.

layer 7 technical

"APAC is the most targeted by Layer 7 DDoS (52%)"

Layer 7 is the top level of network communication that handles the actual applications people use, like web browsers, mobile apps, and online services — think of it as the front desk where requests from users are processed. For investors, Layer 7 matters because problems or improvements here directly affect user experience, security (such as blocking malicious traffic), and the functionality of online products, which can influence customer retention, costs, and revenue.

ransomware technical

"Nearly 80% of financial institutions have faced ransomware attacks"

Ransomware is malicious software that locks or encrypts a company’s computer files and systems, then demands payment for their release — like a thief changing the locks on a business and asking for a ransom. It matters to investors because attacks can halt operations, trigger large cleanup costs, damage customer trust, lead to regulatory fines or legal claims, and reduce future revenue, all of which can hurt a company’s financial value.

botnets technical

"AI-Empowered Botnets and API Visibility Gaps: Attack Trends in Financial Services"

A botnet is a network of internet-connected devices that have been secretly taken over by criminals and are controlled remotely to carry out coordinated attacks or fraud. Think of it like a fleet of hijacked cars driven by a remote operator to block highways or steal goods; for investors, botnets can cause costly outages, data breaches, lost sales, regulatory fines and reputational damage that can quickly reduce a company’s revenue and share price.

dns technical

"and practical DNS and DDoS attack mitigation strategies"

DNS is the internet’s lookup system that translates human-friendly website names into the numeric addresses computers use, like a phonebook that finds a business by name and returns its street address. Investors care because problems with DNS — outages, hijacks or misconfigurations — can make a company’s website, online sales, customer logins and email inaccessible, potentially harming revenue, reputation and short-term market value.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Pro-Iran hacktivism and AI bots are amplifying cyberattacks targeting online banking, payments, and applications

CAMBRIDGE, Mass., May 20, 2026 (GLOBE NEWSWIRE) -- Cybercriminals are now targeting financial services more than any other industry for web and API (Layers 3 and 4) distributed denial-of-service (DDoS) attacks, Akamai (NASDAQ: AKAM) reveals in its AI-Empowered Botnets and API Visibility Gaps: Attack Trends in Financial Services State of the Internet (SOTI) Security report. The findings highlight a dangerous shift as pro-Iran hacktivists and AI-driven bots weaponize DDoS tactics to disrupt online banking, payment systems, and critical applications.

Driven by AI-powered infrastructure, the median duration of global Layers 3 and 4 DDoS attacks targeting the financial services sector is up 738% since 2024. This shows that while digital transformation has enabled advances such as online banking and real-time payments, it has also widened the doors for attackers.

Key findings of the report include:

• Among the financial service leaders surveyed for the 2026 API Security Impact Study, 96% reported at least one API security incident over the past 12 months, the highest among all industries.
• In 2025, 60% of total web attacks and 83% of incursions against API endpoints targeted banking.
• Nearly 80% of financial institutions have faced ransomware attacks in the past two years, yet less than half have adopted advanced security technologies.
• Advanced bot activity surged by 147% in late 2025 — and, in one case study, a staggering 96% of all site traffic was identified as malicious scraping bots.
• Cyberattack methods against financial services vary significantly by region: EMEA is the primary target for Layers 3 and 4 DDoS (62%), APAC is the most targeted by Layer 7 DDoS (52%), and in North America, web attacks are the most prevalent (44%).
  

“Cybercriminals and hacktivists continue to escalate DDoS from nuisance attacks to a sustained siege encompassing both hacktivism and cybercrime, and financial services are in the crosshairs," said Steve Winterfeld, Advisory CISO of Akamai. “In addition, the data shows that APIs are increasingly targeted as AI doesn't reduce traditional security risks, it puts them on steroids. Fortunately, financial services organizations can leverage the security strategies and best practices detailed in this report."

AI-Empowered Botnets and API Visibility Gaps: Attack Trends in Financial Services also includes: data-supported trends on criminal activity, a guest column by the CISO of FS-ISAC, a security spotlight on MITRE capabilities, a cloud spotlight on the differences among AI architectures, and practical DNS and DDoS attack mitigation strategies.

Now in their 12th year, Akamai’s SOTI Security reports continue to offer critical insights on cybersecurity trends and web performance, drawn from attacks viewed across Akamai’s cybersecurity protective infrastructure, which handles a significant portion of global web traffic.

About Akamai

Akamai is the cybersecurity and cloud computing company that powers and protects business online. Our market-leading security solutions, superior threat intelligence, and global operations team provide defense in depth to safeguard enterprise data and applications everywhere. Akamai’s full-stack cloud computing solutions deliver performance and affordability on the world’s most distributed platform. Global enterprises trust Akamai to provide the industry-leading reliability, scale, and expertise they need to grow their business with confidence. Learn more at akamai.com and akamai.com/blog, or follow Akamai Technologies on X and LinkedIn.

Contacts
Akamai Media Relations
akamaipr@akamai.com

Akamai Investor Relations
invrel@akamai.com

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What did Akamai (NASDAQ: AKAM) reveal about DDoS risks to financial services in May 2026?

Akamai reported that financial services are now the top target for web and API DDoS attacks. According to Akamai, pro-Iran hacktivists and AI-powered bots increasingly disrupt online banking, payment systems, and applications, turning DDoS from brief nuisances into longer, more complex campaigns.

How much has the median DDoS attack duration on financial services increased, according to Akamai (AKAM)?

Akamai found the median duration of global Layer 3 and 4 DDoS attacks on financial services is up 738% since 2024. According to Akamai, this surge reflects AI-powered infrastructure enabling attackers to sustain disruptive activity against banks and payment providers for far longer periods.

What API and web attack statistics on banking did Akamai (AKAM) share for 2025?

Akamai reported that in 2025, 60% of total web attacks and 83% of incursions against API endpoints targeted banking. According to Akamai, 96% of surveyed financial service leaders experienced at least one API security incident over 12 months, the highest among all industries.

How common are ransomware and API security incidents in financial institutions, per Akamai’s 2026 study?

Akamai’s research shows nearly 80% of financial institutions faced ransomware attacks in the past two years. According to Akamai, 96% of financial service leaders reported at least one API security incident, yet less than half have deployed advanced security technologies to address these threats.

What regional attack trends against financial services did Akamai (NASDAQ: AKAM) highlight?

Akamai observed that EMEA is the primary target for Layers 3 and 4 DDoS, accounting for 62% of such attacks. According to Akamai, APAC sees 52% of Layer 7 DDoS, while North America experiences 44% of web attacks on financial services.

How are AI-powered bots changing cyberattacks on financial services in Akamai’s 2026 SOTI report?

Akamai reported advanced bot activity surged 147% in late 2025, with one case showing 96% of site traffic as scraping bots. According to Akamai, AI does not reduce traditional risks; instead, it amplifies them, enabling more persistent, automated attacks on financial services APIs and websites.