Threema went dark for hours. The only users who kept messaging ran it themselves

Threema, the paid Swiss end-to-end encrypted messenger, was made unavailable or only partially available by a series of large-scale DDoS attacks across Tuesday evening and Wednesday morning ^[1][2]. Organisations running Threema On-Prem experienced no issues, because those deployments sit on infrastructure the customer controls ^[4].

The sequence is worth reading closely. Users began reporting interruptions on Tuesday at around 6 PM UTC ^[6], and the company answered about an hour later saying the cause was, on the information then available, "a network outage on our colocation partner's side" ^[8]. Roughly three hours after that, Threema said it was restoring services after the partner reported the network problem resolved ^[10]. In its post-mortem, published Friday ^[11], the company dated the outage to Tuesday between 7:30 PM and 11:30 PM CEST ^[13], about four hours ^[14], followed by intermittent outages on Wednesday morning with normal operations restored at 12:23 PM CEST ^[15]. That is an incident window of roughly seventeen hours from first unavailability to all-clear ^[21].

Through Wednesday, users in Switzerland, India and China were still reporting that the service was down while the status page showed no problems ^[16]. The reason was mundane and instructive: an unrelated technical fault stopped the status page updating, and Threema took it offline until the fault was fixed ^[17]. So the outage was accompanied by a failure of the one component whose job is to tell customers there is an outage. Updates went out progressively via social media ^[18], and Threema Work business customers were emailed on Wednesday morning, with account managers fielding inquiries ^[19].

Threema says the attacks hit both its own service and its colocation partner, Nine ^[3], and that it is not entirely clear whether Threema was the primary target or whether the attacks were aimed at multiple targets ^[5]. Defence was hard because the attacker kept changing patterns over an extended period to get around mitigation ^[7]. The company's own description is candid: sophisticated attackers change methods, sources and patterns during an attack, producing "a cat-and-mouse game" in which both sides react to the other's last move ^[9].

None of this touched the encryption. Threema runs its own server infrastructure at various locations in Switzerland and promises no ads, no profiling and no hidden data analyses ^[22]. Those are confidentiality properties, and they held. Availability is a separate property, and it is concentrated in exactly the place a privacy architecture cannot decentralise away: the relay everyone connects to, plus whoever racks it. The On-Prem cohort was insulated not because it was better encrypted but because it was not sharing a chokepoint with everybody else.

The remediation is upstream capacity, not architecture. Threema says it deployed specialised DDoS protection on 14 August to filter attack traffic before it reaches its infrastructure ^[12], and plans to add an incident history and an RSS feed to the status page so administrators can get updates through an independent channel ^[20].

Watch whether the RSS and incident history actually ship, and whether they are hosted off the infrastructure they report on. For anyone buying Threema Work for business continuity, the useful question in the next renewal is what the On-Prem delta costs, and whether email to account managers is an acceptable out-of-band channel when the messenger itself is the thing that is down ^[19].