Encrypted email service Tuta was the victim of multiple DDoS attacks this week.
The German-based provider first announced the incident with a post on X on Tuesday, December 3, 2024, with another attack causing the service downtime two days later. Tuta is said to have successfully mitigated both attacks, but some users are still lamenting issues accessing their accounts or using the service.
Short for Distributed Denial of Service, a DDoS attack’s goal is to make a website, service, or machine inaccessible to users. Cybercriminals achieve this by flooding the targeted network with internet traffic to overwhelm their capacity to carry on with legitimate requests.
The impact on Tuta’s users
“While we have to mitigate DDoS attacks constantly, and usually do so without the users noticing, the attackers used new attack vectors which our DDoS protection system was not prepared for,” Hanna Bozakov, press officer at Tuta, told TechRadar, commenting on this week’s incidents.
We are a privacy-focused service, we can not simply hide our application behind mitigation services
Matthias Pfau, Tuta’s co-founder
DDoS attacks cause downtime to targeted networks as they become unable to respond to user queries. On a practical level, people using Tuta services couldn’t get into their accounts.
While Tuta users couldn’t access their mailbox for some time, Bozakov ensures that no emails received during the attack have been lost or users’ privacy has been compromised. She said: “[Users’ data] is encrypted end-to-end on our servers, and no data has been harmed. The attacks only aim at the availability of our service.”
The team is currently working on hardening its systems against these types of attacks. As Matthias Pfau, co-founder of Tuta, explains, however, these incidents are among the challenges of building a privacy-first secure email service.
He said: “As we are a privacy-focused service, we can not simply hide our application behind mitigation services that require our SSL key for their service. This would be a violation of the trust that users put into Tuta Mail to keep their data safe and private.”
Tuta’s sub-Reddit group has been filled with frustrated customers reporting connectivity issues starting on Monday, with the latest report being shared only a few hours ago.
The provider, however, confirms the attacks have now been mitigated. At the time of writing, Tuta’s status page also confirmed that “all systems are operational.”
If you are still experiencing issues accessing your inbox, this could mean your IP address has been blocked during the attacks by Tuta’s DDoS protection system.
One of the best VPN apps could help here as it spoofs your IP by assigning you another one for each session. Bear in mind, though, that VPNs could also have been blocked by Tuta’s mitigation systems as many people tried to use them during the attack.
Bozakov then suggests rather using a completely different connection to access your Tuta’s app, such as another WI-Fi or mobile internet data.
The provider is still analyzing the attacks at the time of writing and is set to publish a detailed report of what happened in the coming days.