Gcore - Multiple Services | Connectivity Incident Details – Incident details

Service Disruption RCA – April 7, 2026
Status: Resolved
Incident window: April 7, 2026, 08:00–11:53 UTC

Summary
On April 7, 2026, Gcore experienced a service disruption caused by a large-scale DDoS attack targeting infrastructure at one of our datacenter locations.
The attack caused network instability that affected several platform services, including authentication, Storage API, Billing, WAAP configuration delivery, CDN billing statistics processing, and Advanced DDoS statistics dashboards.
To restore service availability, Gcore initiated an emergency failover to a backup datacenter. Most core services were restored within approximately 20 minutes of the failover. The incident was fully resolved at 11:53 UTC.
No customer data was lost. No customers were overcharged.

Customer Impact
During the incident window, customers may have experienced the following impact: 

• Storage API: Temporary unavailability or degraded performance.

• IAM / Authentication: Authentication failures or increased latency.

• Billing Portal: Temporary unavailability. Billing data remained intact.

• WAAP: Delayed configuration delivery to edge nodes, resulting in degraded service. Some extended impact continued until April 10, 2026, 09:55 UTC.

• CDN Billing Statistics: A brief statistics processing issue affected approximately 90 seconds of data on April 7 between 10:04 and 10:05:30 UTC. This interval was excluded from billing calculations to ensure no customer was overcharged.

• Advanced DDoS Statistics: Customer-facing Advanced DDoS statistics dashboards did not display data for part of the affected period. Missing data was fully restored on April 15, 2026.

Timeline (All times are in UTC.)

• 08:00 – DDoS attack began, affecting datacenter network stability.

• 10:16 – Emergency failover to backup datacenter initiated.

• 10:26–10:34 – Core services migrated to backup datacenter.

• 10:28 – Status Page incident posted.

• 10:30 – Status Page updated to Identified.

• 11:13 – Incident mitigated.

• 11:20 – Status Page updated to Monitoring.

• 11:53 – Status Page updated to Resolved.

• April 8, 10:10 – Customers notified that the affected CDN billing statistics interval was excluded from billing.

• April 10, 09:55 – WAAP extended impact fully resolved.

• April 15 – Advanced DDoS statistics data fully restored.

Root Cause
The disruption was caused by a large-scale DDoS attack against datacenter infrastructure. The attack led to network instability and affected communication between several platform components. Some services required additional recovery steps following the initial failover due to dependency and recovery behavior under unstable network conditions.

Resolution
Gcore mitigated the DDoS attack and performed an emergency failover to a backup datacenter to restore service availability. Additional recovery actions were completed for affected services, including WAAP configuration delivery, billing-related processing, and Advanced DDoS statistics restoration. All affected customer-visible data has been restored where applicable, and the affected CDN billing statistics interval was excluded from billing calculations.

Preventive Measures
To reduce the likelihood and impact of similar incidents, Gcore is implementing the following improvements: * Reducing infrastructure dependency on shared network components to limit the blast radius of future network attacks.

• Strengthening messaging infrastructure resilience.

• Improving service recovery behavior during temporary network instability.

• Adding faster monitoring and alerting for statistics data collection gaps.

• Enhancing billing system reconnection logic to reduce recovery time during infrastructure instability.

• Implementing additional safeguards to prevent duplicated statistics data from affecting billing calculations.

Current Status
This incident is fully resolved. All impacted services have been restored, and no customers were overcharged as a result of this incident.

We are happy to inform you that the major outage in our CDN, Storage, WAAP, DDoS and Customer Portal, has been resolved. However, if you continue to experience any issues, please do not hesitate to contact our support team. Our team will be happy to assist you and ensure that any further concerns are addressed promptly. We will also provide a detailed Root Cause Analysis (RCA) once it becomes available.

We appreciate your patience and understanding throughout this incident, and we thank you for your cooperation.

For further assistance, please contact our support team via support@gcore.com

We are pleased to inform you that our engineering team has implemented a fix to resolve the major outage in our CDN, Storage, WAAP, DDoS and Customer Portal. However, we are still closely monitoring the situation to ensure stable performance.

We will provide you with an update as soon as we have confirmed that the issue has been completely resolved.

We are continuing to work on a fix for this incident. During the investigation, we have identified issues with the Hosting service. At the moment, virtual private and dedicated servers in Milan, Sydney, Sao Paulo, and New York are affected.

We have successfully identified the issue and are currently working on implementing a fix to resolve the major outage in our CDN, Storage, WAAP, DDoS and Customer Portal. We appreciate your patience and understanding as we work towards a resolution. Thank you for your continued cooperation.