Cyber Incident Victim: Envato
Date:
Jul 2015
Location:
Australia
Summary
Envato experienced a prolonged DDoS attack lasting two weeks, causing repeated service disruptions and significant financial losses for its marketplace authors, estimated at over $25,000 per hour of downtime. The attacker's identity and motives remained unknown, though the company confirmed no data breaches or unauthorized access occurred during the incidents. Service availability fluctuated during the attacks, with multiple multi-hour outages impacting platform functionality. Envato assured users of data safety while implementing technical upgrades to strengthen DDoS mitigation efforts and reduce future downtime.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Envato marketplace network experienced a sustained distributed denial-of-service (DDoS) attack beginning July 1, 2015, which persisted for approximately two weeks. An unidentified attacker repeatedly flooded Envato's servers with high-volume traffic, causing intermittent service disruptions across its platforms hosting digital assets such as WordPress themes, 3D graphics, and stock photography. The Melbourne-based company confirmed the attacks through a July 2015 post on its official Inside Envato blog, acknowledging the assailant's motives and identity remained unknown despite escalating attack frequency. Service interruptions included a three-hour outage on July 10 and a one-hour disruption on July 12, significantly impacting the platform's global community of content creators. Financial repercussions were substantial, with Envato estimating author losses at $25,570 (€23,184) per downtime hour based on 2014 payout data totaling $224 million to creators.
Envato's technical team implemented monitoring measures and planned infrastructure upgrades to their DDoS mitigation systems following criticism about slow response times during initial attacks. The company assured users through official communications that no data breaches or financial information leaks occurred, confirming the DDoS wasn't used to mask database intrusions. Community concerns escalated as authors publicly discussed the economic impact on forums like ThemeForest, where users questioned Envato's transparency regarding attack severity. Service restoration updates were provided via the @envato_help Twitter account, with the July 10 tweet confirming operational normalization while advising users to report residual access issues. The incident concluded without attribution of responsibility or disclosed resolution details regarding the attacker's cessation.