Zzoomm Apologises for Disruption in Oxfordshire UK After DDoS

Alternative broadband ISP Zzoomm, which is deploying a 10Gbps Fibre-to-the-Premises (FTTP) broadband network to 1 million UK homes by the end of 2025, has apologised to their customers in the Oxfordshire town of Henley-on-Thames after a Distributed Denial of Service (DDoS) assault disrupted their connectivity.

DDoS attacks typically work by overloading a target server or end-user with masses of data requests from multiple internet connected devices (often malware hijacked computers / botnets etc.), which can cause the intended target to crash or suffer significant performance problems until the bad traffic stops. Such attacks may also expose other weaknesses that hackers can exploit (or even blackmail), such as happened to TalkTalk in 2015 (here).

In this case, it wasn’t Zzoomm that was attacked, but rather one of their upstream suppliers in the area. “These were instigated by a malicious party who has attempted to extort payment from another of their customers. They effectively flooded the upstream network with traffic overloading their systems,” said the ISP. As a result, Zzoomm’s local customers have also faced related “service interruptions” over the last week.

“All of us here at Zzoomm would like to apologise for the service interruptions experienced in Henley-on-Thames over the last week. We have not delivered the level of reliability that you have every right to expect from the Zzoomm service,” said the provider in a reassuringly candid response.

At this point it’s crucial to reflect that DDoS attacks happen to UK ISPs all the time, they’re practically par-for-the-course in this business, but most can be mitigated and few are ever significant enough to disrupt connectivity for lots of end-users. In nearly all cases, these incidents aren’t actually an attack against the ISP, but rather somebody targeting a specific customer or upstream network provider for the ISP.

Most ISPs thus prefer not to speak about such things in public, often putting related incidents down to ambiguous network connectivity faults instead.

Zzoomm Statement

“Working with our upstream provider we have looked at how together we can (1) limit the impact of these attacks and (2) respond faster to the attacks. Specifically, our upstream provider has put in place a DDOS filtering service which should make the type of attack that they, and we, have experienced over the last week ineffective.

In addition, we are putting in place more capacity in the core network, which will make it more difficult to be overwhelmed by DDOS attacks. Finally, we are improving our management tools to allow us to respond faster to reconfigure the core network to sidestep different attack vectors. Making these changes has taken time as services and equipment need to be ordered, delivered, provisioned, tested and made live.”

However, merely resolving the underlying exposure to such assaults was not enough for Zzoomm. On top of the aforementioned changes, they’ve also given “every” customer a free period of service and will even upgrade them – from the beginning of July 2021 – to a fully symmetrical speed for the next couple of months (existing customers who pay for this boost will get it for free over the same period).

Zzoomm has also said that they intend to launch a Service Status page, which customers will be able to check in order to identify whether there are any ongoing problems in particular areas (all ISPs should really have these by default, but some providers still don’t). Finally, Zzoomm said they would “continue to work with all our partners to put in place improved defences and heightened checks to limit the impact of any attacks in the future.”

We have to credit Zzoomm here for being transparent with their experience and doing a great job of supporting their customers, not least with lots of service freebies.