Mastodon's flagship server was hit by a distributed denial-of-service attack on Monday, rendering the instance unusable at times. Much of the site was inaccessible, throwing error messages or displaying a full-screen outage warning.

The makers of the decentralized social networking software, which runs its official mastodon.social instance, said in a status update that they were investigating the cyberattack. By 9:05 a.m., Mastodon implemented a countermeasure against the DDoS attack, and the site became accessible again. However, instability may continue as the attack is ongoing.

The cyberattack targeting Mastodon comes days after Bluesky, another decentralized social network, resolved much of its days-long outages following a lengthy DDoS attack. As of Bluesky’s most recent update on April 17, the DDoS attack continues but has been stable since April 16 at 9 PM PDT.

Distributed denial-of-service (DDoS) attacks rely on sending massive amounts of junk web traffic towards an app or website's servers, with the aim of knocking them offline. These cyberattacks don’t involve data theft, but DDoS attacks can be disruptive to users. DDoS attacks have become exponentially more powerful over the years.

When aimed at decentralized social networking services, the attacks can cause instability and outages, but not everyone is taken offline. In Bluesky’s case, those who had moved their account to other providers, like Blacksky, which run on the same protocol and interoperate with Bluesky, were not impacted. Similarly, the attack on Mastodon has so far targeted only the larger server (mastodon.social) and not the many smaller instances that make up the full Mastodon social network.