2025 Adyen — multi-wave DDoS degraded EU payment services ~8 hours (Apr); customer database exfiltration denied in corporate incident note
Data compromised
Primarily service reliability; Adyen positioned incident as availability rather than confirmed PII theft
Technical writeup
On 21 April 2025, Adyen publicly described distributed denial-of-service surges against European payment endpoints across three waves, causing transaction failures/delays and service degradation for roughly eight hours before mitigation closed the window; corporate messaging emphasized availability impacts and stated no consumer database extraction.
Root cause
High-volume DDoS against internet-facing payment APIs and onboarding paths