Bluesky has confirmed that a recent wave of outages affecting its app and website was caused by a sophisticated DDoS attack that disrupted several core platform services between 15 and 17 April 2026.
According to public statements, service interruptions began on 15 April at around 8:40 p.m. ET and continued intermittently through 17 April as mitigation efforts remained in progress.
The incident led to intermittent failures across feeds, notifications, threads, search functions and profile access, with users reporting repeated errors, slow loading times and temporary unavailability throughout the disruption window.
Attack caused intermittent application-layer failures
Bluesky said the attack intensified throughout the day, with intermittent disruption affecting feeds, notifications, threads and search. Users reported partial service availability alongside repeated application errors. Users could intermittently access the platform, while requests to feeds, profiles, threads and search frequently failed or timed out, suggesting congestion or protective controls somewhere in the application delivery path.
Reports of “Rate Limit Exceeded” messages on popular feeds suggest temporary throttling controls were applied during mitigation. Intermittent availability is consistent with active traffic management, where some endpoints are prioritised while higher-load functions remain constrained.
Status page also affected
Bluesky’s own status page reportedly suffered intermittent issues during the event, reducing visibility for users trying to confirm whether the disruption was local or platform-wide.
This can happen when status infrastructure shares dependencies with affected production systems, or when supporting services are indirectly impacted during a broader attack response.
No evidence of a data breach
Bluesky stated that it had not seen evidence of unauthorised access to private user data.
While DDoS attacks are typically designed to impact availability rather than compromise confidentiality, prolonged disruption can still create significant operational and reputational damage.
Infrastructure resilience under scrutiny
The outage follows another recent disruption earlier in the month, prompting questions about resilience as Bluesky continues to grow.
Public-facing social platforms are common DDoS targets due to their large user bases, highly exposed APIs and dependence on real-time service delivery.
Bluesky said mitigation efforts were ongoing and that further updates would follow as engineers worked to restore full stability.
