Electronics Retailer Stops Massive DDoS Attack

With more than 400 stores in the Nordic countries and a booming online retail business, for the team at Elkjøp, the Black Friday Weeks campaign, which lasts for two weeks, is our peak season. Every year, it’s all hands on deck to provide customers a smooth, fast, secure, and reliable shopping experience.

This peak season, we wanted even more visibility into our traffic. In years prior, it had been cumbersome to not be able to see traffic hitting our origin servers. We wanted to better understand what traffic was hitting Akamai cache and protection layers, enabling us to take necessary actions to protect our services even better. In other words, we wanted a complete picture of the traffic hitting the Akamai edge. Without solid insights, we wouldn’t know which aspects of our preparation efforts to prioritize, such as hardening our protection at the edge and strengthening the internal protection of our origin servers.

We needed a cost-effective solution that could show us pain points and areas to harden, enabling us to mitigate problems prior to the start of our Black Friday Weeks campaign and to tackle situations in real time. In addition, our requirement for a long data retention policy had to be met. At the time, we were using another provider for our applications on the back end. However, moving our log data from Akamai to the provider’s platform would have entailed a significant cost.

To achieve our goals, we needed an observability platform that allowed us to ingest, query, and retain large amounts of data for a long period at an affordable price point. We found the perfect solution in TrafficPeak, luckily just in time for Black Friday Weeks and a massive DDoS attack.

In 2023, Akamai introduced us to TrafficPeak on Akamai Connected Cloud, an observability platform designed to ingest, monitor, query, store, and analyze massive amounts of data in real time at a much lower cost than what we could get from other providers. The platform, which is delivered as a managed service, seemed to check all our boxes, so we launched a proof of concept. Within just a few months, we resolved five different issues using TrafficPeak by simply having the extra visibility and ability to query on data patterns. After a successful proof of concept, we implemented the tool in our production environment a month before the peak season.

Then, during the Black Friday Weeks campaign, at peak traffic time, we experienced an enormous DDoS attack involving 3,000 IP addresses across 80 countries. TrafficPeak spotted the attack immediately while Akamai’s security services gave us the protection necessary to contain the attack. The entire response, from spotting the attack to stopping it, was instantaneous. No sites went out of service, and none of our customers experienced any impact whatsoever.

With TrafficPeak, we were able to clearly see the attack, and we realized that our preparation work had paid off, with the Akamai protection layer taking most of the traffic and the leftovers being handled by our origin servers. Without TrafficPeak, we wouldn’t have spotted the attack this early.

TrafficPeak was also valuable to us in determining the cause of the attack. Using the historical data collected by the platform, we started an in-depth investigation that led to remediations in our protection tools, some of which were deployed directly in connection to the attacks. The data TrafficPeak collected was instrumental in piecing together what had happened. We could see that several attacks had hit different endpoints, trying to find different ways to bring down our sites. We looked at the traffic patterns and determined which actions to take to ensure a similar attack wouldn’t happen again.

In addition to finding, containing, and remediating a massive DDoS attack in a very short time without any impact to our users or sites crashing, TrafficPeak and Akamai’s security services have helped us in other valuable ways.

Our sites are dynamic. Many of our team members, from developers to content creators, make changes from around the world, which makes it difficult to get technical visibility into everything. When we work with Akamai to make new rules, TrafficPeak helps ensure the rules are created correctly.

TrafficPeak is fast, and the query speed is great. We can rely on it to respond swiftly, and it has worked flawlessly since day one.

The TrafficPeak support team has also been very helpful and responsive. At first, we had questions about features in the dashboards versus the features other providers offer. The TrafficPeak support team asked what we liked about a certain provider’s dashboard features. That evening, we received an email with a new dashboard that included many of the features we had said we enjoyed and were missing. The developers made a new dashboard quickly, just for us. We were very impressed.

TrafficPeak has become an important part of our toolbox because it enables us to make better decisions to proactively reduce risks to performance and security and to reactively identify issues and their causes.

Elkjøp was founded in Norway in 1962, and since then, it has grown to become a solid market leader in consumer electronics and white goods in the Nordics. The group consists of around 11,000 committed employees who operate under the brands Elkjøp and Elkjøp Phonehouse in Norway, Elgiganten and Elgiganten Phonehouse in Sweden, Elgiganten in Denmark, Gigantti in Finland, Elko in Iceland, Elding in the Faroe Islands, and Pisiffik in Greenland. In Norway, Elkjøp has well over 4,000 employees and around 150 stores.

Elkjøp works hard every day to enrich consumers’ lives through technology, whether online or in store, by solving technology problems and addressing key human needs across a range of areas, including entertainment, productivity, communications, food, safety, and health.