The Information Technology Directorate of the Kurdistan Regional Government successfully defended the Roonaki service portal against a large-scale DDoS cyberattack on February 15–16, 2026. This attack is one of the most serious electronic threats targeting the region’s online infrastructure in recent years.
Officials reported that the assault involved about 10 separate waves. Each wave sent around 180 gigabytes of data per second. Attackers used thousands of IP addresses worldwide and millions of automated requests. Without proper defenses, such an attack could have paralyzed the portal. However, the Roonaki system remained strong.
The directorate quickly activated its Incident Response system. Teams applied a detailed protection plan to stop the attack and maintain service. The measures included:
- Detecting and blocking attacks: Cybersecurity specialists identified attack patterns in real time and countered them immediately.
- Limiting request rates: The system controlled excessive incoming requests to prevent server overload.
- Controlling geographic traffic: The directorate monitored traffic sources and applied targeted blocks.
- Coordinating with ISPs: Officials worked with Internet Service Providers to block attacks closer to the source.
- Cloud protection and IP rotation: The portal moved to a Cloud DDoS Protection platform. Public IP addresses were rotated to reduce vulnerability.
Thanks to these steps, the Roonaki portal stayed fully functional during the attack. Users continued to access services without interruption. Directorate officials highlighted that this incident shows the KRG’s growing ability to protect critical digital infrastructure.
Moreover, this attack emphasizes the importance of cybersecurity for essential government services. The Information Technology Directorate plans to continue monitoring, upgrading systems, and implementing proactive strategies. These steps aim to prevent future cyber threats and strengthen online platforms.
