On Saturday, October 18, 2026, two independent internet service providers in St. Petersburg — P.A.K.T. and eTelecom — simultaneously faced massive technical failures, which both companies attributed to a powerful DDoS attack on their server equipment. According to the monitoring service Detector404, the peak of user complaints in St. Petersburg was recorded at around 15:00 Moscow time, after which the number of reports regarding problems began to gradually decrease. Both provider structures stated that they are actively working to restore normal operations for their services.
What Happened to P.A.K.T. Subscribers
P.A.K.T. reported that attackers purposefully targeted the provider's server equipment. As a result, some subscribers experienced internet connection outages as well as issues accessing their personal accounts — the service through which users manage their tariffs, pay for services, and contact tech support. Company representatives emphasized that the attack is external in nature and targets the provider's infrastructure rather than end users. At the time of publication, P.A.K.T. had not disclosed the exact volume of the attack or specified what percentage of its subscriber base was affected by the disruptions.
eTelecom Also Reports Issues
Almost simultaneously with P.A.K.T., another St. Petersburg operator, eTelecom, warned of technical problems. The company did not detail the nature of the failure in its public statement, but confirmed that the issues were related to external interference with the infrastructure. Both provider structures indicated in their statements that they expect to resume normal service operations in the near future. Specific timelines for full recovery were not mentioned in public announcements.
Detector404 Monitoring: Peak of the Outage and Recovery Dynamics
The Detector404 service, which monitors user complaints about internet provider failures across Russia in real time, recorded a characteristic pattern for St. Petersburg on Saturday. The highest volume of user reports arrived at approximately 15:00 Moscow time. Following this peak, the number of connection problem reports began to decline, which, according to monitoring logic, indicates a partial restoration of network functionality. At the same time, complaints had not completely disappeared from Detector404 data at the time of writing, which aligns with provider statements that the recovery process is still ongoing.
Context: DDoS Attacks on Regional Providers
Distributed Denial of Service (DDoS) attacks on internet provider infrastructure are not a rare phenomenon in the Russian market. Attackers generate a massive flow of fake requests to operator servers, overloading communication channels and disabling equipment. For major federal providers with advanced traffic filtering systems, such attacks are often mitigated automatically; however, for regional and independent operators with less extensive defense infrastructure, the consequences can be palpable, ranging from partial outages to complete connection loss for a significant portion of subscribers. The simultaneous striking of two independent providers in the same city may indicate either a coordinated attack or that both companies use similar infrastructure elements vulnerable to the same attack vector. Neither company has publicly commented on the possibility of a coordinated attack.
What Subscribers Should Do and What to Expect
For subscribers whose connections have been affected by the outage, providers recommend contacting technical support through available channels — by phone, via messengers, or through the website (if access to the personal account has been restored). In most cases, DDoS attacks on provider infrastructure are temporary: once the attacking traffic is cut off or the load is redirected to backup nodes, connectivity is restored within a few hours. Both St. Petersburg companies assured subscribers that they are working to eliminate the consequences and do not expect long-term impacts on service quality. Final data on the scale of the outage and the causes of the simultaneous disruption of two operators may be published by the providers in subsequent statements.
