Ubuntu Suffers Major DDoS Attack: Snap Store, Websites, and Launchpad Hit

Overview of the Incident

On the evening of 30 April, Canonical, the parent company behind Ubuntu, reported that its digital infrastructure was under a “sustained, cross-border” cyberattack. The attack has disrupted access to several key services, including the Ubuntu website, the Snap Store, and the Launchpad development platform. Users worldwide have encountered errors or prolonged loading times since approximately 6 PM UK time.

Timeline of the Attack

Canonical first acknowledged the issue via social media and official channels shortly after the attack began. Initial reports from users started surfacing around 18:00 UTC. Within hours, the company confirmed that its services were facing an ongoing distributed denial‑of‑service (DDoS) assault originating from multiple locations outside the UK. As of writing, engineers are actively working to mitigate the impact, and Canonical has promised to release a detailed post‑mortem once the situation stabilises.

Affected Services

The attack has primarily targeted Canonical’s central web properties. The following services are currently experiencing partial or complete outages:

• Ubuntu.com – the main website, including documentation and community pages
• Snap Store – the platform for finding and installing Snap packages
• Launchpad – the code hosting and project management hub for Ubuntu, many open‑source projects, and Canonical’s own development
• archive.ubuntu.com – the primary APT repository mirror; this is offline, impacting package installations from that endpoint

Users attempting to download Snaps or browse the Ubuntu blog may encounter timeouts or HTTP errors. The Snap Store web interface remains unreachable, though existing Snap installations on user systems are unaffected (they rely on cached metadata and alternative sources).

Services That Remain Operational

Despite the widespread disruption, not all of Canonical’s infrastructure has been compromised. Crucially:

• Ubuntu APT repositories are mirrored across many servers, countries, and geographic regions. While the primary archive.ubuntu.com is down, other mirrors (e.g., us.archive.ubuntu.com, de.archive.ubuntu.com) are still functioning. Users can switch to an alternative mirror in their system settings or /etc/apt/sources.list.
• ISO image downloads for new installations are also unaffected because these are hosted on a separate content delivery network (CDN). Users can still obtain the latest Ubuntu ISO from releases.ubuntu.com or via the official torrent tracker.
• Existing Snap applications that are already installed continue to run normally; only updates or new installations via the Snap Store web service are blocked.

Canonical’s Response

In a brief statement, Canonical said it is “working to address” the attack and will share further details soon. The company has not yet disclosed the full scale of the DDoS or the specific vectors used, but security experts suspect a volumetric amplification attack is likely given the simultaneous impact on multiple services. Canonical urged users to avoid sharing unverified information and to rely on official channels for updates.

Impact on Users and Developers

For millions of Ubuntu users, the primary inconvenience lies in package installation and updates. Those who rely on the default APT mirror in Europe or who have not configured alternative mirrors will find attempts to apt update failing. Developers using Launchpad to host code, manage bug reports, or build packages are unable to push changes or access repositories. The Snap Store outage also affects users who want to discover or install new Snaps—though many core Snaps (like Firefox or GNOME apps) are updated via the Snap daemon’s own refresh mechanism, which may also be delayed.

What You Can Do Right Now

Until full service is restored, consider the following workarounds:

• Switch your APT mirror – Edit /etc/apt/sources.list and replace archive.ubuntu.com with a reliable mirror such as mirror.leaseweb.net or your country’s official mirror. For assistance, check the Ubuntu Mirror List (if accessible).
• Download ISOs via alternative channels – Use releases.ubuntu.com or the main download page which is hosted on a different infrastructure.
• Stay informed – Follow @ubuntu on Twitter or the Ubuntu Status Page for live updates.

Canonical’s security team is expected to provide a more detailed update within 24 hours. In the meantime, the company appreciates users’ patience and caution against spreading rumours.

Conclusion and Outlook

This DDoS attack is one of the most significant to hit Canonical in recent years, underscoring the persistent threat to major open‑source infrastructure providers. While the immediate impact is limited to web‑based services and the primary APT mirror, the outage highlights the importance of distributed architectures and redundancy. Canonical’s swift response and the resilience of mirror networks ensure that most Ubuntu users can continue their work with minimal interruption. The community awaits further details from the company, which are expected to inform future security improvements and incident response protocols.