Latest API Threat Report from Thales reveals record-breaking attacks, with financial services, telecoms and travel sectors most at risk

Thales has announced the findings of its latest API Threat Report (H1 2025), warning that APIs – the behind-the-scenes connectors powering apps, payments, and logins – have become the primary target for cybercriminals.

Across more than 4,000 monitored environments, Thales recorded over 40,000 API incidents in the first half of 2025 alone. Although APIs represent only 14% of overall attack surfaces, they now attract 44% of advanced bot traffic, demonstrating how attackers are focusing their most sophisticated automation on the workflows that underpin critical business operations.

Record-Breaking Financial Services DDoS Attack

One of the most striking findings from the report is the scale of a record-breaking 15 million requests-per-second (RPS) application-layer DDoS attack against a financial services API.

Unlike traditional volumetric DDoS campaigns aimed at overwhelming network bandwidth, this attack was targeted specifically at the application layer – exploiting the API itself to exhaust resources and disrupt operations. 27% of all API-focused DDoS traffic in H1 2025 hit financial services, reflecting the sector’s heavy reliance on APIs for real-time transactions such as balance checks, transfers, and payment authorisations.

This incident demonstrates how attackers are now combining scale with stealth: leveraging massive botnets and headless browsers to mimic legitimate API requests, making it far harder for defenders to distinguish malicious traffic from genuine users.

Key Findings from the Report:

  • 40,000+ API incidents recorded in H1 2025, averaging over 220 per day; projected to exceed 80,000 by year-end if trends continue.
  • Attack distribution by endpoint: 37% data-access APIs, 32% checkout/payment, 16% authentication, 5% gift-card/promo validation, and 3% shadow or misconfigured endpoints.
  • Credential-stuffing and account takeover attempts rose 40% on APIs without adaptive MFA.
  • Data scraping accounts for 31% of API bot activity, often targeting high-value fields such as email addresses and payment details.
  • Coupon and payment fraud represents 26% of attacks, exploiting promo loops and weak checkout validation.
  • Remote code execution (RCE) probes account for 13% of attacks, with Log4j, Oracle WebLogic, and Joomla being the most targeted CVEs.
  • By industry, financial services (27%) lead, followed by telecoms and ISPs (10%), travel (14%), and entertainment & arts (13%).
  • Shadow APIs remain a critical blind spot: organisations typically have 10–20% more active APIs than they are aware of.

“APIs are the digital economy’s connective tissue – but that also makes them its most attractive attack surface,” said Tim Chang, Vice President Application Security Products at Thales. “What we’re witnessing is not just the scale of attacks increasing, but a fundamental shift in how criminals operate: they don’t need to inject malware, they can simply bend your business logic against you. The requests look legitimate, but the impact can be devastating.

“The next six months will only see the volume and sophistication of API attacks grow. The best time to act was yesterday – the next best time is now. Organisations must discover every live endpoint, understand its business value, and protect it with context-aware, adaptive defences if they are to safeguard revenue, trust and compliance.”

Methodology

The Thales API Threat Report (H1 2025) draws on real-world attack telemetry from more than 4,000 Imperva customer environments worldwide. Data was collected between January and July 2025 and includes:

  • 40,000+ API incidents across sectors including financial services, telecoms, travel, healthcare, and e-commerce.
  • Bot telemetry and fingerprinting, analysing how attackers use advanced automation across both web and mobile APIs.
  • Endpoint behaviour analysis, including traffic volumes, anomalies, and stealth patterns signalling abuse.
  • CVE exploit tracking, focused on persistent vulnerabilities such as Log4j, Oracle WebLogic, and Joomla.
  • DDoS forensics, highlighting an unprecedented 15 million requests-per-second flood against a financial services API.

Thales’s Threat Research team used behavioural analytics, machine learning and forensic analysis to categorise attacks, map them to targeted endpoints, and identify trends across industries. While the dataset reflects Imperva’s customer footprint, it provides a robust and representative view of how APIs are being weaponised globally.

Notes to editors – Glossary of terms:

  1. Application Programming Interface (API): A piece of code that links two or more applications together, so they can share data with each other. One example is a mobile app that uses an API for a social media network to allow users to log in using their social media account details.
  2. Coupon: A digital or physical code that provides customers with a discount, promotion, or special offer during checkout.
  3. Credential stuffing: Cybercriminals buy lists of username/password pairs on the dark web, then use bots to repeatedly check on the login pages for other accounts to see where the credentials apply.
  4. Data Scraping: This practice extracts data from websites or web applications for malicious purposes such as price manipulation. 
  5. Distributed Denial of Service (DDoS): Overwhelming a site with traffic to render the service inaccessible. This is typically done in an automated fashion, using a network of bots (also known as a botnet) – automated programs or physical computing devices with Internet access that they have taken over and can control themselves.
  6. Endpoint: Physical devices connected to a network system, such as smartphones, laptops, embedded devices, sensors, or servers.
  7. Headless browser: A web browser without a graphical interface, often used by attackers to automate actions and mimic legitimate user behaviour.
  8. Remote code Execution: A type of security vulnerability that allows attackers to run their own code on a remote machine, connecting to it over public or private networks. From there, they can gain access to sensitive data and applications, redirect traffic, or run other attacks.
  9. Shadow APIs: A shadow API, also known as undocumented API, is an API that exists and operates outside the official, monitored channels within an organisation.