Direct Communications DDoS incident

Analyst assessment

DysruptionHub assesses with high confidence that Direct Communications Cedar Valley experienced a distributed denial-of-service attack that disrupted internet service in Eagle Mountain, Utah. Direct Communications described unusually high traffic consistent with a DDoS attack, and ABC4 Utah reported that the traffic caused slow speeds, packet loss and complete outages.

The provider’s official updates also attributed the continuing disruption to an upstream provider issue and said its initial investigation found effects beyond Eagle Mountain. FOX 13 reported that the provider attributed the disruption to malicious targeting of an upstream provider. That is the provider’s account, not an independently published forensic finding; the upstream carrier was not identified.

Operational significance

The disruption affected residents and businesses that depended on Direct Communications for connectivity. ABC4 reported that City Hall and the library closed because of the outage, with city phones and services unavailable and library service limited. City officials told FOX 13 that City Hall was open and operational Monday morning, Sept. 21.

ABC4’s follow-up documented a resident and his wife having to stop remote work Friday afternoon and defer unfinished work to Monday. FOX 13 reported that a home-based Etsy seller struggled to process digital-file orders because connectivity was inconsistent. These are individual customer accounts, not a measured total of lost business or all affected customers.

Direct Communications Cedar Valley’s customer-facing operation and direct retail footprint are centered on Eagle Mountain. It maintains a local office there, but it belongs to a multistate corporate group headquartered in Rockland, Idaho. The registry treats Eagle Mountain as the supported incident location, not as proof that the wider corporate family operates only in the city.

The provider said the upstream outage extended beyond Eagle Mountain but did not identify another affected community, organization or service area. The evidence therefore does not support adding another incident location.

Current status

Direct Communications said service returned after about 8:30 p.m. Sept. 17, but customers continued to experience instability and another network drop. On Sept. 21, the provider said its front-office phone and billing systems were down because of the internet outage.

KUTV reported Sept. 22 that Direct Communications restored internet service Sept. 21 after the multi-day outage. The provider’s Monday evening statement said internet service availability had returned that afternoon and third-party cybersecurity specialists were reviewing the incident. It advised customers with residual connection problems to restart their routers, and said routers reset to factory settings would require setup again. The positive network-restoration statement supports resolved operational status and Sept. 21 as the end of documented material impact; it does not independently establish a separate restoration time for every front-office phone and billing function.

Our Sept. 21 article documented the historical municipal closures and provider phone and billing limitations before the final availability statement.

Confidence and uncertainty

Confidence is high that the disruption and DDoS characterization are accurate because two local news organizations reported statements from Direct Communications, the provider documented continuing effects, and Eagle Mountain confirmed municipal impacts. Confidence is medium on the exact start date because residents described several days of disruption by Sept. 20, while the provider’s documented outage timeline began Sept. 17.

Ransomware is not supported. Searches for Direct Communications Cedar Valley, Direct Communications, Direct Communications Utah, Directcom Fiber and directcomfiber.com returned no ransomware.live claims. Data impact and threat-actor attribution remain unresolved because reviewed sources do not address data access, data loss, the attack’s origin or the responsible actor.

Analytic gaps

The public record does not establish the attack source, motive, traffic origin, targeted infrastructure, peak volume, mitigation provider, the precise upstream infrastructure targeted or whether any systems were compromised beyond traffic-driven service unavailability. It also does not identify the locations covered by the provider’s statement that the upstream outage extended beyond Eagle Mountain or establish a final restoration time, data impact, extortion demand or responsible actor.