The BGP Hijacking That Almost Took Down a Network

The internet feels abstract until it fails in a very physical way.

One minute, packets flow. The next, your traffic is taking a route you never approved, through networks you never intended, to places your customers have never heard of. Dashboards still glow. Links still blink. But reality has changed underneath you.

That is the thing most people misunderstand about internet resilience: it is not built on certainty. It is built on coordination, trust, and constant verification. And sometimes that trust breaks.

Years ago, we lived through one of those moments at Network Operations. It was not the biggest incident we have ever handled, and it was not the longest. But it was one of the most clarifying. A route announcement appeared where it absolutely should not have existed. Traffic started moving in the wrong direction. For a brief window, customers felt the internet tilt beneath their feet.

We had minutes to decide whether this was noise, incompetence, or an attack. Minutes to verify. Minutes to coordinate. Minutes to stop the blast radius from growing.

That experience taught me something I still believe today: the internet is not fragile because software has bugs. It is fragile because the global routing system still runs on implied trust at planetary scale.

BGP is the invisible control plane of the internet

If you are not deep in network engineering, Border Gateway Protocol can seem like obscure plumbing. It is not. BGP is the mechanism autonomous systems use to tell each other, in effect: I know how to reach this part of the internet. Send the traffic to me.

That simple idea is what lets a packet travel across countries, carriers, exchanges, and data centers without human involvement. It is also what makes BGP both elegant and dangerous. Because the protocol was designed for reachability and scale, not for deep skepticism.

In practice, BGP works because operators behave. Networks announce only the IP prefixes they are supposed to announce. Upstream providers filter what they accept. Peers apply policy. Registries maintain order. Monitoring systems watch for anomalies.

But if one of those layers fails—or if someone intentionally abuses it—the wrong route can propagate astonishingly fast.

That is the uncomfortable truth. On the modern internet, the distance between “everything is normal” and “traffic is being misrouted across the world” is sometimes just a single bad announcement plus a few trusting neighbors.

What a hijack feels like from the inside

People imagine routing incidents as dramatic Hollywood moments. They are not. They begin ambiguously.

Maybe latency spikes in one geography. Maybe a subset of probes fail. Maybe one customer reports intermittent reachability while another sees total loss. Maybe your edge looks healthy while origin paths degrade. The first challenge is not remediation. The first challenge is pattern recognition.

That day, the signal came in fragments. Reachability anomalies. Strange pathing. Mismatch between what our systems expected and what the wider internet had started to believe. When we dug into route visibility, the shape of the problem became clear: prefixes associated with our space were being announced elsewhere.

The exact country is less important than the lesson. Geography matters in routing, but trust chains matter more. A bad announcement can start anywhere and become your problem everywhere if enough systems accept it as valid.

That is why BGP incidents are so psychologically dangerous for operators. A DDoS attack is loud. Hardware failure is concrete. A route hijack is disorienting. Your infrastructure may still be up. Your applications may still be healthy. Your team may still be doing everything right. And yet users cannot reach you because the internet’s map has been redrawn in real time.

The first eight minutes decide almost everything

In high-pressure incidents, people love to talk about technical heroics. The real differentiator is usually much simpler: whether your team can establish a clean operating rhythm before panic takes over.

In our case, the critical move was not a clever command. It was discipline.

• One stream focused on verification: confirm this is a routing anomaly, not an application issue.
• One stream focused on scope: which prefixes, which geographies, which upstreams, which customers.
• One stream focused on escalation: peers, providers, exchanges, internal leads.
• One stream focused on mitigation options already prepared in advance.

When teams fail in these moments, it is rarely because they lack intelligence. It is because they collapse verification, coordination, communication, and execution into the same noisy channel. Everyone talks. Nobody owns. Time disappears.

The first eight minutes matter because that is the window in which false assumptions become expensive. Misclassify the incident and you waste precious time debugging the application layer. Escalate vaguely and counterparties cannot act. Communicate too early without confidence and you create internal confusion. Communicate too late and customers assume the worst.

Good incident management is not about moving fast in every direction. It is about moving decisively in the right direction with a shared picture of reality.

What actually fixes a BGP hijack

There is no single magic button for routing integrity. That is another misconception. Recovery is usually a stack of defensive moves, some technical, some operational, some relational.

First, you need visibility. If you cannot see route propagation across multiple vantage points, you are operating blind. Local truth is not enough. Your router may know the correct state while the rest of the internet is following a lie.

Second, you need policy. Prefix filtering, route validation, sane announcements, and tight upstream relationships are not “nice to have.” They are what turns a possible global incident into a contained one.

Third, you need reach. During a routing event, your ability to contact the right upstreams and peers quickly is strategic infrastructure. People underestimate this. Resilience is not just hardware and software. It is also whether your team knows exactly who to call, what evidence to provide, and how to accelerate action across organizational boundaries.

Fourth, you need pre-decided playbooks. Under stress, nobody produces their best architecture. They execute whatever level of clarity existed before the incident. If route leaks, hijacks, and propagation anomalies are not already modeled in your response process, you will improvise where you should have been rehearsing.

And finally, you need architectural humility. You cannot eliminate all external routing risk. You can only reduce exposure, improve detection, shorten decision time, and design systems that degrade more gracefully when the internet itself behaves badly.

The deeper problem is trust without continuous proof

When I look at modern infrastructure, I see the same pattern everywhere. We say “zero trust” in identity. We say “defense in depth” in security. We say “assume breach” in architecture. But at the routing layer, much of the world still operates on assumptions that are too optimistic for the threat environment we actually live in.

This is why routing security matters far beyond telecom specialists. If you run SaaS, e-commerce, banking, media, public services, or AI infrastructure, BGP is part of your threat model whether you like it or not. Your uptime is downstream of decisions made by networks you do not control.

The strategic implication is clear: resilience cannot stop at your application perimeter. The companies that will outperform over the next decade are the ones that understand infrastructure as a full stack of trust relationships—from code to identity to network paths to operator response.

Most leadership teams still think of internet routing as “the provider’s problem.” That is like thinking backups are “the storage vendor’s problem.” You can outsource operations. You cannot outsource accountability.

What changed for us afterward

The most important incidents are the ones that permanently change your standards.

After that near miss, we became even more opinionated about route hygiene, monitoring, escalation paths, and operational readiness. We treated routing visibility as a first-class requirement, not a specialist dashboard buried in a corner. We tightened assumptions. We made detection faster. We made decision paths shorter. We reduced the amount of interpretation required in the first minutes of an anomaly.

Just as importantly, we reinforced a cultural lesson: infrastructure leadership is not about pretending fragility does not exist. It is about designing organizations that can absorb fragility without denial.

That sounds obvious. In practice, it is rare. Many companies build for performance in normal conditions and call that resilience. It is not. True resilience is what remains when the dependency graph turns hostile.

That applies to routing, but also to APIs, clouds, vendors, identity providers, and AI systems. The shape changes. The principle does not.

The internet still runs on people who care

There is one final point worth making.

For all the justified criticism of BGP and the global routing model, the internet continues to work because skilled operators across the world take responsibility seriously. They monitor. They filter. They escalate. They collaborate across company lines when something goes wrong. The protocol has weaknesses, but the community has judgment.

That human layer is still underrated.

Whenever people talk about autonomous systems, self-healing infrastructure, and AI-managed operations, I agree with the direction. But incidents like this are a reminder that the highest leverage is still the combination of machine speed and human judgment. Detection should be automated. Verification should be rapid. Escalation should be structured. But trust decisions, trade-offs, and strategic remediation still benefit from experienced operators who understand consequences, not just signals.

The future of reliability will belong to teams that combine both.

The real lesson

The lesson from a BGP hijack is not that the internet is broken.

It is that the internet is alive.

It is a negotiated system, constantly adjusting, constantly recomputing, constantly balancing autonomy and coordination. That is why it scales. That is also why it occasionally surprises the people who depend on it most.

If you lead infrastructure, do not treat routing as background noise. Treat it as strategic terrain. Ask harder questions about path integrity. Demand better visibility. Rehearse your response. Build relationships before you need them. And design your systems so that when the map changes unexpectedly, your company does not lose its nerve along with its packets.

Because when the internet tilts, the winners are not the ones with the prettiest dashboards.

They are the ones who prepared for the moment trust fails.

---