On the afternoon of October 21, 2016, the east coast of the United States lost access to most of the internet.

Twitter went down. Spotify went down. Reddit, the New York Times, Airbnb, Amazon, Netflix, PayPal, and dozens of other major platforms became unreachable. The outage started on the east coast and spread. By midday it was affecting users in Europe. Three waves of disruption rolled through the day, each one returning services to normal and then knocking them out again.

The attack did not target any of these companies. It targeted none of their servers, none of their code, none of their databases. It targeted a company most of their users had never heard of: a DNS provider called Dyn, which had offices in Manchester, New Hampshire. The attackers flooded Dyn's infrastructure with traffic from a botnet built from compromised home routers, security cameras, and digital video recorders running default passwords.…