A retry storm is a burst of repeated requests that happens after a service slows down, times out, or returns errors. Instead of waiting quietly, clients, gateways, or background jobs keep trying the same action many times. When enough systems retry at once, they can create more traffic than the original failure, making an already stressed service even harder to recover.
In cyber security and operations, retry storms matter because they can turn a small outage into a wider denial of service. They often appear in payment flows, authentication systems, API calls, and message queues, where failed requests are automatically retried. Attackers can also trigger them by causing errors or latency, knowing that the retries will exhaust connection pools, thread limits, database capacity, or rate limits. Defenses include exponential backoff, jitter, circuit breakers, retry caps, idempotent request handling, and careful queue management.