The paper examines the impact of computer attacks on contractual relationships concerning the provision of digital services between service operators and their customers (users). The author identifies and substantiates a trend in Russian legislation towards imposing on digital service operators a duty to counter computer attacks. Six legally significant characteristics of such attacks are formulated, which affect their assessment in the context of civil liability for breaches of obligations caused thereby. The paper reviews doctrinal and judicial approaches to the classification of cyber‑attacks as force majeure and substantiates the desirability of a differentiated approach depending on the intensity (severity) of the attack. Based on an analysis of the application of contractual limitations of liability in the event of computer attacks, it is proposed that public law rules establishing information‑security requirements for digital services be taken into account as criteria for determining the applicable standard of due care expected of a digital service operator when providing services to third parties. Particular attention is given to the cybersecurity obligations of operators of digital services related to the issuance and exchange of digital financial assets, as well as operators of digital intermediary platforms for goods (marketplaces).