What you are describing is a DDoS and most major websites pay for services to defend against such things. To overwhelm CDN's and DDoS scrubbing centers assuming the site is using them would require overwhelming the CDN and DDoS scrubbing centers and the numbers would depend on what resources these companies have and how fat the bandwidth pipes are. About 30% of people using these services report they get overwhelmed at times.

You specifically asked about "how many users" I assume customers. Customers are rarely the ones performing a DDoS unless servers are improperly configured causing a company to DDoS itself from it's own customers. This is never intentional and is usually short lived usually because the company launched an event they did not properly plan and scale for or an engineer flubbed an update. Once the event is over or the planned change was reverted the DDoS will likely cease and some people will be fired and/or they will better plan next time maybe.

If you mean all the customers one day decided to revolt and they all agreed to commit felonies then it is unlikely they could achieve a full sustained outage for long as their identity and IP addresses are already well known. Customers do have the advantage of being able to attack authenticated and thus going deeper into the stack increasing load. If anonymous attackers can do much the company may need to rewrite everything. It would make for some good bodycam videos and I will enjoy all of them with snacks. Bonus if they manage to get reviewed by Donut Operator.

For actual DDoS attacks, official detailed numbers will never be public as this would tell attackers how much more they need to spend to achieve 100%. It will vary by company, ddos cdn's and scrubbing sites used, website infrastructure, how well applications are coded and a number of other factors.

It happens all the time, and it doesn’t even require coordination, just synchronized intent.

Examples:

- ai.com launching with a super bowl ad and being taken down just from large sign up volume

- Taylor Swift drops an album on Spotify, everyone rushes to stream it, crashes Spotify

- random small websites get featured on reddit front page and get hit offline

> how large would the number of users need to be

depends on the target. small website on shared hosting could be hit offline by 1000 concurrent users. major platform might need millions of users concurrently hitting write paths, not just loading cached/static content. or all requiring open sustained connections

> what would they have to do

just all do the same thing at the same time.

The number of users required depends on the website, what hardware it’s running on, what scaling it has in place, and what caching it has in place.

It’s called a DDOS — distributed denial of service.

It sometimes even happens inadvertently. Way back when, a server unintentionally brought to its knees by excessive traffic was said to have been “slashdotted”, after a then-popular tech site. Hitting the front page of HN or Reddit has had that effect on some sites too. It used to be more common before cloud hosting became ubiquitous — when auto-scaling apps was harder (or even essentially impossible) to implement and static-ish sites weren’t effectively hosted on CDNs.