One Zone, One Bank, One Morning: What the Google Cloud London Outage Teaches Every Regulator Who Lets a Bank Run on a Single Cloud
Bottom line up front: shortly after 7 a.m. London time on October 20, a power failure in one hall of one Google data center took down a bank with tens of millions of customers, silenced remote hearings in criminal courts across England and Wales, and left people standing at checkouts from Vilnius to Australia unable to pay for groceries and fuel. Nobody attacked anything. The lights went out in a zone called europe-west2-b, and for roughly six hours everything built on top of it stopped. The headline writers asked why the internet broke. The internet did not break. A single point of failure that regulators, banks, and governments had agreed not to think about finally failed, and the question for every country that is moving its money and its courts to the cloud is who is responsible for the next one.
What Happened
Google's incident log tells the story in plain time stamps. The problem began at 23:08 Pacific time on October 19, which is 07:08 in London. For the first five hours Google reported "elevated errors and intermittent network failures" across its London region and offered no workaround. At 12:12 London time it named the cause: a power event inside the europe-west2-b zone, one of three zones that make up the region. By about 1 p.m. the company said services were recovering, though customers still could not create new workloads. Thirty-seven Google Cloud products appear on the incident, including the compute, storage, database, and messaging services that modern banks are built on. Google says a full analysis will follow.
The most visible casualty was Revolut, the London digital bank that runs on Google Cloud. Card payments, ATM withdrawals, top-ups, transfers, currency exchange, cryptocurrency trading, and even signing in to the app were unavailable or partially unavailable. A person familiar with the matter told Reuters the two failures were linked. Revolut said customers' money and data were safe and apologized. More than 1,500 Revolut outage reports reached Downdetector by 8 a.m., according to The Guardian. Customers posting on X described a 71-year-old mother stuck at a supermarket till for an hour and a driver stranded at a petrol station in Australia, because a bank whose servers sit in London serves customers everywhere.
The damage did not stop at banking. HM Courts and Tribunals Service confirmed that its Cloud Video Platform, used for remote hearings, was down across large parts of England and Wales. The Criminal Bar Association said prosecution and defense counsel could not proceed with trials and that work to clear court backlogs was set back. Lloyds, HSBC, Halifax, Bank of Scotland, ING Germany, Rightmove, DPD, and Screwfix all appeared in outage trackers the same morning. None of those have been confirmed as connected to Google, and readers should treat them as reported, not established.
"Nobody attacked anything. The lights went out in one zone, and for six hours everything built on top of it stopped."
Why One Hall Could Take Down a Bank
For readers who do not manage infrastructure, a short explanation. A cloud region such as London is made of several zones, each a separate building or hall with its own power and cooling. The design assumption is that one zone can fail without the region failing. Google's own advice to affected customers on Tuesday was to move workloads to another zone or region. That advice only helps a customer who built for it in advance.
Three lessons follow from the morning's events:
Zone failure is a known scenario that still hurt. Google's architecture worked as designed in one sense: Paris and Frankfurt were untouched, and two of London's three zones kept running. Nevertheless, a regulated bank lost its core functions for most of a business day. Either critical services were pinned to the failed zone, or the failover between zones did not work at the speed a payment system requires. Only Revolut and Google can say which, and both owe their customers and regulators that answer.
The failure was physical, not digital. Earlier this year a separate power loss at Google's London networking equipment led the company to ask its facility partner why on-site emergency power did not carry the load. Google has not yet said whether the same question applies to Tuesday. Last week OSRS wrote about attackers who reached supermarket freezers through an aging controller. This week the lesson is simpler. A substation, a switchboard, or a generator that does not start can do what no hacker did.
Concentration turns a local fault into a global one. The fault was in London. The customers were in Lithuania and Australia. When one provider hosts the bank, the courts, the delivery company, and the property portal, a single power event becomes a national incident, and the public cannot tell which of its services share the same roof.
Why Africa Should Read This Twice
Nigeria's fintechs, payment switches, and an increasing number of government services run on the same three global providers, often in a single region and sometimes in a single zone. The Central Bank of Nigeria has pushed banks toward cloud adoption and open banking; it has said far less about where those workloads sit and what happens when the region goes dark. The same is true of Ghana, Kenya, and South Africa, where the continent's largest hyperscale regions are concentrated in Johannesburg and Cape Town.
Four features make the exposure sharper than London's:
Fewer regions, longer distances. A London bank can fail over to Frankfurt. A Lagos bank on a single Johannesburg region has a longer and more expensive path to anywhere else.
Power is the weak link already. The grid that failed Google in London is one of the most reliable in the world. A data center that depends on generators every day has more chances to discover that emergency power does not carry the load.
Cash has become scarce. Nigeria's 2023 cash crisis showed what happens when electronic payments fail, and there is no paper money in circulation. A six-hour outage at a major Nigerian fintech during a salary week would be a public order problem, not a customer service problem.
The public sector is following the banks. Courts, tax authorities, and identity systems are moving to the cloud. Tuesday showed that a court can lose a day of trials to a data center power fault with no adversary involved.
An Analyst's View: Is the Cloud Still the Safer Bet?
An honest analyst must argue the other side. The strongest case against alarm is that Google's cloud, even on its worst London day, is more reliable than the server rooms it replaced. Most Nigerian banks suffered worse outages on their own hardware than Revolut suffered on Google's. Two of London's three zones never failed. The architecture gave Revolut a way out, and Revolut's engineers, not Google's power supplier, decided whether to take it. By that reading, the lesson is not to leave the cloud but to build on it properly, and regulators should ask banks for failover evidence, not for a second provider.
That argument is correct as far as it goes. It fails on one point. A regulator cannot see inside a bank's cloud architecture, and the bank has every commercial reason to run lean. Multi-zone and multi-region designs cost more, and nothing forces a bank to pay until a zone fails on a Tuesday morning. The Bank of England has already designated critical third parties for exactly this reason. The European Union's Digital Operational Resilience Act now requires financial firms to map and test their dependence on providers such as Google. Nigeria and its neighbors have no equivalent in force. The gap is not technical. It is regulatory, and it closes only when someone with authority asks the question before the outage rather than after.
"A single point of failure that everyone had agreed not to think about finally failed."
Practical steps for the audiences OSRS serves:
Central banks and regulators: Require every licensed bank and payment provider to state which cloud regions and zones carry its core services and to demonstrate, under test, that it can lose one zone without losing payments. Adopt a critical third-party regime modeled on the United Kingdom and the European Union.
Security agencies and infrastructure planners: Map which national services share a single provider, region, and power supply. Tuesday's incident touched banks, courts, and logistics at once. The equivalent map for Nigeria does not exist in public.
Business leaders and boards: Ask your technology team three questions this week. Which zone are we in? What happens if it loses power at 7 a.m.? When did we last test the answer?
Citizens: Keep enough cash for a day. Keep a second card from a second bank. The outage that strands you will not be the one you planned for.
The Bottom Line
The Google Cloud London outage was not a cyberattack and not a collapse of the internet. It was a power failure in one hall, and it was enough to stop a bank and silence a court system because too much of the country had been built on the same floor without anyone checking the wiring. Google will publish its analysis. Revolut will tell regulators what its failover did and did not do. The organizations that act before those reports arrive, by mapping their dependencies, testing their failover, and demanding resilience from the providers they cannot see inside, will be the ones still running when the next zone goes dark.
OSRS can help. OGUN Security Research and Strategic Consulting provides critical infrastructure risk assessments, cloud concentration and third-party dependency reviews, operational resilience planning, and strategic advisory services for government, law enforcement, and private-sector leaders in the United States, Nigeria, and across Africa. Contact us to schedule a briefing or a cloud resilience assessment for your organization.
Enjoyed this article? Share it with a colleague who needs to see it. Stay informed by subscribing to our email list and following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, a Professor of Cybersecurity, a national security scholar, and a television commentator. He advises government, law enforcement, academic, and private-sector organizations on security strategy and serves on advisory bodies including the Global Alternative Agenda, the Council for African Security Affairs, and the African Security Forum.
Comments