A lengthy Google Cloud outage has raised questions over the UK’s reliance on a handful of cloud providers, with organizations across a range of industries having been affected.

The incident began just after 7am UK time on 20 October and affected Google Cloud’s europe-west2-b region, one of three local availability zones in London.

Notably, the outage lasted roughly eight hours, with Google mitigating the issue at 3pm and services coming back online an hour later. By 6pm, the hyperscaler said services were restored for most customers.

Only a “very small number” of those impacted in the outage were still experiencing issues, the company added.

In a statement in the wake of the outage, Google Cloud said it will publish a full analysis of the incident once it has completed an internal investigation, urging any customers still affected to contact its support team.

Who was affected in the Google Cloud outage?

Organizations across an array of industries were impacted by the Google Cloud outage.

One of the worst-affected was online bank Revolut, with customers unable to make card payments, withdraw cash, or make transfers for several hours.

The neobank said customers’ funds and data remained secure throughout the incident.

Customers of Lloyds Bank, Halifax, and Bank of Scotland, all part of the Lloyds Banking Group, also reported issues, as did HSBC, with some customers unable to log in via the app and online.

The outage also hit the video system used by defendants, lawyers, and other parties to attend remote court hearings across England and Wales. DPD and Royal Mail are also believed to have been affected, along with Screwfix and Rightmove.

What was the cause?

As noted, Google Cloud is still to publish a full post mortem of the outage, meaning that at this stage there is very little information on the exact cause of the incident.

What we do know so far is that Google has blamed the incident on a “power event”, which is believed to have taken place at its London cloud facility.

Google is preparing a report on the outage, which should be available in the coming days or weeks. ITPro will update this article accordingly when a full explanation from Google has been published.

What happens next?

The Google Cloud outage has triggered the interest of the Financial Conduct Authority (FCA) and the Bank of England’s Prudential Regulation Authority.

The company is designated under the Critical Third Parties regime as critical to the financial services sector, and as such the two authorities have requested more information.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the incident will naturally prompt serious discussions about its impact and resilience.

“[The] outage will generate a significant number of post-incident reviews and likely some difficult conversations between firms and their regulators about whether their cloud resilience testing adequately reflected a scenario where a major provider goes down in a key region.”

What can we learn from the Google Cloud outage?

As with the AWS outage this time last year, experts have warned the incident highlights how many essential services rely on a handful of infrastructure providers.

Scott Dawson, CEO at DECTA UK, said there will undoubtedly be “uncomfortable conversations in IT departments” as a result of the outage.

“Banks and payment providers spend a fortune on keeping their systems running, but how many know whether their backup supplier is using the same Google infrastructure as their main one? That’s something I’d want an answer to,” he said.

“We’ve known for years that cloud services can fail, and there’s really no excuse for waiting until customers are locked out of their accounts to find out whether your contingency plans work.”

Other industry experts have reiterated that the Google Cloud outage shows the importance of digital sovereignty and stronger regional infrastructure capabilities.

Mark Boost, CEO of UK-based cloud provider, Civo, said the outage highlights the risk of overreliance on foreign infrastructure providers.

“True operational resilience simply cannot exist when critical workloads are concentrated in a handful of foreign platforms; it requires open, hybrid, and multi-cloud environments,” he said.

“When the failure of a single foreign hyperscaler has a large-scale impact on the UK’s digital economy, then the tech stack is not robust; it is merely a business risk.”

Boost added that the outage should serve as a “clear directive” that greater investment is needed in UK sovereign capabilities.

Jon Lucas, director and co-founder of Hyve Managed Hosting, echoed Boost’s comments regarding overreliance on foreign cloud providers.

“The incident highlights how businesses relying too heavily on a single cloud provider risk being left without a viable alternative when services fail,” he said.

Lucas noted, however, that diversification of services isn’t quite enough.

“Workload portability is essential,” he said. “Businesses must be aware and avoid unnecessary vendor lock-in and ensure they can move critical applications and data between environments without major disruption.”

FOLLOW US ON SOCIAL MEDIA