Summary
- Google reported a power-related disruption in its europe-west2 London region on 20 October; its service health incident lasted seven hours and 52 minutes.
- UK banks and other digital services reported interruptions, but the outage was not attributed to an attack or customer data compromise.
- The Treasury Committee asked the Bank of England and FCA how they would exercise powers over designated critical third parties.
A power event affecting Google Cloud infrastructure in London disrupted UK banking platforms, digital services and public sector operations on 20 October, exposing the operational consequences of dependencies on a shared cloud region. Google reported a failure in its europe-west2-b zone and intermittent problems elsewhere in the europe-west2 region before progressively restoring affected workloads.
Google’s incident record places the start of the disruption at approximately 07:08 BST. The provider identified service unavailability in the affected zone and elevated errors across some regional workloads. Once the power event had been mitigated, existing workloads were progressively recovered, although Google warned that creation of new resources could remain difficult. The public service health dashboard marked the incident closed after seven hours and 52 minutes; that is the provider’s reported incident duration, not a measurement of every customer’s downtime.
Banking applications were among the most visible services reporting problems. Lloyds, Halifax, HSBC and Revolut were named in contemporary accounts of customer interruptions involving access or payments; affected institutions provided differing restoration updates. Revolut said its customers’ money and information remained secure. These reports describe disruption to services, not evidence that customer balances were altered or banking systems breached.
Disruption extended beyond financial applications. Reports identified interruptions affecting the online property platform Rightmove and remote court hearings, alongside other commercial and public services. Not every unrelated online problem reported that morning can be assigned to the same root cause without supporting evidence from the organisation concerned. The common infrastructure incident nonetheless affected a range of services whose users do not necessarily know which cloud region supports the software they use.
Google’s description centres on a power event within a particular availability zone. Cloud regions are ordinarily divided into separate zones so that applications can distribute processing and data across physical infrastructure with different failure characteristics. When applications, storage or control components depend on a single impaired zone, a localized event can make an outward-facing service unavailable even if the wider cloud provider remains operational.
Some workloads may recover through provider restoration, while others require the customer to restart resources, restore connectivity or move capacity to another zone or region. Google’s status guidance acknowledged the possibility of migration to an unaffected location where practical. Such moves are not automatically available to every service: they depend on where copies of data exist, network architecture, application state, regulatory restrictions and whether an alternative deployment has already been tested.
The incident prompted scrutiny from Parliament’s Treasury Committee. On 20 October, chair Dame Meg Hillier published letters to the Governor of the Bank of England and the chief executive of the Financial Conduct Authority asking how the regulators would use their powers in relation to the outage. The questions concern the resilience of firms depending on cloud services and the oversight arrangements applying to designated critical third parties.
The UK designated Google Cloud EMEA, Microsoft Ireland Operations, Amazon Web Services EMEA and Oracle Corporation UK as critical third parties in July. Designation brings specified infrastructure providers within direct regulatory oversight for financial stability and resilience, alongside obligations on regulated financial firms. It does not predetermine whether Google or a bank breached a requirement during this incident; that would depend on evidence from the providers and supervisors.
Financial organisations typically maintain contractual service commitments, continuity plans and recovery objectives covering essential systems. Yet a dependency is rarely limited to the most obvious hosting agreement. Authentication, monitoring, data replication, managed databases and application interfaces may rely on cloud components that do not fail at the same rate or recover in the same sequence. The incident therefore raises factual questions about the resilience of entire service paths, rather than simply whether an organisation bought capacity in more than one availability zone.
UK supervisors will also need information about the duration, breadth and operational effects of the failure to assess whether it crossed firms’ reporting and resilience thresholds. The Treasury Committee has requested regulatory explanations, but that request does not predetermine an enforcement outcome. Google has said it will publish a fuller incident analysis, which should help establish precisely how the initial power event affected dependent services and what recovery arrangements were available.
Google described a power event affecting infrastructure in its London region, with no evidence disclosed of a hostile cyber intrusion. Service restoration was substantially complete on 20 October, but Google’s promised fuller incident analysis had not been published in the sources checked for this review. The Treasury Committee’s questions to the financial regulators also remain separate from any eventual regulatory finding about the response.
