A power event at Google Cloud’s London data centre this morning took down banking apps, retail platforms and public services at the same time, in a simultaneous failure that illustrates exactly the accumulation risk cyber underwriters have been pricing into capacity decisions for years.
The outage began at 07:08 UK time following a power failure in Google Cloud’s europe-west2-b zone, according to Reuters. Services knocked out included Revolut, Lloyds Bank, HSBC, Royal Mail, NHS England, Rightmove, Asda and DPD. Revolut, which serves more than 13 million UK customers, confirmed multiple services were unavailable. Google’s engineering team was still investigating the root cause at time of writing, with no recovery timeline confirmed and no workaround available for affected clients. Google Cloud’s status page confirmed the affected services included Google Kubernetes Engine, Cloud Run, Google App Engine, Cloud Filestore and BigQuery Data Transfer Service across the europe-west2 region.
For commercial brokers, the outage raises an immediate and practical question: are their clients’ cyber and business interruption policies written to respond when the trigger is a third-party cloud provider failure rather than a direct attack on the client’s own systems?
That depends heavily on the wording, according to Daniel Winn, tech, cyber and digital asset insurance specialist at Jensten. Some cyber policies respond broadly to system outages, he said, while others require the interruption to result from a malicious cyber event.
George Grimshaw, divisional head of cyber and technology at Clear Group, said many policies, particularly older or cheaper ones, only pay dependent BI when the provider has suffered a cyberattack. “An accidental power event like this wouldn’t qualify,” he said.
Standard BI wordings written before the widespread migration to cloud infrastructure commonly require physical damage or a direct systems breach as a trigger. A power event at a hyperscaler’s data centre that cascades into client-side revenue loss may fall outside coverage entirely unless the policy has been specifically extended to include contingent business interruption arising from cloud provider failure. Brokers who have not reviewed commercial clients’ wordings against this scenario since those clients moved core operations to cloud platforms are carrying an exposure they may not know about.
Winn said brokers need to “look beyond the headline cyber limit and examine the precise coverage triggers”, including whether non-malicious failures are covered, whether the client’s cloud provider falls within the policy’s definition of a dependent business, and any exclusions for utilities, infrastructure or widespread outages.
Even where the trigger is right, Grimshaw said dependent BI sublimits are often a fraction of the main limit, and waiting periods of typically eight to 24 hours mean a shorter outage may never reach the point where cover starts.
Google Cloud, AWS and Microsoft Azure between them underpin a substantial proportion of UK commercial digital infrastructure. When one region fails, the breadth of affected businesses reflects not individual risk management failures but a structural dependency that has built up across the economy. That is an argument brokers can take to underwriters when clients push back on cyber premium increases - and it is an argument for ensuring policy wordings explicitly address cloud outage scenarios rather than leaving coverage to be argued at claims stage.
Winn added that brokers need to understand not only which providers their clients depend on, but how long each business could keep operating if one of them became unavailable.
“A 12-hour waiting period on a business that stops trading the moment its app goes down isn’t much comfort,” said Grimshaw.
There is a separate exposure for brokers advising financial services and regulated businesses. Boards that were aware of cloud concentration risk - and it has been a documented concern for several years - and did not act on multi-cloud resilience strategies may face scrutiny from shareholders and regulators if material losses result from this morning’s outage. It is now a live conversation for D&O brokers with clients in financial services, fintech and critical national infrastructure.
