On Tuesday 20 October 2026, a “power event” in a Google Cloud zone in London took Revolut down for hours. Cards, ATMs, transfers, the app. Tens of millions of customers. The money, they said, was safe. It could not be spent. This is 2026. A bank cannot have a single switch.
I started in this world in 1990, on BBSs. Back then they taught you — in small schools, with a modem and patience — why the Internet was born: so that a failure in one place would not darken the rest. So that traffic could route around damage. Thirty-six years later, the best online bank in Europe is dead in the water because the lights went out in a London data centre. And Google, the giant that sells five nines, takes hours to bring a zone back. Ridiculous. Shameful. Predictable.
1. Yesterday, a “power event”
At 07:08 in London, Google Cloud reported errors and network failures in europe-west2, its London region. It is the only UK region it has. The cause, in the bloodless language of the dashboard: a power event in zone europe-west2-b, at a third-party facility. It is not even a Google building. The lights went out in a shed Google rents, and it took Compute Engine, Kubernetes, Cloud SQL, storage, BigQuery, load balancers — the plumbing under half of Britain’s digital economy.
Revolut fell about an hour later. Card payments, top-ups, ATMs, FX, stocks, chat, login. At the peak, more than 1,500 reports on Downdetector. In Ireland, 3.4 million customers. In Spain, seven million. In Italy, six. In the UK, thirteen. By late afternoon Google called the incident mitigated. Revolut was still broken. At 18:39 the bank tweeted that it was back. Ten hours, give or take, with a dead card.
People at the petrol station with a full tank and no way to pay. A 71-year-old mother an hour in a supermarket queue. Car park of a shopping centre in Glasgow. A freelancer in Preston who cancels two clients because he cannot pay the venue. A flat sale stuck between owners. In Australia, a father at a petrol station, embarrassed, unable to get home to his kids. Without a card you do not leave the airport car park. You do not pay the taxi. You do not buy the coffee in transit. A bank that goes dark is not an “inconvenience”. It is people stranded.
Halifax, Lloyds, HSBC, DPD, Rightmove, Royal Mail, the NHS app, court video links in England and Wales also failed, in varying degrees. A pub manager, reduced to pen and paper, said it felt like the millennium bug had finally arrived.
2. Revolut: the best product, one switch
For anyone who travels or gets paid in more than one currency, Revolut is the best online bank there is. Seventy million customers. A $115 billion valuation. Real engineers. A Google Cloud case study. The CTO, Vlad Yatsenko, said things in that brochure that yesterday sound like a joke:
With Google Cloud, we can scale our environment on demand in minutes with zero downtime.
We can have each application running multiple instances, so everything is resilient and we don't have any downtime.
Google can offer us infrastructure that is seamless across regions. That's a huge benefit for us.
Zero downtime. Resilient. Seamless across regions. The case study’s “resilience” bullet is… disk snapshots. Backups. Not a plan B. Not a standby region. A snapshot.
Revolut operates in more than forty countries. Google has regions in Frankfurt, the Netherlands, Belgium, Zurich, Paris, Milan, Madrid, Warsaw. And still the critical path of a bank — authorise a payment, open the app, take out cash — died with one London zone. If your customers in Dublin, Berlin, Valencia and Sydney cannot pay because the lights went out in a building in London, you do not have a global architecture. You have a single switch with marketing offices.
Multi-zone has existed for fifteen years. Multi-region, longer. Active-active, circuit breakers, graceful degradation: a terminal that authorises locally if the centre dies, an ATM that dispenses against the last known balance, an app that at least lets you see the money. None of that showed up yesterday. Mid-morning, Google advised customers to move workloads to another zone. That is not resilience. That is asking the passenger to change planes after the engine is already on fire.
3. Google: in 2026, a power cut takes down a zone
Google Cloud sells 99.99% availability. It sells “independent” zones with their own power, cooling and network. It sells generators, UPS, dual feeds. Yesterday a power event in one zone, in a third-party facility, put 38 or 41 products in red and dragged the whole region into “elevated errors and intermittent network failures”.
A hyperscaler zone does not go down because of a power cut. It goes down if both feeds fail, if the generators do not start, if the UPS does not hold, if cooling takes the rest, if the partner who maintains the building’s electricity does not have the plan B Google puts on the sales sheet. In 2024 it already happened at a point of presence in the same London region: both power feeds lost to a switchgear failure. Yesterday, power again. London again. “We will investigate and publish an analysis” again.
This is 2026. Not 1998. A data centre that falls over on a power cut is a first-year howler. That it happens to Google, with a state-sized budget, is a confession: the redundancy they sell is a slide deck. The redundancy they have is a contract with a third party and a generator that, when it matters, is not enough.
There is a second, worse confession. Google said mid-morning the problem was mitigated “for most customers”. Revolut, Lloyds, the courts, ran on for hours. The hyperscaler recovers its control plane. The bank, the one with people at the pump, takes three times as long. Because the bank did not design for failure. It designed for the happy day.
4. Exactly one year ago: AWS and the card terminals
20 October 2025. The same date, a year earlier. AWS, region US-EAST-1 in Virginia. A DynamoDB DNS automation writes an empty record. Half the Internet falls over. Eight million complaints. Snapchat, Fortnite, Alexa, Canva, Duolingo. In Spain, that same morning, the card terminals go mute. Bizum. ATMs. BBVA, Santander, CaixaBank, ING. Redsys — the country’s payment rail — declares a “temporary and partial” outage; it says it is not AWS. It does not matter. The customer at the till does not distinguish clouds. They distinguish that they cannot pay for bread.
In Barcelona, at GAME, no store in the chain could take a card. On the Madrid Metro, 7,732 lost transactions. A year later, to the day, another hyperscaler, another sacred region, another bank, another morning of people in a queue. This is not an incident. It is the model.
US-EAST-1 is AWS’s navel: the oldest, the largest, the one that drags IAM, global routes, global tables. europe-west2 is Google’s British navel: the only UK region. Every industry puts the heart in one place because it is cheaper, simpler, and easier to explain to the auditor. Then the auditor asks “where is the data?” and the correct answer, for the form, is “in this region”. The correct answer so that people can still buy petrol is “in several, and if one dies, the other still pays”.
5. Spain: football turns off Cloudflare
In Spain you do not even need the lights to go out. A match will do.
Since February 2025, a ruling from Commercial Court No. 6 in Barcelona has allowed LaLiga and Telefónica to require operators to block entire IP addresses during matches. Cloudflare packs thousands of sites onto the same IPs. The cut takes down the pirate… and half of lawful Internet with it. OONI, first half of 2026: 7,441 IPs from 36 providers; 554,507 legitimate domains hit; Cloudflare, with 30% of the IPs, takes 90% of the damage: more than 501,000 sites. UNICEF, Amnesty, Greenpeace, universities, Linux Mint. Ballenoil petrol stations. Froiz supermarkets. The Redsys gateway, again. WikiDex. A cross-stitch shop. A colouring-mandala site.
Anyone who denounces it meets Tebas accusing Cloudflare of protecting trafficking, prostitution and counterfeiting. Anyone who publishes on the blocks finds, some Sundays, their own site dark: the shared IP is on the list. RootedCON has gone to the Constitutional Court. The Asociación de Internautas, to the Ombudsman. Startups document losses. LaLiga talks of €600 or €700 million in piracy. The collateral, in euros of shops and services that have nothing to do with football, is paid by someone else.
Since March 2026 the same device covers the Champions League, tennis and golf. Movistar has taken fourteen hours to lift a block: a working Monday, until half past nine. Every weekend in Spain, a football match does what a power cut in London did yesterday: it turns off a piece of the Internet because the design is a single switch — here, a shared IP; there, a Google zone.
6. The Internet was born so there would be no single point of failure
In 1990, with a BBS, a FidoNet node and 2400 baud, the lesson was physical. If your node died, mail went through another. If a line was cut, the packet took another path. Packet switching. Store-and-forward. The military network the Internet came from was designed to survive an attack: there is no centre. There are paths.
Thirty-six years later we have rebuilt the centre. Three American firms — AWS, Google, Microsoft — hold up banks, hospitals, the post, the courts, the card terminal on the corner. Each sells you “regions” and “zones” as if they were continents. Then you discover the heart of the product fits in a London building, or a Virginia cluster, or a list of IPs a Barcelona court can switch off on a Saturday at 21:20.
That is not the Internet. It is a mainframe with good marketing. And the mainframe, when the lights go out, goes dark in one piece. When the cloud falls over, what remains is the network underneath. That is why the CCIE still matters: not the certificate, the habit of not believing the slide deck.
7. Europe regulates the banner, not the blackout
This is where Europe comes in. And it comes in badly.
GDPR does not, on the letter, require data to live in a single region. It requires you to justify transfers, sign clauses, know “where the data is”. The practical result is the opposite of 1990: compliance wants a tick-box. “Data in the UK”. “Data in the EU”. Google has one region in the United Kingdom. If the British bank — or the auditor, or the committee, or the fear of Schrems — pins the data there, the single switch is blessed by the regulation. Multi-region becomes a legal problem. Single-region, a virtue. Until the lights go out.
Meanwhile DORA has been in force since January 2025. In November the European authorities designated Google, Amazon and Microsoft as critical ICT providers. In July 2026 the UK put them under direct oversight. The paper says operational resilience, exit plans, tests, a register of third parties. On Tuesday the paper did not authorise a coffee or open a car-park barrier.
Europe is extraordinary at regulating the visible and useless. The cookie banner on every site. The “I accept processing” text. The question of whether the data sits in Ireland or Frankfurt. And it is extraordinarily weak where it hurts: a bank that leaves seven million people in Spain unable to pay; a power cut that takes down the courts; a football league that turns off 500,000 lawful sites every matchday. They regulate too much. They punish badly.
The same pattern, these weeks, in the street. In France, a weekend of looting and riots, and the answer is neighbourhood curfews, Sentinelle soldiers so that the police can “focus on order”, RAID, GIGN, helicopters. In Italy, almost 200 officers injured in Milan, and Meloni sends 500 more troops until year-end, a new offence of violent participation in a demonstration, more places in juvenile centres. Measures. More measures. Not the ones a lot of people — myself included — would have wanted. The European state produces rules, decrees, banners, impact assessments. It produces late, and soft, the consequence. The person who torches a shopfront and the person who designs a bank with a single switch both sleep, the two of them, a little too well.
8. What should not happen again
I am not asking Revolut to stop being a good product. It is one. I am not asking Google to shut. I am asking for what in 1990 was first-year material: that a critical system must not have a single point of failure. That a bank still authorises a payment if London dies. That a hyperscaler not sell “independent zones” if a power cut in a third-party facility kills the zone and poisons the region. That a country not switch off half the Internet for a football match. That Europe stop measuring compliance by the banner and start measuring it by whether people can pay for petrol on a Tuesday at eight.
Yesterday was not an obscure software bug. It was electricity. In 2026. At Google. At the bank that presents itself as Europe’s future. Europe’s future, on Tuesday, was a man at the pump with a phone in his hand and a red screen.
Backups do not pay for coffee. A standby region does. If you do not have one, you are not a global bank. You are a switch with a pretty app.