Outages are getting rarer and bigger: ten years of global failures

Major incidents at the big clouds more than doubled in two years: one tracker counts 7 in 2024 and 18 incidents in 2026 so far. Yet the Uptime Institute says outage rates per data centre have fallen for 5 years in a row. Both are right. Individual systems are getting more reliable, and each failure now reaches much further. This week’s 20-hour Microsoft 365 outage is the latest example. Here is the ten-year record, what the data does and does not show, and my forecast for the next twelve months, with probabilities.

Contents · 11 sections

TL;DR #

• Per-site outage rates are falling, and only half of data-centre operators reported an impactful outage in three years, the lowest share on record.
• The big ones are bigger: more outages run past 48 hours, one in five costs over $1 million, and hyperscaler incidents with public records more than doubled from 2024 to 2025.
• The same causes repeat: config and content pushes, DNS and identity as hidden single points, and, new in 2026, physical damage.
• Global outages come in clusters, not at an even rate.
• My forecast for the year to 13 November 2027: another “everyone notices” outage at 90–95%, three or more at 40–50%.

The catalogue: a decade of failures that everyone noticed #

These are the events that crossed from “IT problem” into the evening news. Causes come from the vendors’ own post-incident reviews unless I say otherwise.

When	Who	What happened	How long
Feb 2017	AWS S3, us-east-1	An engineer debugging billing mistyped a command and removed far more servers than intended. AWS’s own status page depended on S3.	~4 hours
Jun 2021	Fastly	A valid customer configuration change hit a latent bug deployed in May; 85% of the network returned errors.	49 min to 95% recovery
Oct 2021	Facebook	A backbone maintenance command took down all data-centre links; DNS servers then withdrew their routes and Facebook vanished from the internet.	~6 hours
Jul 2022	Rogers (Canada)	A router configuration update removed a routing filter. More than 12 million customers lost service, including 911 calls and Interac payments.	~15 hours for most, ~26 until fully restored
Jan 2023	Microsoft WAN	A router IP change during a capacity addition made the WAN recompute its routes. Teams and Outlook down globally.	~5.5 hours
Jul 2024	CrowdStrike	A faulty content update for the Falcon sensor put about 8.5 million Windows machines into boot loops.	Days: each machine needed hands-on repair
Oct 2025	AWS us-east-1	A latent race condition left DynamoDB’s regional endpoint with an empty DNS record; EC2, load balancers, Lambda and sign-in cascaded.	14 h 32 m
Oct 2025	Azure Front Door	An “inadvertent tenant configuration change”, per Microsoft’s preliminary review.	~8.4 hours
Nov 2025	Cloudflare	A database permissions change doubled the size of a feature file and the proxy crashed on it. Cloudflare called it its worst outage since 2019.	~3 h core, ~6 h full
Mar 2026	AWS UAE and Bahrain	Drone strikes during the Iran war damaged facilities; AWS told customers to move regions.	Days
Aug–Sep 2026	Microsoft 365	A “core authentication configuration” issue, per a preliminary account.	Reported 77–92 hours
Nov 2026	Microsoft 365	A network capacity upgrade, health-check failures, overload and a retry storm, per Microsoft’s status updates.	~20 hours

I checked the older entries against the vendors’ original reports and contemporary coverage before using them. The two Microsoft 365 events of 2026 rest on preliminary statements and status-page mirrors; neither had a final public review as of 13 November.

Per-site reliability is improving #

The best long-running dataset is the Uptime Institute’s annual outage analysis. Its 2026 edition, published in May, found that outage rates per site have declined for the fifth consecutive year, though the improvement is slowing. Half of operators reported an impactful outage in the past three years, the lowest share Uptime has recorded; a few years earlier it was 74%. Its count of publicly reported outages has been flat since 2021, at 109 to 122 a year.

So if you run one data centre or one service, the odds are better than they were. Power is still the top cause of serious data-centre outages, but operators have got better at managing it.

But the big ones are bigger #

The same report has the other half of the story. The share of public outages lasting more than 48 hours has risen two years running. One in five operators said their latest major outage cost more than $1 million, for the second year in a row. And Uptime says the rising cost is “primarily” because of “the increasing number of services and businesses that may be dependent, directly or indirectly, on a single data center or availability zone”.

That sentence is the whole argument. Each component is more reliable, but more of the economy sits behind each component.

The hyperscaler numbers point the same way. Control Plane, which tracks customer-facing incidents at AWS, Azure, Google Cloud and Cloudflare that have a public review or status record, counts 2 in 2022, 6 in 2023, 7 in 2024, 16 in 2025 and 18 in 2026 up to late October. I would not read that as “the clouds are falling apart”. Part of the jump is better tracking and more published reviews, and the authors say plainly that it is “not a reliability ranking”. But it is hard to explain all of it away.

Insurers see it too. Parametrix measured the AWS October 2025 event as the largest it has recorded, and later put US economic losses at over $5 billion. Insured losses stayed far smaller, because of waiting periods and low take-up.

The pattern in the causes #

Three things recur.

Config and content pushes come first. Fastly, Facebook, Rogers, CrowdStrike, Google’s June 2025 outage, Azure Front Door and Cloudflare were all valid-looking changes pushed quickly and widely that hit a latent bug. In Control Plane’s data, config and deployment changes are the largest single cause, at 32% of incidents, with a median of about 5 hours. The common thread is that data and configuration are treated as less dangerous than code, so they skip the staged rollouts code gets.

DNS, BGP and identity are the hidden single points. Facebook’s DNS withdrawal, AWS’s empty DNS record and the 2026 Microsoft authentication failure all broke a layer everything else assumes is there. When identity fails, the consoles and status pages engineers need for recovery often fail with it.

Physical risk is back. 2026 brought drone strikes on cloud regions, a thermal event in AWS’s main US region, lightning-driven power swings at Azure, and power failures at Google Cloud in the Netherlands and London. Power and cooling incidents have the longest median duration in Control Plane’s data, about 22 hours, and no rollback fixes a burnt-out hall.

Clustering: they come in bunches #

Between mid-October and early December 2025 there were four headline events in about seven weeks: AWS, Azure Front Door and two at Cloudflare. Then months of relative quiet, then 2026’s run of Microsoft 365 trouble. That is what you expect when a few large systems share dependencies and change practices. It also means a quiet quarter tells you very little.

My forecast for the next 12 months #

These are my own estimates, built from the base rates above. I count “everyone notices” events: multi-sector, multi-country, top news, many hours. There were roughly 3 in 2021, 1 in 2022, 1 in 2023, 2 in 2024, 4 in 2025 and 3–4 so far in 2026. Call it 2 to 4 a year, and rising.

From 13 November 2026 to 13 November 2027	My probability
At least one more global “everyone notices” outage	90–95%
Three or more such outages	40–50%
The trigger is again a config, content or identity change at Microsoft, AWS, Google, Cloudflare or a security agent	60–70% of those events
At least one lasts more than 24 hours	30–40%
Microsoft’s review of this week’s outage names a network or configuration change as the trigger	~85%
A hyperscaler review explicitly names AI-generated code or an AI agent as a contributing factor	15–25%

The last line is low because companies have little incentive to say so. According to CNBC, which saw both versions, an Amazon internal document in 2026 listed “GenAI-assisted changes” as a factor in a run of incidents, and the line was deleted before the meeting.

What this data can’t tell you #

Uptime’s survey is of data-centre operators, not of the hyperscalers’ internals. Control Plane’s tracker is selective, and its counts are a floor. Outage cost estimates vary by an order of magnitude depending on who is selling what. And my own news engine, LSN News, only has history from 7 November 2026. It can describe this week’s outage in detail, with 4,556 articles from 2,272 outlets in 55 languages in the main story, but it cannot yet say whether coverage of outages grows year on year.

What to watch #

• Microsoft’s post-incident review for this week’s outage: does it confirm the network-change trigger?
• Parametrix’s and Uptime’s 2026 full-year numbers, to see whether 2026 beats 2025 on critical downtime.
• Whether the post-2025 reforms work, notably Cloudflare’s “fail small” programme and stricter staged rollouts for configuration. A quiet 2027 would be evidence that they do.
• Any multi-day failure of a whole provider rather than one region. That would mean the tail is fatter than I think.

Frequently asked questions #

Are cloud outages getting more frequent? #

It depends on what you count. Per data centre, no: Uptime’s data shows five straight years of improvement. For major incidents at the big clouds with public records, yes, sharply since 2024, although better tracking explains part of that rise.

Why are outages getting bigger if systems are more reliable? #

Because more of the economy depends on fewer systems. Uptime says rising costs come “primarily” from more businesses depending on a single data centre or availability zone. A rarer failure in a more shared component hurts more people.

What causes most big outages? #

Changes. Configuration and deployment changes are the largest single cause in the hyperscaler tracker, at about a third of incidents. Power and cooling cause fewer incidents, but the ones they cause last longest.

How likely is another global outage in the next year? #

My estimate is 90–95%. At a base rate of two to four such events a year, a year without one would be unusual.

Does AI make outages more likely? #

There is no public evidence that AI caused any of the headline outages. The only documented signal is Amazon’s internal flag on AI-assisted changes, which it softened in public. Theory says faster, cheaper change brings new failure modes, so it is worth watching, not assuming.

The lesson #

Better components have not bought a calmer internet, because we used the reliability to put more eggs in fewer baskets. The forecast is not a prediction of doom: most of these events last hours, not days. But everyone chose a reliable vendor, and that is exactly the problem. Plan for the provider being down, push configuration through the same canaries as code, and keep at least your incident channel and identity path out of the shared basket.