Banking operations across the UK ground to a halt on 20 October when Google Cloud experienced a power-related incident at its London facility. Customers of Lloyds, HSBC and Revolut found themselves locked out of online services, card payments and account access. The disruption stemmed from a power event affecting Google's europe-west2 cloud region, which triggered elevated errors and intermittent network failures. Google's engineers restored most services by the end of the day, but the incident laid bare the operational fragility of financial institutions dependent on shared cloud infrastructure.

Banking Services Disrupted Across Multiple Providers

Lloyds Banking Group reported that customers experienced problems accessing online services, while HSBC acknowledged difficulties for some of its customer base. Revolut's operations were similarly affected, with users unable to process card payments or execute withdrawals, though the fintech firm stressed that customer funds and data remained secure. The outage also touched other sectors: Royal Mail and Rightmove reported service disruptions, though Reuters could not confirm whether all reported incidents traced directly to the Google Cloud failure.

Google pinpointed the europe-west2-b availability zone as the source of the disruption. After the power issue was resolved, engineers worked to restore affected workloads across the wider London region. The company ruled out any involvement of a cyberattack, characterising the incident instead as an infrastructure failure.

Regulators Turn Attention to Cloud Dependency

The timing of the outage intensified regulatory concern. In July 2026, the UK Government had designated Google Cloud, Amazon Web Services, Microsoft and Oracle as critical third parties to the financial sector, bringing them under joint oversight by the Bank of England, Prudential Regulation Authority and Financial Conduct Authority. That designation reflected fears that disruption to a single major technology supplier could cascade across multiple financial institutions simultaneously.

The incident also caught the attention of European authorities. On 21 October, Reuters reported that the European Banking Authority had reached out to Google Cloud seeking additional details about the disruption and its potential impact on financial institutions across the EU. Banks remained legally responsible for managing the operational risks tied to outsourcing, regulators emphasised.

Jamie Beckland, Chief Product Officer at APIContext, framed the outage as a test of financial resilience that banks had failed. "When a power failure at a Google data centre prevents people from accessing their money, it's a failure of financial service resilience. Banks can outsource infrastructure, but they cannot outsource responsibility for keeping their services available," Beckland said. He stressed that the real measure of resilience lay not in whether Google met its service-level agreements, but in whether customers could still make payments, access accounts and move money when critical infrastructure failed. Financial institutions needed to map their infrastructure and application dependencies end-to-end, he argued, including the customer transactions those systems supported.

Shared Infrastructure Amplifies Concentration Risk

The outage illustrated a fundamental vulnerability in modern financial architecture: organisations that appear independent to customers may rely on identical underlying technology. Dr Hamza Mutaher, Lecturer in Cyber Security at Birmingham City University, explained the dynamic: "Different businesses can appear independent or separate to one another, whilst still relying on the same cloud infrastructure behind the scenes. A disruption to that shared infrastructure can therefore have widespread knock-on effects, leaving customers unable to access otherwise unrelated services, especially when it involves a company like Google that is used by tens of thousands of organisations."

Mutaher cautioned against misinterpreting the outage as evidence of data theft or compromise. "An outage does not, by itself, mean that personal data has been stolen or compromised," he said. He recommended that organisations conduct audits of their technology dependencies and regularly stress-test how essential services would function if a major provider became unavailable.

The incident echoed earlier disruptions that had exposed the limits of cloud resilience. In September, AWS confirmed that physical damage affecting multiple availability zones in Bahrain had exceeded the protection offered by its regional infrastructure, leaving some customers unable to recover resources hosted exclusively in the affected region. For organisations reliant on cloud services, such incidents raised fundamental questions about whether existing recovery arrangements could sustain essential operations during a provider failure, particularly when multiple business functions depended on the same underlying infrastructure.