Was the Google outage a cyber attack? How to tell an outage from an attack

MacWindowsiPhoneAndroidUpdated

Google says it was a power event. On 20 October 2026, its status page said a power event caused the outage in its London cloud zone europe-west2-b, and its final report on 27 October traces it to an underground cable fault outside the data centre and a fault in the generator controls. No source describes it as a cyber attack.

Quick answer

Google attributed the 20 October 2026 outage to a power event. Its final report says the mains supply failed because of a utility cable fault, and the backup generators didn't start because of a controller misconfiguration. No source we found describes it as a cyber attack. To judge any outage, go by what the provider and official bodies say.

What did Google say caused the outage?

Google's first updates on its Cloud Service Health page on 20 October 2026 said only that it was investigating. At 12:12 UK time it said that "due to a power event" it had suffered an outage within europe-west2-b. At 12:58 it said a power event caused the outage.

The final incident report, published on 27 October 2026, gives the detail:

  1. At 06:53 UK time, the electricity supplier lost the facility's main feed because of an underground cable fault on the utility network outside the data centre.
  2. The facility's second feed was already switched off for repairs, after problems found in a generator test on 14 October.
  3. The controllers that should have started the generators sensed voltage on the switched-off line and read the supply as healthy, so they never sent the start signal. Google calls this a misconfiguration.
  4. The batteries ran out at 07:00, and servers in the zone lost power.

Google says the primary impact was mitigated after 6 hours 8 minutes. For the full timeline, see our guide to the Google Cloud outage of 20 October 2026.

What did the affected companies say?

The Emma money app posted on X at 09:29 on 20 October 2026 that it was down because of a Google Cloud outage, and called it "a technical outage, not a security issue". Revolut posted on X the same morning that all its customers' money and data were safe, and at 18:39 said its disruption was due to a recent Google Cloud outage and that services were restored.

What is the difference between an outage and a cyber attack?

An outage means a service isn't available. A cyber attack is one possible cause, and there are many others.

The National Cyber Security Centre (NCSC) defines a cyber incident as unauthorised access, or attempted access, to an organisation's IT systems. In its small business guide to response and recovery, it says incidents can be malicious, such as denial of service attacks, malware, ransomware or phishing, or accidental, such as damage from fire, flood or theft.

The NCSC has made this distinction publicly before. On 19 July 2024, after a widely reported IT outage that followed a CrowdStrike security update, it said it assessed that the outages were not the result of a security incident or malicious cyber activity.

How can you tell which it is?

You usually can't tell from the outside, so go by what the people who run the service say.

  1. Read the provider's own status page. Google posts on status.cloud.google.com, and many banks have a service status page on their own website. Our guide is Google down or is it just me? shows where to look.
  2. Read the company's own statements. The NCSC's advice for any message you're unsure about is to contact the organisation directly, using the details on its official website rather than any in the message.
  3. Look for official statements. The NCSC published its assessment of the July 2024 outage on its website. Treat claims about a cause as unconfirmed until the provider or an official body makes them.
  4. Know what user-report sites show. Downdetector collects reports from people having problems. Its figures show that people are reporting problems with a service. The cause comes from the provider.

What should you do after a big outage?

Be careful with messages about it. In its July 2024 statement, the NCSC said an increase in phishing referencing that outage had already been observed, as opportunistic malicious actors sought to take advantage of the situation. Don't use the links or numbers in a message about an outage; the NCSC says to use the details on the organisation's official website. Our guide to scam texts after a bank outage covers the NCSC's signs of a scam, forwarding texts to 7726 and reporting fraud. For fake alert emails, see security update scam emails, and to check whether your details have turned up in a breach, see check if your password has been leaked.

Where Failshot fits

Failshot is second layer device security for your Mac, for the moment someone sits down at it. Your password is the first layer, and Failshot is the layer after it. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you the photo and the time. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. Download the Mac app from failshot.app, for macOS 14 or later. iPhone, Android and Windows versions are coming soon.

More questions

Was Google Cloud hacked on 20 October 2026?

No source says so. Google's status page described a power event, and its final report of 27 October 2026 names an underground cable fault on the utility network and a misconfiguration in the generator controls as the causes.

Why did banking apps go down if it wasn't an attack?

Some apps run on Google Cloud. When zone europe-west2-b lost power, Google says anything hosted only in that zone became unreachable and other zones were strained. Revolut and Emma both said on 20 October 2026 that their disruption was due to the Google Cloud outage.

Can a power failure really take down a data centre?

Google's report explains how it happened here: the mains feed failed, the generators didn't start, and the batteries, which Google says give 5 minutes of runtime, ran out. Servers, storage and network hardware in the zone then lost power.

Was the June 2025 Google Cloud outage an attack?

Google's report doesn't describe an attack. Its incident report for 12 June 2025 says that, from its initial analysis, it was caused by an invalid automated quota update to its API management system, which was distributed globally.

Where can I see if a cyber attack is behind an outage?

Check the provider's status page and statements, and the NCSC's news pages, where it publishes statements on major incidents. Our guide can a cyber attack take down a bank? covers incidents that have been documented.

Sources