by Shehzadi NAJAF
On November 1, a Russian hosting company called Beget lost much of its cloud in a single night. An attack wiped data across its infrastructure and knocked hundreds of websites offline, and more than a thousand servers needed manual inspection before anything could come back. Around the same time, Japan’s GMO disclosed a breach at its Onamae service, a cloud desktop platform used by financial traders, where some 26,000 customer servers could be affected. Most people will never hear about either story. That quiet is exactly the problem.
We talk about the cloud as though it were weightless. It is not. It is warehouses full of machines, and a startlingly small number of companies own most of them. Amazon, Microsoft and Google together take about 63 percent of all spending on cloud infrastructure worldwide, and their networks alone carry roughly one in every thirteen bytes of global internet traffic. When so much of the world’s digital life sits in so few places, a bad day for one of them becomes a bad day for everyone.
The incidents this year show how that plays out. An outage in Amazon’s US East region reportedly stretched to about 28 hours. Microsoft, hardly a small player, has been renting capacity from Amazon to keep GitHub running as AI driven traffic outgrows its own migration plans. After last October’s big Amazon failure, one University of Surrey computer scientist pointed out that companies had leaned on a single service without planning a way around it. Every incident has its own cause. The pattern underneath never changes. When one giant stumbles, thousands of businesses that never agreed to share a fate stumble together.
This is a connectivity story, not only a technology one. When an undersea cable is cut, we understand that a country has been partly disconnected. Losing a major cloud region does something similar one layer higher. Payments stall, hospital records vanish, government portals go blank, and the physical network underneath keeps working perfectly the whole time. Nothing is broken between the two countries. The thing they were both renting is simply gone.
The strain is also growing, not shrinking. Amazon’s cloud business grew 28 percent in the first quarter of 2026, and all three of the largest providers now report capacity pressure from AI workloads, which is exactly why Microsoft has had to borrow rooms in a competitor’s house. Every new AI product, every government service moved online and every bank that retires an old data center adds more weight to the same few shelves. Nobody is deliberately building a fragile system. It becomes fragile through a thousand sensible individual decisions, each one cheaper and faster than the alternative, until the whole arrangement depends on a handful of buildings staying powered and uncompromised.
The usual advice is to spread the risk across several providers, but that helps less than it sounds. Analysts note that using multiple clouds tends to relocate concentration rather than remove it, because the menu of serious options is still the same three names. In Europe, more than 65 percent of financial firms already rely on at least two of them for critical work. Diversification on paper can still mean the same dependency in practice.
Europe has decided this can no longer be treated as a private purchasing decision. Under its Digital Operational Resilience Act, regulators named 19 critical technology providers on November 18, 2025, including Amazon, Microsoft, Google, Oracle and India’s Tata Consultancy Services, and placed them under direct supervision, with penalties that can reach one percent of a provider’s daily worldwide turnover. Britain followed in July 2026 by designating four cloud providers of its own. It is a serious step, and the first time regulators have looked directly at the suppliers rather than only at the banks that use them.
It also carries a quiet limitation. Both regimes exist to protect European and British financial systems. A designation in Frankfurt gives a bank in Lahore, a mobile money operator in Nairobi or a hospital network in Dhaka no say in how those same providers prepare for failure, even where they rent the very same machines. Oversight is arriving regionally while the dependency is global. That mismatch is where the next serious failure is most likely to land.
What would a better arrangement look like? It starts with unglamorous work. Governments and large institutions should map which providers their critical services depend on, then test what happens when one of them disappears. Exit plans need to be written before the outage, not during it. Countries should build enough regional data center capacity that one provider’s region is not a national single point of failure. And the conversation should move into forums like the International Telecommunication Union and the G20, where cloud regions can be discussed the way cables and power grids already are, as infrastructure that belongs to everyone who relies on it.
Beget’s customers learned all this in one night. The rest of us have mostly been lucky, and luck is a poor way to run the systems that hold the world’s economies together. The cloud has an address. So does the damage when it goes down.
