Incident Database
The Most Expensive Tech Outages Ever
Updated October 2026 · 23 documented incidents · 9 carry a published cost figure, 14 do not
Largest, Where a Figure Was Actually Published
CrowdStrike Jul 2024
$5.4B
Direct losses to US Fortune 500 companies (Parametrix)
Change Healthcare 2024
~$3.1B
$2.2B response cost + $867M lost revenue, FY2024 (UnitedHealth 10-K)
Delta (CrowdStrike cascade)
$550M
$380M revenue + $170M costs, net of $50M fuel (Delta 8-K)
TSB migration, Apr 2018
£330M
Cost of the botched migration, plus a £48.65M FCA/PRA fine in 2022
AWS us-east-1, Oct 2025
$38-581M
Preliminary insured losses, likely at the low end (CyberCube)
AWS S3, Feb 2017
$150M
S&P 500 companies, 4-hour outage; +$160M US financial services (Cyence)
Full Outage Database
| Incident | Date | Duration | Published Cost | Cause | Cost Source | |
|---|---|---|---|---|---|---|
| CrowdStrike Falcon Update | Jul 2024 | ~8 hours (recovery days-weeks) | $5.4B | Faulty configuration update | Parametrix, Jul 2024 (US Fortune 500) | Details |
| Change Healthcare Ransomware | Feb 2024 | Months | ~$3.1B | Ransomware (ALPHV/BlackCat) | UnitedHealth 10-K, FY2024 | Details |
| Delta Air Lines (CrowdStrike cascade) | Jul 2024 | 5 days of cancellations | $550M | CrowdStrike-caused IT failure | Delta 8-K, Jul 2024 | Details |
| TSB Bank Migration | Apr 2018 | ~8 months to normal service | £330M + £48.65M fine | Failed IT migration | TSB results; FCA/PRA, Dec 2022 | |
| Toyota / Kojima Industries | Feb 2022 | 1 day (14 plants, 28 lines) | None published (~13,000 vehicles) | Supplier cyberattack | Toyota statement (no cost figure) | Details |
| AWS Oct 2025 (us-east-1) | Oct 2025 | ~15 hours | $38M-$581M insured | DynamoDB DNS race condition cascaded to EC2/Lambda | CyberCube, 23 Oct 2025 (insured loss) | Details |
| AWS S3 us-east-1 | Feb 2017 | ~4 hours | $150M (S&P 500) | Operator error (too many servers removed) | Cyence, via NPR, Mar 2017 | Details |
| Robinhood (COVID volatility) | Mar 2020 | Multiple days | $70M FINRA penalty | Infrastructure overload | FINRA AWC, Jun 2021 | Details |
| JBS Foods Ransomware | May 2021 | ~1 week | $11M ransom paid | REvil ransomware | JBS statement, Jun 2021 | |
| Meta (Facebook) Global Outage | Oct 2021 | ~6 hours | None published | BGP routing error | Meta blog (no cost figure) | |
| AWS us-east-1 Outage | Dec 2021 | ~7 hours | None published | Networking device issue | AWS post-event summary (no cost) | Details |
| Cloudflare Nov 2025 | Nov 2025 | ~3 hours (full restore ~6hr) | None published | Oversized bot-management config file crashed proxies | Cloudflare blog (no cost) | Details |
| Azure Front Door Oct 2025 | Oct 2025 | ~8.5 hours (global) | None published | Inadvertent config change bypassed validation, hit global edge fleet | Microsoft post-incident (no cost) | Details |
| AWS Jul 2026 (CloudFront VPC Origins) | Jul 2026 | ~3.5 hours (global) | None published | VPC Origins control-plane capacity limit (euc1-az2) served global 5xx | AWS status / The Register | Details |
| AWS May 2026 (us-east-1 / use1-az4) | May 2026 | ~28 hours (single AZ) | None published | Data-center cooling/thermal event shut down EC2/EBS hardware | AWS status / The Register | Details |
| GitHub Extended Outage | Oct 2018 | ~24 hours (partial) | None published | Database corruption cascade | GitHub post-incident (no cost) | |
| Fastly Global CDN Outage | Jun 2021 | ~1 hour | None published | Software bug triggered by customer config | Fastly post-incident (no cost) | |
| CenturyLink Network Outage | Aug 2020 | ~5 hours | None published | BGP routing announcement error | FCC report (no cost figure) | |
| Google Cloud us-central1 (fiber disconnect) | Sep 2026 | ~4h 11m (regional) | None published | All fiber paths unplugged at once during maintenance (procedural error) | Google post-incident (no cost) | Details |
| Google Cloud us-west1 (fiber/reroute) | Aug 2026 | ~2h 22m (regional) | None published | Fiber maintenance cut inter-DC capacity; automated reroute failed | Google post-incident (no cost) | Details |
| Google Cloud (IAM/Service Control) | Jun 2025 | ~3 hours (us-central1 up to ~2h 40m) | None published | Invalid quota policy update crashed Service Control, broke IAM | Google post-incident (no cost) | Details |
| Google Cloud Multi-region | Jun 2019 | ~4 hours | None published | Configuration change | Google post-incident (no cost) | |
| Azure Jan 2023 (global WAN) | Jan 2023 | ~5 hours | None published | WAN/BGP router config change broke Azure + M365 connectivity worldwide | Microsoft status / The Register | Details |
A figure appears in the cost column only where a company disclosed it, a regulator filed it, or a named analyst or insurance-modelling firm published it, and the source column names that specific surface. Where nobody has published one the cell reads "None published", which is the case for 14 of these 23 incidents: a detailed technical post-mortem is not a cost disclosure, and we do not fill the gap with a dollar guess at somebody else's losses. To put a number on an event that has none, use the duration and your own revenue: the AWS and GCP chronologies show revenue at risk per $100M of annual revenue with the arithmetic on display, and the calculator takes your own inputs. All figures in USD unless noted. Cost sources re-audited October 2026.
Cause Category Distribution
Among major publicly reported outages, software, configuration and cyber causes dominate the headline events. This skews differently from data center operator surveys: Uptime Institute's Annual Outage Analysis finds power the single most common cause of serious data center outages. The mix below is an illustrative ordering of the high-profile outages tracked on this page, not a survey statistic.
Patterns in Major Outages
Single point of failure in widely-adopted software
CrowdStrike, Fastly, CenturyLink: when a change to a widely-deployed system is incorrect, the blast radius is massive. Monocultures of infrastructure dependency are the underlying cause.
Automated delivery amplifies the failure
Manual software updates catch issues before full deployment. Automated update pipelines (continuous delivery) push failures to 100% of systems simultaneously. CrowdStrike's channel file update bypassed staged deployment.
Recovery is always harder than expected
The CrowdStrike recovery required manual intervention on 8.5 million machines - there was no automated rollback because the sensor crashed before it could roll back. This is the hidden cost of outages: recovery engineering is rarely fully planned.
Supply chain dependencies are invisible risk
The Toyota/Kojima incident and the Delta/CrowdStrike cascade show that your outage risk extends to your suppliers and vendors. Third-party risk assessment is lagging behind actual dependency.