As reported by SecurityAffairs, a Google Cloud outage in the London europe-west2 region on October 20, 2026 disrupted Revolut's card payments and ATM withdrawals across Europe, with ING Germany also reporting concurrent online banking issues. Revolut confirmed customer funds and data remained intact, but transaction availability collapsed — a distinction that matters enormously in payments infrastructure.
This incident is not a security breach, but it deserves attention from cybersecurity and resilience professionals because it illustrates a structural risk we've been flagging for years: cloud concentration in financial services has outpaced organizations' actual resilience architectures. When a single regional failure at one hyperscaler can freeze a pan-European neobank's payment rails for hours, the threat model isn't just attackers — it's the infrastructure dependency itself.
Why This Matters
Revolut operates as an app-only bank with no physical branch fallback. When Google Cloud's London region degraded, there was no alternate path for transactions to flow. The status page showed card payments and ATM withdrawals as unavailable — meaning customers at point-of-sale terminals and cash machines worldwide were stranded in real time.
The reassurance that "money and data are safe" addresses integrity and confidentiality, but says nothing about availability — the third leg of the CIA triad. For a payments platform, availability is the product.
What makes this particularly notable is the timing and scope. ING Germany reporting separate issues around the same window raises questions about whether there were cascading effects across shared infrastructure or dependent service chains. We're not alleging causation — but the pattern warrants investigation, because correlated failures across institutions often reveal hidden shared dependencies that don't appear in any single organization's architecture diagrams.
The Concentration Risk Problem
The financial services sector has migrated aggressively to a small number of hyperscalers over the past decade. The efficiency and scale benefits are real. But the systemic risk is equally real, and it manifests in two distinct ways:
- Vendor concentration: Many fintechs run the entirety of their production stack on a single cloud provider. When that provider has a regional event, there's no failover — there's just an outage.
- Regional concentration: Even organizations using multiple providers frequently deploy workloads into a single region within each provider, trading geographic resilience for latency optimization or cost savings.
Revolut's situation appears to reflect the second pattern: dependency on a single Google Cloud region for customer-facing payment services. For a regulated financial institution operating across the European Economic Area, this architecture choice carries material operational risk that should have been addressed at design time.
What Defenders and Architects Should Be Asking
For security and resilience leaders, this outage is a prompt to re-examine your own posture — not just whether you use the cloud, but how you use it. Several questions deserve immediate attention:
Shield53 Recommendations
Immediate Actions:
- Audit your critical service topology: Map every customer-facing service to its underlying cloud regions and identify single-region dependencies within 72 hours.
- Review your SLA and RTO assumptions: Confirm that your contractual SLAs with cloud providers align with your own customer commitments and regulatory obligations. The gap between these is where outages become incidents.
- Validate incident response runbooks: Ensure your communication protocols and status page processes are ready for a multi-hour regional outage — including pre-drafted customer messaging templates approved by legal and compliance.
Strategic Actions (30-90 days):
- Design and implement active-active multi-region architecture for Tier 1 payment and authentication services. Active-passive is insufficient for institutions of Revolut's scale and customer expectations.
- Conduct a full tabletop or simulation exercise around complete regional cloud loss, including downstream effects on partner integrations, card networks, and ATM operators.
- Reassess your cloud concentration risk register and present findings to the board risk committee. If a single regional event can halt your core business, that's a board-level disclosure obligation in most jurisdictions.
- For EU-regulated entities, verify alignment with DORA operational resilience requirements, which mandate mapping of ICT third-party dependencies and tested response plans for severe disruptions.
This outage will likely resolve quickly, and Google Cloud's engineering teams are among the best in the industry at rapid recovery. But the lesson isn't about Google's reliability — it's about how fintech architectures distribute risk. When your entire customer experience runs through one region at one provider, you've made a bet on availability that the math doesn't support indefinitely. The question for every CISO and CTO today is whether your organization would survive this morning's scenario — and if not, what you're doing about it before the next one hits.
