Case studies
Nine real incidents, read for what you would check on Monday morning
Each study rests only on public sources, boils down to one sentence and ends with three concrete checks. These are not stories of bad luck: they are failures you can test for in your own organization.
All case studies
Cloud· 2025
AWS us-east-1: one empty DNS record, a day of cascading failures
One empty DNS record in one region: fourteen and a half hours of disruption. The culprit was not a server, it was automation.Read the analysis and the Monday check Manufacturing· 2025Jaguar Land Rover: weeks of idle factories and a state-backed loan
A cyberattack on one manufacturer is an outage for thousands of suppliers: the government had to guarantee a £1.5bn loan.Read the analysis and the Monday check Aviation· 2025Collins Aerospace: one check-in system, four airports on paper
One check-in software vendor, four airports on paper. The manual plan B was not designed for a peak weekend.Read the analysis and the Monday check Retail· 2025Marks & Spencer: weeks without online sales
The attackers came in through a third party's help desk: your password-reset process is a front door.Read the analysis and the Monday check Healthcare· 2024Change Healthcare: one portal without MFA stalls US medical billing
Policy required multi-factor authentication; one portal was the exception. Verify, don't assume.Read the analysis and the Monday check Aviation· 2024The CrowdStrike outage: when one update grounds the planes
It was not an attack: one update deployed everywhere at once was enough. Your security tool is also a single point of failure.Read the analysis and the Monday check Energy· 2021Colonial Pipeline: ransomware that cut the fuel supply
One VPN password without a second factor was enough to stop a pipeline: the company could not show that the operational side was safe.Read the analysis and the Monday check Manufacturing· 2019Norsk Hydro: producing by hand rather than paying
Hydro did not pay: it produced by hand and told the truth. The manual mode has to exist before the attack.Read the analysis and the Monday check Finance· 2018TSB: an IT migration that paralysed a bank
A go-live date is a decision, not a plan: TSB worked backwards from the date, and its customers paid for it.Read the analysis and the Monday checkAnalyses based solely on public information, with sources. FZ Consultation was not involved in any of these incidents and has no affiliation with the organizations named.
What this outage teaches
October 2026: one Google Cloud zone in London, about eight hours
One note a month: what happened, what we do not know yet, what it teaches, and three or four checks for Monday morning. Sources read, claims attributed.