OVHcloud Strasbourg fire (2021)
Fire that destroyed the SBG2 building at OVHcloud's Strasbourg site on the night of March 9 to 10, 2021 and took millions of websites down. It proved a backup kept on the same site is no backup.
On the night of March 9 to 10, 2021, shortly before 1 am, a fire broke out in the SBG2 building at OVHcloud's site on the Rhine port in Strasbourg. The building, a five-story tower designed to cool itself through natural air flow, burned down entirely; part of SBG1 was destroyed, and SBG3 and SBG4 were shut down as a precaution. Netcraft counted 3.6 million websites affected, across 464,000 domains. The fire started in a power room, near UPS units, one of which had been repaired the day before. Customers then found that their backup, bought as an option, sat in the building next door, when it was not in the same one. Several sued the host. On January 26, 2023, the Lille Métropole commercial court ordered it to compensate Bati Courtage, whose paid backup option kept the copies in the same place as the main server. A second ruling against OVH followed in March 2023 in the Bluepad case, and the host said it would appeal. For an underwriter, Strasbourg fixed two survey questions. Where does the backup sit, in kilometers? And has the building design, here a tower whose air flow feeds the fire, been reviewed by a fire engineer? The loss was also a reminder that losing a host is a contingent business interruption for thousands of insureds at once.
On March 10, 2021, an online retailer in Alsace lost its website, its catalog and five years of orders: its hosting and its optional backup were both in Strasbourg. Its commercial package policy did not cover the failure of a host, and its cyber policy paid only after an attack. It rebuilt the site in three weeks, from exports emailed to its accountant.
OVH fire, OVHcloud fire, OVHcloud Strasbourg fire, SBG2 fire
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.