A global internet outage would kill payments in minutes and shelves in days

On Thursday 12 November 2026, at 16:17 UTC, Microsoft’s cloud began to fail. Within about an hour Downdetector counted outage reports from 74 countries and territories. Outlook, Teams, SharePoint Online, Copilot, Defender and the Intune management console went down together, and Kentik’s Doug Madory later put the downtime at roughly 18 hours. Microsoft said it saw no evidence of malicious activity. On Friday morning it still had not published a root cause, only that a large number of servers had become unexpectedly unavailable, while the engineer Gergely Orosz wrote that twelve hours in, nobody had worked out what was killing servers as they came back online.

A Thursday in November that already looked like a rehearsal

That is one company, one cloud, about a day. It is also the closest public rehearsal for the question this article asks: what happens to the world, and to an ordinary week, if every online system stops at once?

The question attracts bad answers. Disaster fiction paints darkness, riots and collapse by Tuesday. Corporate risk papers list “business continuity exposures” in a tidy table. Neither tells you what breaks first, what breaks second and where the damage stops. A usable answer starts from failures that have already happened, reads exactly what each one broke, and then stacks them with the grace periods removed.

The record is longer than most people remember. In July 2024 a faulty CrowdStrike update crashed about 8.5 million Windows devices. The insurer Parametrix put direct losses for the US Fortune 500 at $5.4 billion, with roughly three quarters of the health and banking firms in that group paying direct costs. In April 2025 a voltage collapse cut power to about 60 million people in Spain and Portugal, and some areas waited up to 16 hours. In September 2025 a firewall upgrade at the Australian carrier Optus blocked emergency calls for about 13 hours; at least four people who tried to call later died, and a subsequent report tied the upgrade’s failures to two of those deaths. In October 2025 a DNS race condition inside Amazon’s DynamoDB service in Northern Virginia knocked out large parts of AWS. DynamoDB itself recovered in under three hours, but the services built on top of it kept failing until the afternoon. In November 2025 a database permission change at Cloudflare doubled the size of a bot-management file, crashed the proxy software that reads it and cut core traffic for about three hours, with full restoration after nearly six.

The Microsoft outage also did not stay inside Microsoft. Downdetector’s crowdsourced reports that Friday included Gmail, WhatsApp, Claude, Lloyds Bank and, in Britain, the 999 emergency number and NHS England. Crowdsourced reports prove neither cause nor scale, and some of those spikes may be users who could not reach a service through a Microsoft-based sign-in or workflow. The pattern still matters, because it shows how little a user can see of the chain behind a button. The Conversation reported that OpenAI and Anthropic both had problems with the tools that connect their AI services to Microsoft 365. A year of tracking by Control Plane counts 18 major outages at AWS, Azure, Google Cloud and Cloudflare in 2026 alone, and Microsoft’s previous disruption, in September, ran for days.

Every one of these events was a slice. Every one was repaired by people who still had working phones, power, email and internet to coordinate the repair. During the Microsoft incident, administrators compared notes on Reddit, Mastodon, Bluesky and LinkedIn, and none of those platforms was down. A total outage removes that last condition, and it is the point the rest of this article returns to. The worst case is not data vanishing. It is the loss of the coordination layer: the shared clock, the payment rail, the sign-in, the message that tells a truck where to go, and the same loss striking the people who would normally fix it.

Three habits govern the text that follows. Facts carry a source and a date. Mechanisms, the explanations of why one failure drags another behind it, are labelled as explanation. Judgements, such as which scenario is more plausible than another, are labelled as mine, because no dataset settles them. Everything is dated to 13 November 2026, a day on which the Microsoft outage was still being repaired and its cause was still unpublished.

Defining a total outage and its honest limits

Read literally, “all online systems at once” cannot happen. The public internet is stitched together from tens of thousands of independently operated networks, and many systems that matter, from military networks to plant-floor controllers, sit on private links that no single fault reaches. A scenario that required every one of them to fail in the same minute would need a cause with no known counterpart.

So this article uses a narrower definition and states it plainly. A total outage here means a correlated failure that takes the commercial internet away from most users in most regions for at least several days, leaving local islands that work and little else. It does not require every cable to be cut or every server to be wiped. It requires that at least three of five layers fail together: physical transport (fibre, subsea cables, mobile networks), naming and routing (DNS and BGP), cloud and delivery platforms, identity and sign-in, and the applications on top.

“Online” needs a boundary too. In the sense that matters for daily life, an online system is any system that needs a round trip to a machine its user does not control. That covers a card terminal asking a bank for permission, a pharmacy checking an insurance claim, a warehouse scanner receiving its next pick, a rail signaller consulting a timetable server, and a mobile phone whose network core runs on internet protocols. It leaves out a light switch, a gas stove, a mechanical lock and an AM radio. The gap between the two lists is the size of the problem. In many countries the traditional telephone network is also moving onto internet protocols, which removes one more fallback.

Three facts keep the scenario from sliding into fiction. First, correlated failures already occur when providers share a dependency, and the frequency is not small. Beyond the 18 major outages Control Plane counts for 2026, a thermal event in a single AWS us-east-1 availability zone in May took 21 hours and 30 minutes to reach majority recovery. Second, the longest public outages measured so far run from hours to a few days. TechCrunch described the September 2026 Microsoft disruption as lasting days, and Microsoft blamed a core authentication configuration. Third, nothing on record has lasted weeks across regions.

That third fact sets the limit of what can be called evidence. Everything in the first 72 hours can lean on documented incidents. Anything beyond day three is extrapolation from components, and the text says so each time it crosses that line. The article therefore reads in three horizons: the first hour, the first 72 hours, and the first two weeks.

The tone is deliberately hard on the way modern systems are built and deliberately cautious about claims. Dependency chains that nobody mapped are a legitimate target for blunt criticism. A confident forecast of riots in week one is not, because the Iberian blackout, the best large-scale natural experiment Europe has had in two decades, produced queues, shelter beds and traffic improvised by volunteers rather than collapse. Where the evidence is that mild, the text says it is mild. Where the evidence is that bad, as with emergency calls, it says that too.

The article does not assign probabilities to a total outage. Published estimates of that kind either hide their assumptions or mix incompatible causes. A later section ranks five credible routes to a near-total failure by plausibility and damage, and that ranking is an editorial judgement, not a forecast.

The internet as a stack of dependencies, not a switch

People talk about “the internet going down” as if it were a lamp on a wall. It is closer to a building with forty floors where the lift, the stairs and the water pump are all run from the top one. A page loads because a dozen separate systems agree, in sequence, in under a second. If any layer disagrees, the page does not load, and the user sees the same blank screen whatever the layer.

The bottom layer is physical: fibre in the ground, cables on the seabed, mobile masts, data centres and the electricity that feeds all of them. Above it sits routing, the protocol called BGP through which independent networks tell each other which addresses they can reach. Above routing sits naming, the DNS that turns a readable name into a machine address. Then comes the encrypted connection, which needs a valid certificate and a correct clock. Then the platforms, the clouds and content delivery networks that host the code. Then identity, the system that decides who you are. Last comes the application, and behind the application the business process: a card payment, a prescription, a delivery.

A single card payment shows the sequence. As an explanation rather than a measured fact: the terminal looks up an address through DNS, opens an encrypted session, and sends a message through an acquirer to a card network, which routes it to the issuing bank. The issuer’s fraud engine runs in some cloud region and checks a database in another. The reply travels the same path in reverse. The round trip finishes in a couple of seconds, it touches easily half a dozen independent organisations, and none of them is visible to the cashier.

The October 2025 AWS failure is the cleanest published demonstration of how a bottom-layer fault climbs. AWS’s own summary traces it to a latent race condition in the automation that manages DNS records for DynamoDB’s regional endpoint in Northern Virginia. Automated components applied conflicting plans and left an empty record: the name existed, but it pointed to no address. From 11:48 PM Pacific on 19 October, every system that needed DynamoDB through its public endpoint in that region failed to connect. Engineers pinned the cause to DynamoDB’s DNS state at 12:38 AM, and DynamoDB errors ended at 2:40 AM. EC2 launch failures lasted until 1:50 PM, because new servers could not start while the systems that manage them worked through a recovering backlog. Network load balancers had their own faults between 5:30 AM and 2:09 PM. Nothing was hacked and nothing was physically broken, and one missing record took about fourteen and a half hours to unwind.

The geography of the damage fooled many readers. Analyses of AWS’s post-event summary point out that customers outside Northern Virginia were hit when authentication, deployment or control-plane services depended on that region, and one such analysis cites AWS’s own account of Redshift customers in other regions meeting an identity-service dependency there. Running servers in a second region is not the same as being operationally independent of the first. A firm can keep its web servers and database replicas in Frankfurt and still fail because the sign-in service it relies on lives in Virginia.

The Microsoft incident has the same shape on a larger scale. Microsoft first traced the outage to cloud-based server problems in the Americas, which it said overloaded the remaining infrastructure and spread the disruption to other regions. The mechanism is familiar to anyone who has watched a motorway jam form. Healthy capacity absorbs the traffic of failed capacity, becomes overloaded and fails in turn, and every client that retries adds load. Recovery then takes longer than the fault, because a server that restarts has to rejoin services that are themselves overloaded. That is explanation, not Microsoft’s published account, which at the time of writing is still thin.

Cloudflare’s November 2025 outage adds a smaller, more human detail. The first hypothesis inside the company was a hyper-scale DDoS attack, partly because Cloudflare’s own status page, hosted off its platform, happened to fail at the same moment. The real cause was a permissions change in a ClickHouse database that doubled the size of a configuration file for bot management. The file crossed a hard-coded limit of 200 features, an unhandled error crashed the proxy software, and for a while the network flipped between working and failing every few minutes as good and bad versions of the file alternated. During an incident, the status page of the provider is a dependency too.

Each layer fails at a different speed and is repaired by a different method. A bad DNS record or routing change gets fixed by a rollback, in minutes to hours, if the people who own it can still reach their own tools. Certificate and clock errors need hands on individual machines. Physical faults need ships, trucks and spare parts, in days to months. A total outage becomes dangerous in proportion to how many layers need manual repair at the same time. The Parametrix chief executive advised firms to map their service providers and assess their dependence on each, and the advice is sound. It also describes a task that almost nobody has finished, including the operators themselves.

Concentration risk in three clouds and a handful of gatekeepers

Synergy Research Group’s third-quarter 2026 figures put worldwide spending on cloud infrastructure services at about $168 billion for the quarter, up 55% on the year and more than double the level of the same quarter in 2024. Amazon holds 26% of the market, Microsoft 19% and Google 16%. Three companies therefore carry 61% of the money spent, and the United States accounts for 44% of the global total. A year earlier the same three held roughly 63%. They are slowly losing share to neoclouds built for AI work, but the market grew so quickly that their absolute capacity is larger than ever, and AI-specific services now make up about a third of everything sold. Growth is moving concentration around more than it is reducing it.

The pattern repeats at other layers. Cloudflare’s reverse proxy sat in front of about 20.5% of all websites at the end of 2025, according to W3Techs figures cited by the incident-tracking firm ilert, which put its share of the reverse-proxy market near 81%. In July 2024 CrowdStrike’s sensor sat inside roughly 8.5 million Windows machines, less than 1% of all Windows devices, yet the crash reached about a quarter of the Fortune 500, all six of the airlines in that group and about three quarters of its health and banking firms. A small share of devices carried a large share of the damage because they were the right devices: check-in desks, hospital workstations, trading floors.

Identity is the quietest concentration. Most people sign in to dozens of services with a small number of accounts, and recovery for those accounts usually runs through email. During the Microsoft outage the security researcher Troy Hunt wrote that he was locked out of several services that use email for login, and said that with a handful of companies supplying the infrastructure, an ordinary business has little it can do to plan for the failure of one. It is a pessimistic view, but it matches the way the dependency chain is built.

The honest counterpoint is that concentration also buys quality. Parametrix found in the CrowdStrike case that cloud-based systems recovered faster than traditional computing setups. A large provider employs more engineers, runs more monitoring and keeps more spare parts than a small firm’s single server room ever will. The trade is between frequency and correlation. A thousand firms with a thousand separate server rooms each fail rarely and independently, and the economy keeps running around the gaps. The same thousand firms on one cloud region fail less often and all at once. A total outage lives entirely in the correlation, not in the frequency.

Why does concentration persist? Price, features, hiring and compliance all favour the big platforms, and none of them prices the spillover. A firm that picks a single provider bears its own outage costs, not the economy’s. Parametrix put the average direct loss at $44 million for each affected Fortune 500 company and expected cyber insurance to cover only 10% to 20% of the total. CyberCube estimated insured losses from the CrowdStrike event between $400 million and $1.5 billion and called it potentially the worst loss in the cyber insurance market in 20 years. Insurers cannot absorb a systemic event, so they cap their cover, and the risk returns to firms and, at the edge, to the public.

Spare capacity is the other missing price. Nobody is paid to keep idle servers for the benefit of strangers, yet idle servers are exactly what absorb the load of a failed neighbour. One comparison of the three providers’ third-quarter results describes all three as short of capacity while AI demand grows. I cannot verify failover headroom from outside, and the providers do not publish it. It is nevertheless reasonable to read the Microsoft account of overloaded remaining infrastructure as a sign that headroom is thinner than the market shares suggest. That is a judgement, and it is the first of several in this article that rest on what operators do not disclose.

Four failures, one pattern: small changes with global reach

Four recent incidents can be laid side by side. They differ in cause and in duration. What they share is more telling than what separates them.

Four large failures compared, 2024 to 2026

The table is deliberately plain, and its main message is in the “trigger” column. None of the four is known to have involved an attacker. A quality-control bug, a race condition, a permissions tweak and an as yet unexplained server failure were enough, and in the first three cases the trigger was a routine change pushed through trusted automation. CrowdStrike needed about six days to bring 97% of the affected machines back, because fixing a machine that cannot boot means touching the machine. The other three recovered in hours because the repair was a rollback that the operator could push from a central point.

Several traits repeat. The change was small and routine. The automation that applied it was trusted and fast, so it reached the whole fleet before any human could look. The blast radius had not been tested, because nobody had imagined that file, that record or that permission as a global switch. The recovery took longer than the fault, since restarting systems queue behind each other. And the first diagnosis was uncertain. Cloudflare suspected a DDoS attack. Microsoft’s status page first said the outage involved no security issue, then revised the line to say it was not aware of any malicious activity. Neither company lied; both were reporting the limit of what they knew in the first hours.

That uncertainty is a hazard in itself. In a real total outage the first question every government and operator would ask is whether it is an accident or an attack, and the answer determines the response: isolate and rebuild, or fix and restore. An attacker who understands this can hide inside the ambiguity. A defender who guesses wrong in either direction loses days. It is one of the reasons accident data is a fair guide to the worst case. Accidents show the mechanism a deliberate actor would copy: a small change, pushed through trusted automation, with global reach.

There is also a lesson in what the four did not do. None of them took down every provider at once. When AWS failed, Microsoft and Google ran. When Cloudflare failed, most sites that did not use it stayed up. The world’s online systems are less synchronised than the headline “half the internet is down” suggests, and that mismatch is the only reason the previous incidents ended in costs measured in billions rather than in a crisis. The scenario of this article removes that mismatch. It assumes the same kind of trigger acting on a layer that every provider shares: a common library, a common certificate authority, a common time source, a common update channel or a common cable corridor.

Which shared layers exist is not secret. Time is one, and a later section covers GPS. Software supply chains are another, and the CrowdStrike incident is the proof of concept. Routing is a third: the global BGP table has no central authority, and a bad announcement from one network can reach the rest within minutes, as Cloudflare has described in earlier incidents. DNS root and top-level infrastructure is a fourth, resilient by design but not independent of the operators who run it. None of these is a prediction. Each is a place where a small change could have a global reach, and the history above shows that small changes already do.

The first sixty minutes of a worldwide outage

What follows is scenario extrapolation, built from the incidents above and labelled as such. It assumes a cause that takes down cloud platforms, major content networks and the identity services layered on top of them, while power stays on and most physical networks stay intact. That is the mildest version of a total outage, and it is already severe.

In the first five minutes nobody knows what is happening. Users see apps spin and pages fail. Inside companies, the monitoring tools that would announce the problem often run in the same clouds that have failed, so the dashboards go dark or freeze. The Microsoft incident showed the pattern in small: administrators could not reach management consoles and learned about the outage from public trackers, which themselves depended on the working parts of the internet. In a total outage the trackers would fail too. An organisation would not even be able to check whether it is the only one affected.

By minute fifteen, card payments start to fail in earnest. A terminal that cannot reach its acquirer cannot approve a purchase, and online banking, mobile wallets and transfers stop. Airline check-in, boarding and crew-scheduling systems stall, much as they did in July 2024, when CrowdStrike’s update contributed to more than 3,000 flight cancellations and delayed 23,900 more. Ride and delivery apps go quiet. Offices cannot reach email or documents. Mobile voice calls might continue for a time, because voice has traditionally run on separate signalling, but the core networks of modern operators run on internet protocols and cloud-hosted components, so how long voice survives is an open question, and the answer differs by country and carrier.

By minute thirty, behaviour changes. The Iberian blackout of 28 April 2025 offers the best European record of how people react in the first hours, and it is gentler than the film version. ENTSO-E’s expert panel found that the system went from normal to blackout in about 90 seconds. Within hours, stores in Barcelona were selling battery radios, generator shops in Terrassa had run out, queues formed for emergency supplies in Portugal, and civilians directed traffic at dead junctions in Madrid and Barcelona. Spain’s prime minister asked the public to call emergency services only if really necessary. People searched for information with the one tool that still worked, the radio.

Information is the scarcest resource in this window. Governments and broadcasters have working alternatives, since radio and television transmitters have their own power and the mobile network can still push cell-broadcast alerts in some countries, although how many handsets would receive them without a working data connection is uncertain. But official messaging depends on the people who write it being able to reach one another. The cabinet that must meet by video link cannot. The emergency coordinator who must check hospital capacity through a web portal cannot. In the Iberian case, the Spanish government convened its national security council the same afternoon, because the people involved were in the same city. A country with its crisis staff in one place coped better than a company with its staff on four continents.

By minute sixty the first measurable harms arrive. Emergency calls are the sharpest. In the Optus failure, 13 hours of blocked calls produced about 600 failed calls and at least four deaths, on a single carrier and with other networks working. In a worldwide outage the question is not whether some calls fail but how many dispatch centres can still receive and route them, and whether an ambulance crew still gets an address. Hospitals begin to lose electronic records. Pharmacies cannot verify claims or prescriptions. Transport networks that rely on live scheduling start to improvise.

The first hour produces few dead and many unanswered questions. It is the hours that follow that turn inconvenience into harm, because the grace periods built into modern life, a charged phone, a full tank, a store’s stock, a bank balance that is still readable, begin to run out one after another. The next sections take each of those clocks in turn.

Cards, ATMs and the cash gap

Payment is where a total outage becomes personal within minutes. Card authorisation is an online round trip: the terminal asks, the issuing bank answers. If the terminal cannot reach its acquirer, the purchase either fails or falls back to an offline mode whose behaviour depends on how the merchant and the acquirer configured it, usually with low limits and often switched off. Most customers would find out at the till, and most cashiers would have no instruction for what to do next.

The Iberian blackout shows how this looks in practice, with a caveat worth keeping. On 28 April 2025 the Bank of Spain said electronic banking was working adequately on backup systems. At the same time residents reported ATM screens going blank, and in Portugal ATMs and electronic payment systems were affected. The ledgers survived, but the front doors did not. That split is the pattern to expect from a network failure: balances sit in redundant data centres, while the terminals, apps and links that let a person reach them stop working. Banking is also not a sector that escapes losses by staying open. Parametrix assigned $1.15 billion of the CrowdStrike damage to Fortune 500 banks.

Retail shows the same weakness from the shop floor. One account of the spring 2025 attacks on Marks & Spencer and the Co-op says that online systems were shut down in response, that payments could not be accepted and that shelves emptied as supply chains stalled. Those were two companies, with every other retailer and bank still working. A shop that cannot reach its payment provider also usually cannot reach its price file, its stock system or its loyalty database, because they sit in the same cloud. A till is one thing; a till that knows what a litre of milk costs is another.

Then comes the cash question. On 3 November 2026 the European Commission published guidance telling households to be able to cope on their own for at least 72 hours in a crisis. The guidance says households should keep cash, including small notes and coins, in case digital payment systems fail, and where possible a digital payment method that works offline. It is a communication, not a law. It names seven categories of need, sets no quantities and imposes no obligations. No statistic tells us how many households hold three days of cash. The fact that officials felt the need to say it is evidence that they suspect many do not, and that suspicion is a judgement I share.

An ATM has the same dependencies as a till and two more. It needs a network connection to authorise a withdrawal, and it needs a cash-in-transit firm whose dispatch, routing and vault systems are themselves online. A customer with a healthy bank balance, a valid card and a working ID could therefore stand in front of a closed machine and a closed branch, because a branch cannot confirm identity or move money without its systems. Cash is a stock, not a flow, and a total outage turns a flow economy into a stock economy overnight. The ones who fare well are those who already hold stock: small shops with cash boxes, market traders, tourists carrying notes, and older people who never stopped using cash.

Behind the retail layer sits wholesale money. The UK government has said that about £1.4 trillion in daily UK transactions depends on the subsea cable industry, and that about 65 cables connect the country. Central banks and payment operators run private networks and rehearse failovers, and it would be unfair to assume they have no plan. I have found no public test, however, of a simultaneous loss of the public cloud layer and the networks that carry settlement. In that gap sits a problem that no outside observer can size: transactions caught in flight. A transfer that was accepted by one system and not yet recorded by another leaves two ledgers that disagree, and settling the disagreement can take days even after the connection returns.

The ledger gap has a human side. When systems restart, the first priority is to bring up the ones that move money safely, and the second is to reconcile what happened during the gap. Customers whose salary or benefit payment fell inside the window may wait longer than customers whose money did not move. People living close to the edge, who spend their income as it arrives, carry the heaviest burden of any short-term freeze. A payments failure that lasts 24 hours is an inconvenience for a household with savings and a crisis for one without.

For that reason payments are both the first system to fail and the first that individuals can partly repair themselves, with a few notes and some coins. It explains why cash appears in every official kit list. But cash only works if there is something to buy, and stocks of goods behave on a different clock. That is the subject of a later section.

Telecom networks and the emergency call that never connects

The Optus failure of 18 September 2025 is the best documented case of an emergency system failing without anyone inside the company knowing. Optus began a routine firewall upgrade at about 12:30 AM. The upgrade blocked calls to the Triple Zero emergency number for customers in South Australia, Western Australia, the Northern Territory and New South Wales. Ordinary calls kept working. The safety net that should have routed an emergency call through another carrier’s network, called camp-on, did not work either. Optus learned of the fault shortly after midday, stopped the upgrade and restored emergency calling after about 13 hours.

Chief executive Stephen Rue said no alarms had told the company that some emergency calls were failing. A customer had phoned a contact centre at around 9 AM to complain, and at least five customers contacted overseas centres during the outage, where operators did not escalate the warnings. A later report found at least ten mistakes by technicians and described bad instructions from the company. It also noted that Optus’s process did not capture “grey” devices that had been bought online or overseas and might not comply. The first estimate was about 600 failed calls. The Australian communications regulator later found that 2,145 people had been denied emergency call access, and that Optus had not carried out welfare checks on 369 of those who tried to call. At least four people who tried to call died, and the independent report tied the upgrade’s failures to two of those deaths. The regulator has since started Federal Court proceedings.

Emergency calling is a service where silence looks identical to success. A dispatch centre that receives no calls looks fine, a monitoring dashboard that counts only completed calls looks fine, and the failure shows up only when a person who is not breathing is not reached. That property matters for a total outage, because the monitoring that would catch a failure depends on the same network and the same operational discipline that has just broken.

Scale the Australian case up. An emergency call passes through the access network, which is the radio mast or the fixed line, then through the operator’s core, which is increasingly software and in some operators partly cloud-hosted, then across interconnection points between operators, then through the routing layer that picks the correct dispatch centre, and finally into the dispatch centre’s own software that locates the caller and assigns a crew. In many countries the circuit-switched telephone network, which tolerated a surprising amount of abuse, is being retired, and emergency services are moving to internet protocols. That move brings better location data and richer media. It also ties the emergency call to the same dependency chain as everything else, and that trade deserves more public debate than it has had.

The evidence for mobile networks under stress comes from the Iberian blackout, where the cause was power rather than internet failure. The AP reported that millions of people lost phone and internet coverage, that calls were impossible on most mobile networks and that some apps worked sporadically. In a scenario where power stays on but cloud services fail, masts would keep radiating, and the answer would depend on how each operator built its core. Some networks would hold. Others would fail. I cannot name which ones, and neither can most regulators, because the dependency maps are private.

Dedicated radio networks used by police, fire and ambulance crews run separately in most countries and would probably keep working. The weak link is the public’s route to them. A person with a dead phone needs a working landline, a neighbour whose phone works, a fire station or a police station within walking distance, or a lift from someone who is heading that way. In a rural area that is a long list of ifs. Welfare checks, the routine step that follows any known failure, would become the main emergency task. After the Optus incident, South Australia Police carried out 154 welfare checks on one carrier’s customers within about two days. In a worldwide outage the number of people who would need checking, many of them old, isolated or dependent on powered devices such as oxygen concentrators, runs into the millions.

The Iberian authorities understood the risk. Spain’s prime minister asked the public to call emergency services only if really necessary, and Portuguese police put more officers on duty to cope with calls for help, including from people trapped in elevators. Those are the instruments of a state that still has a working command chain. The European Commission’s November 2026 package includes a non-binding recommendation on operational continuity and stress-testing, although it covers the national contact points of the EU Civil Protection Mechanism and not public emergency calling. Until stress tests include the loss of the public cloud layer, the honest description of emergency calling in a total outage is this: the dedicated radios would probably work, the public’s access would probably not, and no one knows by how much.

A power grid that needs its own communications

The electricity grid is the one dependency that all the others share, and the Iberian blackout of 28 April 2025 is the best evidence Europe has of what its failure feels like. A 49-member expert panel under ENTSO-E, the association of European transmission operators, spent almost a year on the case and published a 472-page final report in March 2026. It called the event the most severe in Europe in 20 years. At about 12:33 CEST the system went from a normal day to a blackout in roughly 90 seconds, and around 60 million people lost power.

The report is a warning about unknown unknowns. ENTSO-E found no single cause. It described a rapid rise in voltage, oscillations, uneven control of voltage by individual generators, limited reactive power capacity and a cascade of generator disconnections, many of which were inverters tripping on overvoltage. Earlier reporting called it the first known blackout caused by excessive voltage, and an analysis of the final report in POWER magazine says that the existing defence architecture was not equipped to interrupt an overvoltage cascade. The grid’s own engineers had not planned for the mechanism that took it down. That sentence deserves to sit beside any confident claim about what a different, larger failure would or would not do.

The restart tells the second half of the story. Spain had recovered more than 92% of its power by 5 AM on Tuesday, roughly 16 hours after the collapse, although some areas waited longer for stable supply. At 8:35 PM on Monday only 35% of demand had been restored. Electricity was pulled in from Morocco and France to restart the south and the north. Hospitals and emergency services ran on generators, gas stations stopped working, and the German outlet heise reported that at least seven people died of indirect consequences, three of them from carbon monoxide poisoning caused by emergency generators. The most dangerous object in a long blackout can be the machine people buy to survive it.

Now add the internet. Protection equipment inside substations acts locally in milliseconds and needs no network to open a breaker. That is by design, and it is why a loss of cloud services would not by itself switch the lights off. What degrades is everything above the protection layer: coordination between control centres, remote dispatch of wind and solar plants, market systems that schedule generation, forecasting, smart-meter data, demand response, and the remote access that lets an engineer reconfigure a substation from a desk. Operators run private networks for the most sensitive control traffic, and I cannot see inside those. I can say that the share of grid operations that touch IP-based systems has grown steadily, and that the dependence is circular. Masts and data centres need power, and the grid needs communications that run through masts and data centres.

In the first hours of a pure internet outage the grid would probably cope, because its core control loops are local and its operators are trained to run it in degraded modes. The risk rises with time and with the fraction of generation that is small, distributed and remotely controlled, such as rooftop and farm solar. The more of the system that is a million small devices and the fewer large synchronous machines, the more the grid depends on software and communications to stay stable. The Iberian report found Spain’s system short of the voltage control it needed on that day. A grid short on control and also short on communications is a worse place to be.

The combined case is the true nightmare for restoration. Restarting a grid after a collapse, called black start, needs control centres to talk to plants, plants to talk to each other, and neighbouring operators to agree when to reconnect. In Iberia all of that was possible, and it still took most of a day. If the communications layer were also degraded, restoration would likely take longer. That is my judgement from the way black start works, not a published result, and I know of no public exercise that tests it end to end.

The grid is also a target as well as a victim. US agencies assessed that the Chinese state-sponsored group Volt Typhoon had compromised IT environments in the communications, energy, transportation and water sectors and had remained inside some networks for as long as five years. Their stated concern was access that could allow movement into operational technology, including heating and cooling in server rooms and the control of energy and water systems. The agencies also said they had not seen the group use that access to disrupt anything. A later section returns to this.

For households the lesson of Iberia is practical. A grid collapse lasting 16 hours produced shelters, queues and improvised traffic control, but no breakdown of order. A collapse lasting a week would be a different event, because refrigerated food, medicines and heating all run on clocks measured in hours and days. Battery radios, cash, water and a safe way to run any generator are the unglamorous items that appear in every official list for that reason.

GPS time as the silent synchroniser

Most people think of GPS as a map. For the infrastructure of the internet it is mainly a clock. Cellular networks use satellite-derived time to hand calls between towers and to avoid interfering with each other. Power utilities use it to compare measurements taken in different places at the same instant. Financial systems use it to timestamp transactions. Data centres use it to keep distributed databases consistent. Remove the signal and the receivers fall back on local oscillators that drift, slowly at first and then fast enough to matter.

The best-known estimate of the cost is a 2019 study for the US National Institute of Standards and Technology by RTI International. It put the loss from a GPS outage at about $1 billion per day, rising to $1.5 billion in the April and May planting season. One of the authors, Kyle Clark-Sutton, called a billion dollars a day the floor rather than the ceiling. Another estimate, by the Brattle Group for the terrestrial-positioning firm NextNav, put a month-long US outage at $58.2 billion, and since NextNav sells a backup system the figure should be read with the commercial interest in mind. The RTI study also found that, after 30 days, wireless networks would work at about 60% of normal capability in the best case.

GPS is not the internet, and an internet outage does not turn it off. The dependence runs the other way, and that matters for the total outage scenario because a time failure would hit many layers at once. Time is the one shared dependency that almost every layer quietly uses. A server with the wrong clock rejects valid security certificates. A phone network with drifting timing drops calls. A grid with no common reference loses sight of how its own oscillations spread. This is explanation, not measurement, and the length of time that backup oscillators hold depends on the equipment installed, which operators rarely publish.

Two events show how fragile the margin is. In May 2024 the Gannon geomagnetic storm degraded GPS accuracy by tens of metres for hours. A report cited by Risk & Insurance puts the error at up to 70 metres for about six hours, and Kansas State University’s Terry Griffin estimated that tractors drifting off their guidance lines cost farmers in the US Midwest more than $500 million during planting. Most of the damage was to precision farming rather than to networks, because infrastructure operators had backups and early warnings. The second case is deliberate. Jamming and spoofing of satellite signals is routine in conflict regions, and a determined actor could cause local timing faults far from any front line. I do not have a measured figure for how often that happens in Europe, so I will not give one.

Europe is better placed than most. It operates its own Galileo satellites, and most modern receivers can use several constellations, so the loss of one does not blind them. The weakness is that all constellations are exposed to the same space weather and to the same jamming. Terrestrial alternatives to satellite timing exist, among them long-wave radio navigation and time delivered over fibre, but they are not deployed at the scale the dependence would justify. The cost of a backup is easy to see, and the cost of a failure that has not happened yet is not.

Hospitals that fall back to paper they no longer have

A hospital runs on three kinds of memory: the record of who the patient is and what has been done, the stream of orders and results, and the supply chain behind both. In 2024 two attacks hit different parts of that memory, and between them they give the clearest preview of what a total outage does to care.

On 21 February 2024 ransomware hit Change Healthcare, a UnitedHealth subsidiary that handles an estimated one in three US healthcare transactions. Hospitals, pharmacies and doctors’ offices use it to verify insurance, obtain prior authorisations, submit claims and route payments, and about 67,000 pharmacies dealt with systems that ran through it. The company shut systems down to contain the spread. For weeks pharmacies struggled to fill prescriptions, providers could not process claims, and practices scrambled to stay open. The data of about 192.7 million people was eventually counted as affected, and UnitedHealth lost $3.09 billion in 2024. Nothing was wrong with a hospital’s own computers, and care was harmed anyway. The weak point was a link in a chain that most patients had never heard of.

In June 2024 the London pathology provider Synnovis was hit by the Qilin ransomware group. NHS England reported that 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at two trusts, and about 1,100 cancer treatments were delayed. The lab could not match blood groups quickly, hospitals fell back on universal O-type blood, and stocks ran short. By the end of 2024 services had been restored. In June 2025 King’s College Hospital confirmed that one patient had died unexpectedly during the attack and that the contributing factors included a long wait for a blood test result. The trust said it could not determine whether the attack caused the death directly, and an earlier report had counted at least two cases of severe patient harm. A King’s College London study cited by The Record found that digital outages cascade through clinical care wherever services depend on integrated systems and real-time data.

In both cases the failing component was outside the hospital and narrow in function: insurance and claims in one, pathology in the other. In a total outage every external service fails together, along with most of the internal systems that now live in the cloud: electronic patient records, imaging archives, laboratory and pharmacy systems, e-prescribing, medication cabinets, patient identification, bed management and ambulance dispatch. Hospitals keep downtime procedures, meaning paper forms, printed medication charts and runners who carry results by hand. But paper is a skill as well as a stock. Forms must be printed and stored, staff must know the workflow, and many clinicians trained in the past 15 years may have little or no experience of running a ward without a screen. I know of no audit that tests how many wards could work for 72 hours without their records. The reports of the incidents above suggest the answer is not many, and that is a judgement, not a measurement.

Care splits by urgency, and the clock differs for each type. Time-critical conditions such as stroke, heart attack, sepsis and major trauma depend on imaging and laboratory results within minutes to hours, and delays kill quickly. Chronic dependence, in patients on dialysis, home oxygen or ventilation, relies on powered devices and on regular deliveries. Scheduled care, which covers cancer therapy and surgery, depends on a pipeline of tests and approvals, and weeks of delay cause harm that is hard to see and real. The Synnovis numbers belong to this third kind. They are what a narrow, local outage looks like. A total outage would scale them by a factor nobody has measured.

The Iberian blackout adds evidence from a power failure. Hospitals in Madrid and Catalonia suspended routine work and treated critical patients on backup generators, and homebound patients who depend on oxygen machines were among those hit hardest. The deaths from carbon monoxide came from generators, not from hospitals. In an internet-led outage with power on, hospitals would keep their lights and their ventilators running. The loss would be information, and Parametrix’s numbers for CrowdStrike show how heavily healthcare carries that exposure: it took the largest sector loss, $1.94 billion, and about three quarters of the Fortune 500 healthcare companies were hit.

Medicines and supplies are a second chain. Hospitals order drugs and consumables electronically from wholesalers who run just-in-time stock, and hold little spare. Pharmacies in countries that have moved prescribing into national electronic systems, which includes Slovakia and the Czech Republic, depend on those systems to dispense chronic medication. I have not found a public statement of what a pharmacy there would do if the system were unreachable for a week. The answer may exist in an emergency plan that was never published. It deserves to be public, because the people who would need it are exactly those who cannot improvise.

None of this means hospitals are badly run. They are generally good at power failures, mass-casualty drills and flu surges. They are poor at the one thing a total outage removes, the shared digital record that lets a team of strangers treat a patient safely, and the weakness comes from how health care was digitised, not from carelessness. The failure mode is a safe hospital that no longer knows who is in it.

Food systems built for a three-day buffer

A modern food supply chain holds very little between the farm and the plate. Supermarkets keep stock measured in days, and fresh goods in a day or two. They order by forecast, and software replenishes shelves from distribution centres that run on tight schedules. Trucks are routed by software, refrigeration is monitored remotely, and orders to suppliers move through electronic data interchange. That efficiency is why the shelves are full on a normal Tuesday. It also means the buffer is short, and the EU’s 72-hour guidance rests on it.

The clearest recent test came in spring 2025, when attackers hit Marks & Spencer and then the Co-op. The Co-op shut down parts of its supply chain and logistics operation to contain the intrusion. Shoppers reported stores without milk or fresh produce for days, and The Grocer described availability as crippled. Two weeks into the incident, staff told Recorded Future News that deliveries from the Co-op’s large depots were well below 20% of normal capacity. On the Scottish island of Islay, where the Co-op is the only large grocery store, the company had to bring in a temporary supply. M&S paused online orders, saw empty shelves and sent warehouse workers home.

Those two cases are the nearest thing on record to a food-supply stress test, and they carry two lessons. First, shelves emptied within days, not weeks, even though only one retailer was affected. Second, in most places other shops could fill the gap. As The Record noted, outside places like Islay customers could shop elsewhere. A total outage removes the neighbour who can absorb your customers. Every retailer, wholesaler and haulier would be disrupted at once, and every distribution centre would be trying to restart manually in the same week.

The mechanism behind the speed is worth spelling out. A modern warehouse does not know where its goods are without its software. Pickers follow instructions on handheld devices, pallets are tracked by scans, and trucks are dispatched against orders that arrive from stores overnight. When the software goes, the goods are still on the shelves of the warehouse, but nobody can find, pick or dispatch them quickly. A manual restart with paper lists and phone calls is possible. It is slow, and the Co-op’s figure of under 20% of normal depot throughput gives one data point for how slow, from a company that still had working phones and partly working systems. I use it as a reference, not a forecast.

Primary production is exposed as well. Dairies schedule milk collection by software, because milk cannot wait. Greenhouses and cold stores depend on power and remote monitoring. Precision farming leans on GPS, and the May 2024 geomagnetic storm cost US Midwest farmers more than $500 million during planting, while the 2019 NIST study put the daily cost of a GPS outage at $1.5 billion in the planting season. Timing matters. The same outage in January would hit cold chains and heating. In April it would hit sowing, and a missed planting window cannot be recovered later in the year.

Expect behaviour to amplify the physical shortage. Shoppers who see a bare shelf buy more of what remains, which empties the next store faster. The EU stresses that its guidance is not a call for panic buying or stockpiling, and the advice is sensible: a modest, steady household reserve built in calm weather works against the rush, because it removes the reason to join the queue. The reserve is the only part of the food system an individual controls.

A rough timeline follows, offered as judgement based on the Co-op, Iberian and EU evidence. In the first day, fresh items thin out and queues form where cash is accepted. By day three, bread, milk and produce are scarce in many urban shops, and rural shops with long delivery chains are worse off. By day five to seven, ambient goods, which have more shelf life, start to thin as panic buying and the failure of replenishment meet. Warehouses would still hold stock, and the question is how quickly manual dispatch can move it. The central point is that hunger is not the first-week problem; distribution is. The food exists. The system that finds it and moves it does not.

Fuel, ports and the logistics that run on messages

Every physical movement in a supply chain is preceded by a message that authorises it. A truck leaves because an order was released, a container leaves a port because customs and the shipping line cleared it, a tanker discharges because a nomination was confirmed. Take the messages away and the trucks, ships and tankers still exist, but nothing tells them where to go. The best evidence for how fast that matters comes from four incidents that each removed a different part of the message layer.

The first is Maersk and NotPetya in June 2017. The malware wiped about 45,000 PCs and 4,000 servers across the shipping group, and 76 port terminals were affected. Chairman Jim Hagemann Snabe later said the company reinstalled 4,000 servers, 45,000 PCs and 2,500 applications in ten days, work that he said would normally take about six months. He also noted that a ship carrying 10,000 to 20,000 containers docks into a port every 15 minutes. Employees managed to process about 80% of the normal work volume by hand, and the incident still cost Maersk between $250 million and $300 million. Manual operation held up, but at a price that a company with a working global network around it could pay.

The second is Colonial Pipeline in May 2021. A ransomware attack hit the company’s billing and business systems, and the operational pumping systems were not compromised. Colonial shut the pipeline down anyway, to stop the malware spreading, and it stayed shut for six days. Fuel shortages appeared at filling stations on the fourth day, made worse by panic buying, and the company warned that it would take days more for supply to return to normal. The pipeline did not fail. The ability to bill for the fuel failed, and a company that cannot bill cannot responsibly ship. That detail should be read twice by anyone who thinks the physical layer is safe because it is physical.

The third is the Iberian blackout, a failure of power rather than data. Gas stations stopped working because pumps need electricity. Spain’s transport minister said trains could not be restarted that evening even after power returned. Traffic lights went out across both countries, and metro systems in Madrid, Barcelona and Lisbon stopped. In a power-on internet outage pumps would run, but the pump is only the last metre of a long chain: payment authorisation, tanker dispatch, terminal release and refinery scheduling all run on messages, and a station with no delivery has no fuel to pump.

The fourth is aviation in July 2024. The CrowdStrike failure caused more than 3,000 flight cancellations and delayed 23,900 more, and all six airlines in the Fortune 500 cohort took direct losses, the highest average per company at $143 million. Air traffic control networks are largely separate and kept working. What failed were airline systems for check-in, crew scheduling, aircraft weight and balance, and baggage, plus the airports’ own desks and screens. A plane can still fly without them. It cannot be legally dispatched without the paperwork they produce.

Put these together and a rough shape emerges. In a total outage ports and terminals would revert to paper. Throughput would drop, and with every line, terminal and customs service affected at the same time, nobody could borrow capacity from a neighbour. Ships at sea would keep navigating, with some reliance on GPS that has backups, but ships arriving at a port that cannot release containers would queue. RTI’s 2019 study found that a 30-day GPS outage would cost the maritime sector more than $10 billion, mainly through port delays and the supply-chain disruption that follows from them, and that estimate assumes GPS is the only layer lost.

Road freight depends on dispatch apps, telematics and routing software, with drivers who work from the screen. A haulier with phones and paper could still move goods, and many would, but without payment systems and without fuel that is not guaranteed. Logistics does not stop; it slows to the speed of paper and goodwill. Paper moves a fraction of what software moves, and the fraction is the number that decides how fast shelves empty.

The practical consequence is an ordering of priorities that governments would face in the first week. Fuel for hospitals, water works, emergency services and food distribution would take precedence over private use, and rationing by decree would require a way to communicate it. It is the least discussed element of preparedness plans: not the stock of fuel, which exists, but the means to release it to the right people on the right day, without the systems that normally do the releasing.

Water, heating and the control systems nobody sees

Most people never think about the machines that keep water clean and flowing. Pumps lift it, plant controllers dose chemicals and monitor turbidity, valves route it, and a network of sensors reports to a control room. Wastewater plants do the reverse. Industrial control systems, known as operational technology or OT, do the work, and they have historically been separated from the office network. That separation has eroded as utilities added remote monitoring to save staff trips to distant sites.

Two kinds of failure should be kept apart. A loss of connectivity means operators can no longer see or command remote sites from a central desk. A loss of control means someone or something is operating the equipment wrongly. A total internet outage would produce the first, not the second, and for water systems the first is manageable for some time. Plant controllers run locally, pumps keep pumping while they have power, and staff can drive to sites. It is slow and labour-intensive, and it fails when staffing is thin.

The second kind is the one security agencies worry about. The US advisory on Volt Typhoon said the group had obtained access to information about water treatment plants, water wells and an electrical substation, in addition to operational technology systems and network security devices. Water and wastewater were among the four sectors where the group had compromised IT environments. The agencies said they had not seen the actors use that access to disrupt services. They described the access as preparation for a crisis, and the sectors involved are the ones a total outage would hit hardest if the loss were deliberate. I come back to that in the section on hostile states.

Power is the real dependency of water. In the Iberian blackout the Portuguese water supplier EPAL warned that supplies could be disrupted, and queues formed for emergency supplies including lamps, generators and batteries. A water tower stores a day or two of pressure. Towns pumped from deep wells or with long, flat distribution networks depend more heavily on continuous electricity. Wastewater lift stations need power as well, and when they fail in a heavy rain the result is a public-health problem within days. These effects appear in blackout plans, but a plan that assumes a blackout of 16 hours is not a plan for a week.

Heating adds a seasonal dimension. This article is dated 13 November, the beginning of the heating season in Central Europe, and a total outage in January would be a different event from one in July. District heating plants, common in the region, rely on control systems and pumps. Gas networks rely on remote monitoring and dispatch. Buildings rely on thermostats and boilers with electronic controls. Many of these keep working locally if the internet fails, which is a strength of OT design. The danger is cold combined with a power cut, and the evidence from Iberia is that people who lose power improvise with equipment that kills. Three of the seven deaths linked to that blackout were carbon monoxide poisonings from emergency generators.

Even the building around you has a cloud. Elevators with remote monitoring, access-control systems, smart locks, fire-alarm panels with remote reporting and building management systems may degrade or lock into safe modes when they lose the network. In Portugal police received requests for help from people trapped in elevators. The Volt Typhoon advisory also warned that access to a facility’s IT could allow tampering with heating and cooling in server rooms. That is a reminder that data centres, the machines behind most of the scenarios here, rely on air conditioning that is itself a networked system.

The conclusion for this section is deliberately modest. Water and heating would probably survive the first days of an internet-only outage, because their control loops are local and their operators are trained to run them in degraded modes. They become the main risk when the outage is combined with a power failure, or when the loss is not accidental. The invisible machinery is more resilient than the visible apps, and the margin of resilience is the staff who can still drive to the site.

Identity lock-out when email becomes the skeleton key

The first thing most people notice in a big cloud outage is not that a site is down. It is that they cannot get into something else. During the Microsoft failure, security experts pointed out that users could not reset passwords, create new accounts or, in some cases, receive sign-in codes for multifactor authentication and single sign-on that depend on email. Troy Hunt, who runs the Have I Been Pwned breach service, said he was locked out of several services that use email for login. His comment was a reminder of how many of the digital locks in a life share one key, an inbox.

Identity is the quiet spine of the stack. A single sign-on system lets one account open dozens of services. A multifactor system proves a second factor, by text message, authenticator app, push notification or hardware key. A recovery system, nearly always email or phone, restores access when the others fail. Each of those verifies something with a remote server. Passkeys and hardware keys are stronger against phishing and keep the secret on the device, but the service that checks them is still online. The device may be in your pocket and working, and the door it unlocks is somewhere else.

The most instructive case is Maersk. When NotPetya wiped the company’s domain controllers, the servers that hold the directory of who is allowed to do what, the group lost not only its data but its ability to say who anyone was. Recovery began with identity. A single domain controller in Ghana that had been knocked offline by a local power cut just before the attack held an intact copy of the directory, and engineers flew it to the United Kingdom to rebuild from. That account comes from WIRED’s reconstruction and is not an official forensic report, but the pattern matches how recovery teams describe the order of work: restore authentication first, then everything that depends on it. Identity is the keystone; when it falls, everything built on it waits.

Consider what the Microsoft outage did to workplaces that run on cloud identity. Outlook and Teams went down, but so did the Intune console, which administrators use to manage devices, and some users reported trouble reaching cloud-based Windows desktops. Defender, Microsoft’s security tooling, was among the services affected, so companies lost both the work surface and part of the system watching for attacks. In a total outage that coupling would reach banks, hospitals and public agencies, which run on the same identity stacks as everyone else.

Fallbacks exist, and they are rarely exercised. Security practice calls for emergency “break-glass” administrator accounts that do not depend on the main identity provider, stored offline and tested. Many organisations have one on paper. Few have tested it with the identity provider itself unreachable, and an untested break-glass account is a belief rather than a control. That is a judgement from the pattern of incident reports, not a survey result.

For individuals the problem is smaller and more personal. A password manager that syncs through the cloud may be unreachable, though most keep a local encrypted copy, which works if the device is already set up. A phone that has lost its authenticator app, or whose bank app wants a fresh verification, becomes a locked brick for finance. Printed recovery codes, a paper list of critical accounts and one offline copy of key documents are the dull measures that make the difference, and they appear again in the practical section near the end.

Fraud thrives in the confusion. After the CrowdStrike failure in 2024, reports said criminals used the outage to target the company’s customers, and the pattern is old: a crisis produces urgent requests, unfamiliar procedures and workers who want to help. In a total outage, with verification channels down and normal controls suspended, social engineering would be easier than ever. Some system administrators joked during the Microsoft outage that phishing and spam dropped sharply while it lasted, a small comfort that disappears the moment the services return and the backlog of fake support messages arrives.

Last, there is the matter of proving who you are in person. A passport or national ID card works without a network, as it always has. The digital layers on top, a mobile identity app, an electronic signature, a one-time code from the bank, do not. A person with a physical document and cash can still do much in a shop, a bank branch or a municipal office, as long as the clerk has a way to accept them. In practice that last condition is the one that fails first, because staff were told to use the system and have no process for accepting a paper copy.

Governments, courts and registries without their databases

The state is a database with a flag. Land and company registers, tax and social insurance systems, vehicle and driver records, civil registries, court case files and border checks all depend on records held in systems that are increasingly in the cloud or reached over the internet. When the Microsoft outage spread in November 2026, the list of affected organisations named by BankInfoSecurity included banks, hospitals, courts and schools, and CNN reported that US city governments were waiting for services to return. Those were disruptions to productivity, and for most people they were annoyances. A total outage turns the annoyance into a stop.

The Iberian blackout offers a measure of how a state behaves when infrastructure fails. Portuguese courts stopped work, the Spanish parliament closed, and both countries convened emergency cabinet or security council meetings within hours. People in the same building and the same city could still run the response. The weak points were not command but information: governments could talk to each other and to their emergency services, but could not easily talk to the public, and in the first hours the public used battery radios to hear them.

Estonia is the clearest example of a country that planned for this. After the cyberattacks of 2007 exposed how much of the state existed as data, Estonia built the world’s first data embassy: a government-operated Tier 4 data centre in Luxembourg, with the status and protections of an embassy, holding copies of critical registers and the means to start systems from them. The Luxembourg facility backs up information on taxes, land, businesses, identity documents, pensions, legislation and the census. An Estonian government spokeswoman described its main goal as digital continuity: the capacity to start the systems when necessary and retrieve data from externally stored versions. Monaco later made a similar arrangement with Luxembourg. The idea is simple and under-copied: a state’s records should survive the loss of its territory, its networks and its capital.

Most countries have not done this at scale, and the gap matters in a scenario where the loss is of connectivity rather than data. A data embassy protects against loss of data. It does not keep the land register open when no one can reach it, and it does not pay benefits when the banks are closed. The practical question for any government is which transactions have a paper or offline fallback and which do not. Pension and benefit payments depend on bank rails. Property transfers need a registry stamp. Business registration needs a database lookup. Policing needs access to warrant and vehicle records. Border control needs checks against watch lists, which a guard can replace with a visual inspection only at the price of throughput and some security.

Governments also run separate networks for sensitive work, and that is an advantage worth stating plainly. Classified and emergency government communications generally travel on private networks, which is why officials can coordinate even when the public internet fails. The difficulty is the boundary: many civilian services that governments must keep running, such as health insurance, tax and welfare, run on the commercial cloud, and the officials who manage them often work from ordinary laptops using ordinary identity systems. The Microsoft incident, which hit email and collaboration for institutions across many countries, is an example of how thin that boundary can be.

Legal continuity is the less obvious gap. Deadlines, filing windows and limitation periods are written for a world where the system works. A court that cannot receive filings for a week has to decide whether time stopped. Contracts have force majeure clauses, and states have emergency powers, but few have rehearsed the paperwork of a general suspension of digital deadlines. Estonia’s work on digital continuity is one of the few public attempts to answer that kind of question. Elsewhere the answer would be invented under pressure, by officials who are themselves cut off from the systems that record their decisions.

The sober reading is that governments would function in a degraded way for days, because the core of the state, a few hundred people with phones, radios, cars and secure links, can keep operating. What would stop is the long tail of routine services that the public experiences as the state. A government can survive a total outage far more easily than a citizen can transact through one.

The money ledger of downtime

Every large outage produces a bill, and the bills so far are a guide to scale even though none of them measures a total outage. The CrowdStrike failure of July 2024 cost the US Fortune 500, excluding Microsoft, an estimated $5.4 billion in direct losses according to the insurer Parametrix, an average of $44 million for each company affected. Parametrix told Reuters that the global figure could reach roughly $15 billion. Airlines bore the highest cost per firm, at about $143 million. Insurance covered only a fraction: Parametrix expected cyber policies to pay between 10% and 20%, and CyberCube put insured losses between $400 million and $1.5 billion, which it called potentially the worst loss in the cyber insurance market in two decades.

Attacks cost more because they last longer. Maersk put the NotPetya damage at $250 million to $300 million. UnitedHealth lost $3.09 billion in 2024 from the Change Healthcare attack. The Cyber Monitoring Centre, a UK non-profit whose technical committee is chaired by a former head of the National Cyber Security Centre, estimated that the 2025 Jaguar Land Rover attack cost the UK economy £1.9 billion, with a plausible range from £1.6 billion to £2.1 billion, about 5,000 affected organisations and production halted for roughly five weeks. It called the incident the most financially damaging cyber event to hit the UK, and most of the loss came from lost manufacturing output at JLR and its suppliers. JLR reportedly had no cyber cover in place at the time, and a government loan guarantee of £1.5 billion followed. The Microsoft outage of November 2026 may end up costing billions in lost productivity, according to CNN, although no one has yet published an estimate.

Adding these up is tempting and misleading. They are single-company or single-sector events, and the economy around them kept working. A thousand JLRs at once would not be a thousand times worse, because the system that makes the damage tolerable, the ability of unaffected firms and customers to absorb the shock, would be gone. The relationship is not linear. In the first day the losses are mostly delayed work and idle staff. By the third day, inventories run out and orders cannot be placed. By the second week, suppliers who have no revenue cannot pay their own suppliers or their staff, and the credit that keeps trade moving begins to seize.

Estimates for continuous failures show how wide the error bars run. The 2019 RTI study for NIST put a GPS outage at $1 billion a day, which the Engineering journal calculates as 1.7% to 2.6% of daily US output. Critics argue that figure is far too low for a loss that would hit 14 of 16 critical infrastructure sectors. A GPS World commentator pointed to the February 2021 Texas power crisis, a single state and a single sector over a week, which has been estimated to have cost $195 billion and at least 57 lives. A Texas freeze is a rough comparator for a worldwide outage, not an equivalent. It does, however, show how far a week of one broken utility can exceed a tidy daily average.

That is why I do not give a single number for the cost of a total outage. Any figure would be an extrapolation from component events, with error bars wider than the number itself. The more honest unit is days of output at risk. If an outage took away a fifth of normal economic activity for a week, the loss would be about one and a half days of annual output. If it took away half for two weeks, the loss would be about a week of annual output. These are arithmetic, not forecasts, and the share of activity that actually stops is the unknown that every earlier section of this article tries to bound.

The distribution of loss matters as much as the total. Insurance caps its exposure, so firms carry the rest. Governments step in when the failure threatens an employer or an industry large enough to matter politically, as the JLR loan guarantee shows. Small suppliers, who have thin cash buffers and no insurance, go under first, and they are the part of the economy that cannot be rebuilt in a day when systems return. The CMC rates events on a one-to-five scale, comparing it to hurricane categories, and placed JLR at category three. A total outage would be off that scale. The Co-op, M&S, JLR and Change Healthcare cases should be read as the early warnings of a risk that insurers and regulators already know is systemic.

Day three to day seven, where the physical chain breaks

Everything before this section leaned on documented incidents. From here, the text is extrapolation, and the reader should treat dates as ranges. The shape comes from the clocks that run in a household and in an economy, and the best way to read a total outage is as a set of those clocks running down at different speeds.

Cash runs first. Without working terminals, a household’s usable money is the notes in a drawer, and that clock is measured in hours to days. Fuel runs next, at stations and in tanks, and the Colonial Pipeline case shows shortages emerging on the fourth day of a shutdown with panic buying added. Fresh food follows, with the Co-op showing shelves emptying within days. Water holds as long as pumps have power. Chronic medication depends on how much a patient has at home, and for most people that is days to weeks, with specific exceptions such as insulin and oxygen that carry far shorter margins. Heat depends on the season.

On day three the clocks begin to cross. A shop that still has stock has no way to take payment, and a household that still has cash has nothing to buy. A factory that has stock of parts cannot place the next order, and a supplier that could ship cannot be told where to. JLR’s production halt of about five weeks is a measure of how quickly a modern manufacturer stops when its systems stop: automotive plants run on days of parts, and the loss spread to about 5,000 organisations. In a total outage no manufacturer would be spared, and the second-order effect would reach every sector that buys from them.

By day five the weakest links give. Small shops and care homes with no spare generator or cash run out of supplies. Hospitals with paper downtime procedures reach the limit of their paper stock and the endurance of their staff. Pharmacies that cannot dispense chronic medication send patients to emergency departments, which are already overloaded. Delivery of oxygen, dialysis supplies and specialist drugs, all dependent on routing and dispatch systems, slow or stop. These are the quiet deaths, the ones that do not make headlines because each is one person, and they dominate the mortality of the period. The Synnovis attack offered a small-scale image of that pattern: a single patient death among more than 10,000 disrupted appointments.

By day seven the dominant risk is no longer technical. Chains of trust fray. A town that has not seen a delivery for a week starts to ration informally, and authority passes to whoever has stock and a way to communicate: mayors, police, local shops, churches, community groups. The Iberian blackout lasted about 16 hours and still produced improvised traffic control, volunteers directing cars and shelters for people stranded away from home. Imagine that sort of local organisation under strain for a week, with no way to know when it will end. The infrastructure fails over days. The social order is tested over weeks.

Authorities face an ordering problem. Restoring service means choosing a sequence, and the sequence is dictated by dependencies: power first, then the transport layer, then naming and routing, then identity, then the platforms, then applications. At each step the people doing the work need the thing they are restoring in order to coordinate. In 2017 Maersk spent ten days rebuilding its own estate with an intact network and a company-wide mobilisation. A national or global restart would have no such luxury. Which services come back first would be political as much as technical, and the choices would be made under the pressure of public demand and rumour. The next section looks at why even the technical sequence is harder than it sounds.

The restart problem: systems that need each other to start

Fixing a fault and ending an incident are different events. The October 2025 AWS outage shows the gap in numbers. DynamoDB’s errors ended at 2:40 AM Pacific. EC2 launch failures continued until 1:50 PM, more than eleven hours later, because the subsystem that manages server capacity had to rebuild its state while a backlog of requests pressed on it. AWS’s remedies target both halves of the event: preventing the empty DNS record in the first place, and limiting the blast radius when dependent services recover under load. The first half is a bug. The second is a property of every large system, and it is the one that decides how long a total outage would last.

The Microsoft outage of November 2026 is the live example. At the twelve-hour mark Gergely Orosz wrote that Microsoft had not worked out why servers died when brought back online. Kentik’s Doug Madory reported traffic returning to Microsoft’s services after about 18 hours. Early reporting on Microsoft’s account mentioned failed health checks and a strategy of redistributing traffic, which is what an operator does when it must bring capacity back in small steps to avoid being flattened by the returning load. The pattern is not unique to one firm: restart is a controlled, gradual, supervised process, and it is slower than the fault by design.

The core difficulty is circularity. A cloud platform’s control plane, the software that starts virtual machines, is itself a set of programs that run on machines. Identity services need DNS to be found, DNS servers need certificates and correct clocks, clocks need a time source, and the monitoring that tells you whether any of this is working often needs the same cloud. Each system is built on the assumption that the others are already running, so the first to start must start without them, using a manual procedure that someone has to know, have written down and be able to reach. A restart is not the reverse of a shutdown. It is a different procedure that most organisations have never run end to end.

Maersk is the proof. The company had lost every domain controller, and the surviving copy in Ghana was, in the words of one account, saved by luck rather than by a recovery plan. Without that blackout in an obscure office, the rebuild of the identity layer would have been far longer. The company’s chairman called the ten-day reconstruction of 4,000 servers, 45,000 PCs and 2,500 applications a heroic effort, and said it would normally take six months. Heroism and luck are not planning assumptions, and a worldwide outage would call for both at once, thousands of times over, with competing demands on the same scarce engineers.

Power adds a physical dimension that software people tend to forget. Data centres are very large electrical loads. In Ireland they accounted for 21% of national electricity consumption in 2023, according to figures from the country’s statistics office cited in an industry presentation, with a projection of about a third by 2026. Bringing a data centre back means starting cooling plants, UPS systems and thousands of servers in sequence, because a simultaneous start draws a surge that grids and backup generators are not built to meet. A grid that had just recovered from its own trouble could be hit by hundreds of facilities all demanding restart power in the same hour. Operators would have to stage the restart, which is one more reason it would take days rather than hours. That is explanation, not measurement, and operators rarely publish their restart procedures.

The returning load is a hazard of its own. When networks come back, every device, app and server tries to reconnect at once, retrying aggressively, and a service that has just come up can be knocked down by the crowd. Cloudflare’s 2025 incident showed a milder form: the network flipped between working and failing every few minutes as good and bad configuration files alternated. Mobile networks face a version of it as millions of phones re-register. Operators handle it by throttling, admitting traffic in batches and keeping some services deliberately off. That means that even when the fault is fixed, the user experience is one of partial and unstable service for a long time.

There is a human problem too. Runbooks, the written procedures for recovery, are often kept in the same wiki or ticketing system that is down. Staff are exhausted after the first 24 hours, and the engineers who understand the oldest and most critical systems are few and often close to retirement. Communication between teams, which in normal times runs on chat and video, would have to fall back on phones, paper and meetings in person. The Microsoft incident revealed a minor version of this: administrators were reading each other’s reports on public social networks because their own channels were unreliable.

Finally there is data consistency. After a long outage, replicated databases may disagree about which version of a record is right, payments may be recorded in one place and not another, and backups may be too old or on systems that cannot be reached. Some data would be lost, some would be duplicated, and a great deal would have to be reconciled by hand. The restart problem is the reason I regard the two-week horizon as the most uncertain one in this article. The first 72 hours depend on stocks and buffers. Everything after depends on whether the people and procedures needed to start the machines exist, and in too many places the honest answer is that nobody has checked.

Submarine cables, the part that cannot be rebooted

Nearly all intercontinental data crosses the seabed. Between 500 and 600 cable systems, depending on how they are counted and which source is read, carry more than 99% of international traffic across roughly 1.7 million kilometres of cable, according to the International Telecommunication Union and industry trackers. They are the physical foundation under every cloud. Satellites carry a small fraction, and the capacity gap is wide: a modern cable can carry hundreds of terabits per second.

Damage is routine. The International Cable Protection Committee counts 150 to 200 faults each year, roughly three to four a week, and about 80% have human causes, mostly ship anchors and fishing gear. Despite a 77% increase in global cable length since 2013, annual repairs have stayed around 200, according to a TeleGeography analysis summarised by the engineering firm SMEC. Repairs cost between $1 million and $3 million each and need specialised cable ships with trained crews, and they can take weeks or months. Most faults never reach the public, because traffic reroutes without anyone noticing.

Rerouting works only while somewhere else to route exists. On 6 September 2025 cables including SMW4 and IMEWE were cut near Jeddah in the Red Sea, and a telecoms company and a US official said that about 25% of the data traffic between Asia and Europe was affected. Microsoft told Azure customers to expect higher latency, then rerouted traffic and said service was restored by the evening of 7 September, although repairs would take longer. Cloudflare reported delays of up to 30% between India and Europe. An earlier cut of the AAE-1 cable in December 2024 took until 7 April 2025 to repair, about four months, according to one chronology. Rerouting buys days; ships and permits decide months.

The risk is concentration in a few narrow places. The Red Sea corridor squeezes many systems through one shallow strait where ships anchor to wait for the Suez Canal, and the Kentik analyst Doug Madory has called it a dangerous place for submarine cables. Other chokepoints exist at landing stations, in the Strait of Malacca, in the Luzon Strait and across the Baltic. SubTel Forum counted 46 incidents in 2024, the highest figure since 2013 and up from 15 the year before, according to Recorded Future, and three of them damaged multiple cables at once, with prolonged disruption in countries lacking alternative routes. The shortage of repair ships and the difficulty of obtaining permits in conflict zones lengthen the outages.

For the UK, the dependence is stated in official figures. The government has said that around 65 cables connect the country and that about £1.4 trillion in daily transactions relies on the subsea cable industry, and in October 2026 it set out new rules to protect cables from sabotage. A single cable fault is an inconvenience. A coordinated cut of many cables, which would be a deliberate act by a capable state, is a different scale of event. I have not found a public, independent estimate of how many simultaneous cuts a regional network could survive, and operators are understandably reluctant to publish the answer.

What would a multi-cable event do? Traffic between continents would fall to whatever capacity remained, and the first casualties would be the services that depend on distant servers: cloud regions on another continent, global platforms, international payments and messaging. Domestic traffic would keep working where the content is local, which is why countries with domestic data centres, internet exchange points and local content would degrade more gracefully than those that depend on foreign hosting. Europe has a good position in that respect, and small island states and countries with one or two cables have a poor one.

This is also the part that cannot be restarted from a console. Software faults are fixed by rollbacks, and power faults by operators switching on plants. A severed cable is fixed by a ship sailing to a location, recovering both ends from the seabed, splicing and relaying them, while the weather, the politics and the availability of the ship decide the schedule. In a scenario where many cables were cut within a short window, the queue for repair ships alone would stretch recovery into months. Of all the layers in the stack, this is the one where the word total fits least and the word prolonged fits best.

Space weather, the scenario without a culprit

Most scenarios in this article have an owner: a vendor, an operator, a state. Space weather has none. On 10 and 11 May 2024 a series of coronal mass ejections struck Earth in rapid succession, with faster ones catching slower ones in what scientists call a pile-up, and NOAA rated the result a G5 geomagnetic storm, its highest category and the first since 2003. The storm was the strongest in more than two decades and the best modern test of how much of the technical world it can reach.

The results were mixed in an instructive way. Utilities that had received early warnings took precautions, and widespread blackouts were avoided. GPS was less lucky. A report summarised by Risk & Insurance says that GPS errors reached 70 metres for about six hours, that roughly half of the approximately 10,000 active low-orbit satellite payloads had to manoeuvre, and that decay rates reached 180 metres per day, which made collision assessment impossible for a time. Kansas State University’s Terry Griffin estimated that GPS errors in tractor guidance cost US Midwest farmers more than $500 million during the planting window. The grid held because it was warned; the farmers lost money because nobody had warned their tractors. A NOAA forecaster said afterwards that the public should understand a blackout could occur in future storms of this magnitude or stronger.

The reference events are larger. In March 1989 a storm roughly three times weaker than the Carrington event of 1859 collapsed the Hydro-Québec grid, left about five million people without power for nine hours and damaged a transformer in New Jersey. The Carrington storm itself, the largest recorded, disrupted telegraph networks across continents. Estimates of its strength fall between 800 and 1,750 nanoteslas on the Dst index, against 412 for the 2024 storm and 589 for 1989, and radiocarbon records in tree rings point to even larger events, such as one around 993 CE. Lloyd’s of London estimated that a Carrington-class storm today would cost the United States alone between $600 billion and $2.6 trillion, with power outages lasting from 16 days to two years. Published estimates of recurrence run from 80 to 420 years, a range that shows how little is known.

Where does the internet come in? An electrical engineer writing in The Conversation warned that a Carrington-scale storm could induce currents in the long cables of the backbone and in the data centres that hold the content, and that outages could last weeks. I treat that as a plausible hazard rather than a measured one, because the exposure of specific repeaters and landing stations has not been publicly tested at that intensity. What is better established is the first-order damage: induced currents in long conductors such as power lines damage large transformers, and large transformers are custom-built machines whose replacement takes months. A grid that has lost a large number of them cannot be switched back on by a restart procedure.

That is where the logic of this article changes. In a Carrington-class event the internet is a secondary casualty. The primary casualty is electric power, over a large region and for a long time, and the 72-hour guidance that the European Commission set for household self-sufficiency becomes too short by an order of magnitude. Everything that depends on the grid, from water pumping to refrigeration to hospital oxygen plants, runs on a clock that generators and fuel stocks cannot cover for weeks. I would class it as low in probability and extreme in consequence, and as the one scenario here in which the question of food and heat dominates the question of data.

Two points keep it from being a fatalistic story. The first is warning time. A coronal mass ejection takes roughly one to three days to reach Earth after it is observed leaving the Sun, and operators can reconfigure grids, reduce loads and delay maintenance in that window, as they did in 2024. The second is that protective measures are known: blocking devices, operating procedures, spare transformers and tougher timing systems. They cost money, and the benefit is the avoidance of an event that has not yet happened in the modern grid. Space weather is the clearest case in this article where preparation is cheap relative to the loss and still underfunded.

The sun is also in an active period. Reports describe solar cycle 25 as peaking between 2024 and 2026, and a G4 storm followed in June 2025. Activity does not make a Carrington-class storm more or less likely in any given year in a way that forecasters would endorse, but it does mean the nearest decade is not a quiet one. For a reader planning around the worst case, the sensible stance is neither dread nor dismissal. It is to treat the grid, not the data, as the dependency that would decide the outcome.

Hostile states, pre-positioned access and machine-speed vulnerability discovery

Deliberate attacks have already shown what a large accident only suggests. NotPetya, released in June 2017 through a compromised update of a Ukrainian accounting package, was attributed by the US government to Russia’s military intelligence unit known as Sandworm. It was aimed at Ukraine and escaped. Maersk lost between $250 million and $300 million. One summary lists Merck at $870 million and FedEx’s TNT unit at $400 million, and puts global damage near $10 billion, a figure widely quoted for the incident. A weapon built for one country spread to shipping, pharmaceuticals and logistics worldwide within hours, and that spillover is the route by which a regional attack becomes a near-global one.

The second pattern is quieter. In 2024 the US Cybersecurity and Infrastructure Security Agency, the NSA and the FBI, with partners in Australia, New Zealand and the UK, assessed with high confidence that the Chinese state-sponsored group Volt Typhoon was pre-positioning itself on IT networks to enable lateral movement to operational technology. It had compromised organisations in communications, energy, transportation, and water and wastewater, and in some cases had held access for as long as five years. The group typically exploited vulnerabilities in internet-facing network devices to get in, then used the legitimate tools already on a machine, a technique known as living off the land, to avoid detection. The agencies said they had not seen the actors take steps to disrupt functionality. In May 2026 the US government launched a further initiative, CI Fortify, in response to the same activity.

What does a hostile state want from a total outage? Probably less than the title suggests. A global collapse would damage the attacker’s economy as much as anyone’s, and its allies’ too. The credible aims are selective: to slow an adversary’s military mobilisation, to degrade ports, rail, telecoms and power in a theatre of conflict, or to create bargaining pressure. An official quoted by CyberScoop described the early-conflict goal as disrupting the adversary’s ability to mobilise. That is a regional, targeted denial and not a planetary blackout. The risk of near-total failure comes from the combination of three things: pre-positioned access in many countries, tools that spread, and shared dependencies that carry the effect beyond the target.

This is where the newest variable enters. In April 2026 Anthropic announced Project Glasswing and said its unreleased Claude Mythos Preview model had found thousands of zero-day vulnerabilities, including some in every major operating system and web browser, among them a 27-year-old flaw in OpenBSD. By early June the company said partners had surfaced more than 10,000 high or critical vulnerabilities, and it extended access to about 150 more organisations across more than 15 countries, including operators of power, water and healthcare systems. In its own scan of over 1,000 open-source projects, it flagged 23,019 potential vulnerabilities and estimated 6,202 as high or critical, and an independent review of 1,752 findings confirmed more than 90% as valid. Anthropic is a vendor in this field, and these are its claims. Security commentators noted that, because access is limited to partners, the wider community has not verified them.

The implication is double-edged, and I will not pretend to resolve it. If models can find serious bugs faster than human teams, defenders who get access early can fix flaws before attackers find them, and Anthropic says that is the purpose of the programme. The same capability in other hands, or in successor models without access controls, shortens the time between a flaw existing and a flaw being exploited. Over the whole system, the balance depends on something unglamorous: how fast fixes reach millions of devices that nobody is watching. Volt Typhoon got in through unpatched edge devices, which is a patching failure and not a discovery failure. Faster discovery helps only if distribution of fixes keeps pace, and the history of network devices suggests it often does not.

For the total outage scenario, this matters in one specific way. A shared component, such as a library, a management tool, a firmware image or an update channel, that is found vulnerable and exploited before it can be patched could reach many systems within hours. CrowdStrike showed the delivery mechanism by accident. NotPetya showed it on purpose. What AI-accelerated discovery changes is the supply of such flaws and the speed at which someone can turn one into a working exploit. I would not put a number on that change. I would say it moves the hostile route to a near-total failure from the category of the theoretical to the category of the plausible, and it is the clearest reason this article exists in 2026 and would have read differently in 2016.

A scenario matrix ranked by plausibility and damage

The previous sections described layers. This one ranks routes. Five credible paths lead to something close to a total outage as defined at the start, and they differ more in how they would be repaired than in how they would begin.

Five routes to a near-total outage compared

The ratings are my relative judgements, not probabilities, and they rest on how often each type of event has already happened. The first route is rated high because it is happening now: Control Plane counts 18 major cloud and CDN outages in 2026, and the Microsoft incident was still being repaired on the day this article was dated. The second is rated medium because Iberia proved that a grid in a rich, well-run region can collapse in 90 seconds from a mechanism its operators had not planned for. The last is rated low because the best published estimate of recurrence for a Carrington-class storm is once every 80 to 420 years, a very wide range.

The recovery column is the most useful one. Rollbacks fix the first route in hours, because the operator controls the change. Black start, the sequence by which a collapsed grid is rebuilt from a few self-starting plants, took most of a day in Iberia with working communications. Ships and permits govern the third route, and a repair ship cannot be rushed by a motivated executive. A rebuild from clean backups governs the fourth, and Maersk’s ten days with a global workforce shows the floor, not the ceiling. Transformer manufacture governs the fifth, and a factory schedule is not something that crisis management can compress. The duration of an outage is set by its slowest repair method, not by the size of the trigger.

Rank by expected damage and the order shifts. A cloud cascade is the most likely and the least damaging. A superstorm is the least likely and the most damaging. In between, the grid collapse and the cable cut have the most room to surprise, because their worst cases have not yet been seen. My ordering of concern, weighing both columns, would be the grid collapse first, because everything else rests on it and because Iberia showed the mechanism is still not fully understood. The multi-cable cut would come second, because repair capacity is thin and the chokepoints are known. State sabotage would come third, and I place it there because of the spillover problem, not because I expect a deliberate global shutdown. The cloud cascade would come fourth in concern and first in frequency. The superstorm would come last in probability and first in the severity of what follows.

The most dangerous cases are compounds, and the history of large failures is full of them. A cloud failure that coincides with a power cut in a heating season. A cable cut in a corridor where a conflict is already raising ship traffic and reducing repair access. A state attack that uses a vulnerability found by a machine and deployed through a vendor update. No single route needs to reach the far end of its range for the combination to produce the scenario defined in the opening sections. Compounds are also harder to rate because each component is partly independent, which means the sum is less likely than any part and more damaging than all of them.

One more caution belongs here. A ranking invites the thought that the top item is the one to prepare for. The better reading of the matrix is that the five recovery paths need five different kinds of preparation: tested rollbacks and staged restarts, black-start exercises that include communications, repair-ship capacity and cable diversity, offline backups and independent identity, and space-weather warnings and spare transformers. A government or company that prepares for only the most likely route leaves four others untouched. The next sections look at the people those routes would hit hardest, and then at what works.

The people with the least margin

The ordinary citizen of a rich country is not the main victim in a total outage. The people with the least margin are. Margin means stock, cash, mobility, health and neighbours, and some groups have little of each. The evidence from past events is consistent about who they are.

Older people living alone are the first. In Spain, homebound patients who depend on oxygen machines were among those most affected by the blackout, and the German outlet heise reported at least seven indirect deaths, three from carbon monoxide poisoning caused by emergency generators. People who live alone have no one to notice that they have not called. After the Optus failure, South Australia Police carried out 154 welfare checks in about two days, for one carrier’s failure. The knowledge of who needs a check lives in databases and in the memory of local services, and databases are the part that would be offline.

People who depend on powered or connected medical devices come next: home dialysis, ventilation, oxygen concentrators, insulin pumps with connected monitoring, and refrigerated medicines. Some of these keep working locally, and some lose features without a connection. I do not have a verified list of which devices fail in which ways, and I suspect most clinics do not either. The Synnovis case is a reminder that the harm is often indirect: a patient waiting on a blood test, not a machine switching off. The deaths in a total outage would mostly be quiet ones, caused by delay.

Rural residents are third. On the island of Islay the Co-op was the only large grocery store, and when its depots ran below 20% of normal capacity the company had to bring in a temporary supply. In a total outage every rural community is an Islay. Distances to hospitals are longer, delivery chains are longer, and alternatives are fewer. The same applies to small islands, mountain villages and anywhere with one road and one shop.

Low-income households come fourth, for a plain reason. They hold the least cash and the smallest stock of food, and many spend income as it arrives. A payments freeze that a middle-class household barely notices can be a crisis for a family one pay cheque from empty, and the reconciliation delays after a restart fall hardest on those who need the money first. Gig workers whose income comes through apps lose it the minute the app stops. Hourly workers lose wages when the workplace closes.

Tourists and travellers are an underrated group. In Lisbon, terminals closed and throngs of tourists sat outside waiting for news of flights, and Barcelona set up shelters for people who could not get home. A stranger in a foreign city with a dead phone has no cash in the local currency, no map, no translation app and no one to call. At a European scale, that is millions of people on any given day.

The picture has a twist that is worth stating. Groups that are usually described as digitally excluded may cope better in the first days. A pensioner who pays in cash, keeps a paper address book and listens to the radio has a margin that a young professional who lives on a phone does not. The vulnerable group is not simply the old or the poor. It is anyone whose daily life depends on a service that cannot be bought with cash or fetched on foot, and who has nobody nearby who would notice.

For planners, the lesson is practical. Welfare-check lists should exist on paper in the hands of local services, not only in a database. Care providers need a plan for visits when scheduling software fails. Pharmacies need a procedure for dispensing chronic medication without the national system, and the public should be told what it is. None of this is expensive. All of it requires someone to decide, before the failure, that a list of names is critical infrastructure.

Panic, rumour and a public that forgot paper

The evidence on how people behave when systems fail is more reassuring than the genre suggests, and less reassuring than officials like to say. The Iberian blackout produced improvised cooperation. Civilians directed traffic at dead junctions, authorities in Barcelona opened shelters, and the owner of a Madrid ice-cream shop gave his stock away after two hours without power because it would spoil anyway. Co-op shoppers facing bare shelves told reporters they were managing and being thrifty. Nothing in those accounts looks like a breakdown of order.

The same evidence also shows where behaviour does damage. When Colonial Pipeline shut down for six days in 2021, fuel shortages appeared on the fourth day and were made worse by panic buying. Within a week, a tracker cited by The New Republic marked 71% of North Carolina’s filling stations as out of fuel. The supply interruption was real, and panic buying turned it into empty pumps in places the pipeline serves. Panic does not create the shortage; it brings it forward and makes it worse. That is why the European Commission’s guidance stresses steady, modest reserves built in calm weather and says plainly that it is not a call for panic buying.

History offers a sharper contrast. The New York blackout of July 1977 lasted a little over a day. By the time power returned, more than 1,600 businesses had been looted, over 3,700 people arrested and firefighters had fought more than 1,000 fires, according to PBS. In August 2003 a far larger blackout, covering about 50 million people across eight states and part of Canada, passed with far less disorder, although New York recorded six blackout-related deaths. Analysts attribute the difference mainly to the condition of the city, including its poorer areas, and some credit a post-9/11 civic mindedness and a well-coordinated emergency response. The duration and cause were similar. The social conditions and the visible presence of organised authority were not. Behaviour in a long outage depends less on the outage than on the society it lands on.

For a total outage that finding cuts two ways. A society with trust, organised local institutions and visible authority would probably hold for days. A society with high inequality, low trust and thin local capacity would be more exposed, and the same outage would produce worse outcomes. That is why a single prediction for Europe is unrealistic, and why the variance between regions would be large. The Iberian result applies to Iberia in April 2025. Extending it to a week, or to other places, is judgement.

Rumour is the third force. In the first hours of the Iberian blackout, Spain’s prime minister said all hypotheses remained open and asked the public to refrain from speculation. Portugal’s National Cybersecurity Centre said there was no sign of a cyberattack. Microsoft’s status page changed its wording about security during the November outage. Each of those statements was an attempt to fill a gap that rumour would otherwise fill. In a total outage the gap would be larger, official channels thinner and the number of voices claiming to know the truth higher. The old channels of rumour, word of mouth and handwritten notices, would return, and they would spread claims about causes, shortages and safe places just as quickly as they did in earlier eras.

The last element is a public that has forgotten some of the skills of the paper age. This is an observation, not a statistic. In Barcelona a shop clerk said she could not even call her boss because nothing worked. A woman waiting at a bus stop said she had been there for almost three hours trying to find a lift to the airport and could not talk to her family who had just arrived. Many adults find their way with a phone, store contacts on a phone, hold tickets on a phone, pay with a phone and open their homes or cars with a phone. A person who has lost the phone has lost a good part of memory, orientation and agency, and it is not hard to imagine the effect on decision-making in the first hours.

What reduces panic is not exhortation. It is early, plain, repeated information from a source that people can reach, a visible local authority, a way to get cash and basic goods, and household reserves that remove the urge to join a queue. The EU guidance on risk communication says authorities should give citizens timely, accessible and reliable information before, during and after a crisis. The word that matters is before. A radio frequency or a notice board that people have been told in advance to check is worth more on the first day than the best statement written on the second.

Radio, broadcast and the fallback that still reaches homes

When systems failed in Iberia, the technology that people reached for was a battery radio. Reporters described residents of Barcelona walking into stores to ask for them, and a street vendor sold radios and torches in the city the following day. The detail is small and it is a useful test of preparedness: how many households own a radio that works without the grid, and how many know which station would carry official information?

Radio and television have properties that the rest of the stack lacks. A transmitter sends one signal to unlimited receivers, so it does not suffer from the load that crushes services in a crisis. A battery or wind-up receiver needs no network, no identity and no payment. Many transmitter sites have their own generators. Broadcast is the one medium that can inform millions of people at once without any of the layers that fail in a total outage, at least for as long as the studio can feed the transmitter. That condition is where the risk hides, because a modern broadcaster’s studios, playout systems and links to transmitters often depend on IP networks and cloud services. I have found no public audit of which stations could stay on air if their cloud tools failed, and I would not assume the answer is all of them.

Receivers are a gap of their own. Many households have no radio apart from the one in a car, and many smartphones either lack FM reception or have it disabled. Digital radio and television need powered, more complex sets. A car radio with a petrol tank is a practical receiver and a practical charger for a phone, and it is worth remembering as a fallback. The EU guidance lists a battery radio among the basic items for a 72-hour kit, and the cost is a few euros.

Other alerting systems have narrower uses. Cell-broadcast messages can reach all phones in an area through the mobile network’s radio layer in countries that have implemented them, although that depends on the operator’s core and on handsets receiving broadcast messages. Sirens, where they still exist, need power and a trigger. Neither replaces a station that people know to tune to. The simplest policy is the most underused: tell the public, now, which station will carry official information in a crisis, and print it on the same leaflet as the 72-hour guidance.

There is a lesson here about how the stack is built. The oldest technology in the list, a one-way analogue broadcast, is the most resilient part of the information system, and the newest, a personalised service tied to identity and cloud, is the least. That does not mean going backwards. It means keeping an old and cheap layer alive precisely because the new layers are more capable and more fragile at the same time. The case for radio is not nostalgia; it is that its failure modes are different from everyone else’s.

Regulators writing rules after the failure

The regulatory response to the failures of 2024 to 2026 is under way, but its shape shows what is and is not being tested. On 3 November 2026 the European Commission presented four non-binding guidelines on population preparedness: 72-hour household self-sufficiency, preparedness in schools, inclusion of people with disabilities, and risk communication. The document is a Commission Communication, numbered C(2026) 8250 and dated 30 October. The Commission also proposed an annual EU Preparedness Day on 23 October from 2027, and adopted a non-binding Recommendation asking countries to stress-test the national contact points of the Civil Protection Mechanism so that they can run around the clock even when disruption hits them.

Behind those household measures sits a harder layer of law. The Critical Entities Resilience Directive has applied since 18 October 2024, replacing the older European Critical Infrastructure Directive. A Council Recommendation invites member states to update risk assessments and run stress tests based on common scenarios, beginning with energy. In July 2026 the Commission adopted a Communication with non-binding guidance on technical, security and organisational measures for critical infrastructure. A policy-intelligence scan reports that seven member states were referred to the Court of Justice in April 2026 for failing to transpose the directive, and I treat that as a secondary report pending the Commission’s own record. In March 2026 the Commission published a report on preparedness in the financial sector, which lists the rules on operational resilience, ICT resilience, business continuity and crisis management that already apply to banks and market infrastructure.

Elsewhere the pattern is similar. In the UK, the government set out new rules in October 2026 to protect subsea cables from sabotage, and in April 2025 it published plans for a Cyber Security and Resilience Bill. In Australia, the regulator has started Federal Court proceedings against Optus over the 13-hour emergency-call failure, after a Senate inquiry and an independent review. These are the right kinds of responses to the failures that caused them.

Look at what they share. Almost all address one entity, one sector or one asset class. The stress tests start with energy. The Optus case yields rules on emergency calling. The cable rules protect cables. The household guidance relies on individuals. I know of no regulation that requires a cross-sector, cross-provider test of a simultaneous loss of a hyperscale cloud region, a major identity provider and a payment network, which is the pattern of the more severe scenarios above. Rules are written for the last failure, and the next one is likely to cross the boundaries they draw. An EU Observer commentary on the 72-hour guidelines adds a further criticism: policy commitments often lack operational detail, participation by organisations of people with disabilities is frequently ad hoc, and continuity of support remains a persistent weakness. The author argues for a human continuity test.

What would a stronger set of rules contain? My proposals, offered as editorial judgement, are five. First, require operators of critical services to disclose their dependency on major cloud, identity and DNS providers to their regulator, with tests of what happens when each fails. Second, run cross-provider exercises that remove a hyperscale region and a sign-in service at once. Third, set minimum offline capability for payments and for basic food retail so that people can buy food and fuel for a defined period. Fourth, require emergency-call monitoring that works from outside the operator’s own network, which is the lesson of Optus. Fifth, treat paper lists of vulnerable people held by local services as part of critical infrastructure.

Resilience also carries a privacy cost that regulators should name. Continuity means copies, and copies of health, identity and tax records multiply the places where data can be stolen. The Change Healthcare breach, which touched about 192.7 million people, shows what a single concentrated repository can mean. Data embassies and offline backups solve one problem and sharpen another, and the answer lies in encryption, access control and a clear legal status for the copies, as Estonia’s treaty with Luxembourg tried to provide. A country that builds continuity without building privacy protections has exchanged one risk for another.

Resilience that already works, from Estonia to a shoebox of cash

Most of what makes a society resilient to a total outage is cheap, old and dull. The measures below come from the failures described above, and each is tied to a lesson that an actual incident taught. They are grouped by who has to act, because the same measure can be trivial for a household and expensive for a state.

For households, the baseline is the European Commission’s 72-hour guidance, with the caveat that it is a floor. The list is short: water, long-life food, medicines, lighting, a battery or wind-up radio, a power bank and cash in small notes and coins. The Commission also advises, where possible, a digital payment method that works offline, and identity documents in a waterproof pouch. Add paper copies of the phone numbers and addresses that matter, a paper map of the local area, printed recovery codes for the accounts that would hurt to lose, and a list of the neighbours who are old or alone. Know which radio station carries official information. Avoid the one purchase that killed people in Iberia: do not run a generator or a gas stove indoors. Three of the seven deaths linked to that blackout were carbon monoxide poisonings.

The amount of cash is a personal decision, and the Commission names no figure. A reasonable test is whether the notes in the drawer would pay for three days of food, fuel and transport if every card terminal were dead. That is enough to matter, and not so much that theft or loss becomes a worse risk than the outage. Steady, modest reserves built in calm weather also remove the temptation to join a panic queue, which the Colonial Pipeline episode shows is a hazard in itself.

For businesses, the first task is the one the Parametrix chief executive described: map the providers and assess dependence on each. The AWS outage shows why the mapping must reach the control plane. Servers in a second region are not independence if sign-in, deployment or secrets still live in the first. Specific measures follow from incidents. Keep a break-glass administrator account that does not depend on the main identity provider, store its credentials offline and test it. Keep backups that cannot be altered by whoever controls the network, because Maersk recovered from a single stray copy and no company should plan on that. Print the runbooks. Keep an out-of-band channel for the crisis team, such as phones and a radio, that does not run through the cloud. Host the status page somewhere else. Cloudflare’s own post-mortem lists validating even internally generated configuration files with size limits among its fixes, and the CrowdStrike and AWS cases argue for staged rollouts with a kill switch.

A day-without-the-cloud drill costs a morning and tells a company more than any audit. Have the tills work offline, have the warehouse pick from paper, and see how long the team can take orders by phone. Companies in food retail, pharmacy, healthcare and logistics, where the harm lands on the public, should run it first. Insurance should be read for what it does not cover: Parametrix expected only 10% to 20% of CrowdStrike losses to be insured, and JLR reportedly had no cyber cover at all.

For states, Estonia remains the model on continuity of data. The Luxembourg data embassy holds copies of critical registers and the means to start systems from them, under a legal arrangement that gives the servers an embassy’s protection. The country’s X-Road data exchange and its history of rehearsing failures are part of the same approach. Other states can copy the pattern at lower cost: offline copies of civil, land, tax and health registers, with a tested procedure to start from them, and a list of transactions that must have a paper fallback. Governments should also publish which radio station carries official information, keep fuel reserves for hospitals, water works and emergency services with a way to release them, hold welfare-check lists on paper with local services, and fix the rules for suspending digital deadlines in a prolonged outage before one occurs.

For operators of networks and grids, the priorities are specific. Emergency-call monitoring needs a measurement that works from outside the operator’s own systems, which is the Optus lesson. Black-start plans should be exercised with degraded communications, because the Iberian restart took most of a day with communications intact. Data-centre restart plans should be coordinated with grid operators, given that data centres reached 21% of Irish electricity consumption in 2023. Cable operators and governments should fund repair-ship capacity and cable diversity in the known chokepoints.

A caution applies to all of it. Preparedness has costs, and they fall unevenly. A household list that assumes a car, a cupboard and cash is hard for a person with a disability or a low income to meet, and the EU Observer commentary on the 72-hour guidance makes that point. The Commission’s guidelines on disability-inclusive preparedness exist for this reason, and they should be read as part of the same package, not as an appendix. Resilience that works only for the people who already have margin is not resilience; it is a transfer of risk to the people who do not.

Open questions and a calibrated reading of the worst case

The evidence in this article is strong on what has already failed and weak on what has never been tested. Several questions cannot be answered from public sources, and I list them because the answers would change the conclusions.

How long do backup oscillators and batteries hold timing and signalling across operators when GPS or grid power is lost? How many mobile networks run their cores on public clouds, and what happens to voice calls if those clouds fail? Are the private networks that carry interbank settlement independent of the same fibre, power and operational staff as the public internet, or only logically separate? How much stock do grocery distribution centres, hospital pharmacies and fuel terminals hold, measured in hours, and how fast can each be dispatched on paper? How many wards could run for 72 hours on downtime procedures? How many simultaneous cable cuts could a given region survive, and how long would repair ships take to reach the sites? In what order would a government restore services, and who would decide? None of these has a public answer that I could find, and most should.

There are also open questions about the present. On the day this article is dated, Microsoft had not published the root cause of its 12 and 13 November outage. If the report shows that a shared component or a change process was behind it, that would strengthen the case for the first route in the matrix. If it shows something else, the text above would need to be revised, and I would rather say so now than pretend to a certainty I do not have. The effect of AI-accelerated vulnerability discovery on the balance between attackers and defenders is also unsettled, and the available figures come largely from the companies that sell the tools.

With those limits stated, a calibrated reading of the worst case runs as follows. A literal outage of every online system at once is not credible. A multi-day, multi-layer failure of the commercial internet for most users in a region is credible and low in probability, and it has precedents in each of its parts. For the first 72 hours the order of failure would be payments, communications and workplace systems within minutes to hours, emergency calling and hospital information shortly after, then cash, fuel and fresh food over days. The severity of the second week would depend almost entirely on whether the people and procedures needed to restart the machines exist, and on whether power stayed on.

The worst cases are compounds, especially those that include the loss of electricity or the loss of intercontinental cables, because those have the slowest repairs. The most severe single event would be a Carrington-class storm, and it is also the one with the lowest probability and the cheapest preparation. The most likely event, a cloud and identity cascade, is also the least damaging, and it is the one we are rehearsing every few weeks. Frequent small failures are a better predictor of the shape of the big one than any fictional scenario, because they show the same mechanisms at a scale we can survive.

The criticism that this article set out to make is not that a total outage would be catastrophic. That is obvious. It is that the failures of 2024 to 2026 have repeated the same lessons, a small change reaching everything, a restart slower than the fault, identity and time as shared dependencies, and the public learned about each of them by living through it. Regulators have started to test single sectors. Nobody has published a test of the combination. The measures that would matter most, a radio, a drawer of cash, a printed list of vulnerable neighbours, a tested break-glass account, an off-platform status page, a dependency map and a cross-provider exercise, cost very little against a single day of the failure they address.

Questions readers ask about a worldwide internet outage

A global internet outage would kill payments in minutes and shelves in days

A Thursday in November that already looked like a rehearsal

On Thursday 12 November 2026, at 16:17 UTC, Microsoft’s cloud began to fail. Within about an hour Downdetector counted outage reports from 74 countries and territories. Outlook, Teams, SharePoint Online, Copilot, Defender and the Intune management console went down together, and Kentik’s Doug Madory later put the downtime at roughly 18 hours. Microsoft said it saw no evidence of malicious activity. On Friday morning it still had not published a root cause, only that a large number of servers had become unexpectedly unavailable, while the engineer Gergely Orosz wrote that twelve hours in, nobody had worked out what was killing servers as they came back online.

That is one company, one cloud, about a day. It is also the closest public rehearsal for the question this article asks: what happens to the world, and to an ordinary week, if every online system stops at once?

The question attracts bad answers. Disaster fiction paints darkness, riots and collapse by Tuesday. Corporate risk papers list “business continuity exposures” in a tidy table. Neither tells you what breaks first, what breaks second and where the damage stops. A usable answer starts from failures that have already happened, reads exactly what each one broke, and then stacks them with the grace periods removed.

The record is longer than most people remember. In July 2024 a faulty CrowdStrike update crashed about 8.5 million Windows devices. The insurer Parametrix put direct losses for the US Fortune 500 at $5.4 billion, with roughly three quarters of the health and banking firms in that group paying direct costs. In April 2025 a voltage collapse cut power to about 60 million people in Spain and Portugal, and some areas waited up to 16 hours. In September 2025 a firewall upgrade at the Australian carrier Optus blocked emergency calls for about 13 hours; at least four people who tried to call later died, and a subsequent report tied the upgrade’s failures to two of those deaths. In October 2025 a DNS race condition inside Amazon’s DynamoDB service in Northern Virginia knocked out large parts of AWS. DynamoDB itself recovered in under three hours, but the services built on top of it kept failing until the afternoon. In November 2025 a database permission change at Cloudflare doubled the size of a bot-management file, crashed the proxy software that reads it and cut core traffic for about three hours, with full restoration after nearly six.

The Microsoft outage also did not stay inside Microsoft. Downdetector’s crowdsourced reports that Friday included Gmail, WhatsApp, Claude, Lloyds Bank and, in Britain, the 999 emergency number and NHS England. Crowdsourced reports prove neither cause nor scale, and some of those spikes may be users who could not reach a service through a Microsoft-based sign-in or workflow. The pattern still matters, because it shows how little a user can see of the chain behind a button. The Conversation reported that OpenAI and Anthropic both had problems with the tools that connect their AI services to Microsoft 365. A year of tracking by Control Plane counts 18 major outages at AWS, Azure, Google Cloud and Cloudflare in 2026 alone, and Microsoft’s previous disruption, in September, ran for days.

Every one of these events was a slice. Every one was repaired by people who still had working phones, power, email and internet to coordinate the repair. During the Microsoft incident, administrators compared notes on Reddit, Mastodon, Bluesky and LinkedIn, and none of those platforms was down. A total outage removes that last condition, and it is the point the rest of this article returns to. The worst case is not data vanishing. It is the loss of the coordination layer: the shared clock, the payment rail, the sign-in, the message that tells a truck where to go, and the same loss striking the people who would normally fix it.

Three habits govern the text that follows. Facts carry a source and a date. Mechanisms, the explanations of why one failure drags another behind it, are labelled as explanation. Judgements, such as which scenario is more plausible than another, are labelled as mine, because no dataset settles them. Everything is dated to 13 November 2026, a day on which the Microsoft outage was still being repaired and its cause was still unpublished.

Defining a total outage and its honest limits

Read literally, “all online systems at once” cannot happen. The public internet is stitched together from tens of thousands of independently operated networks, and many systems that matter, from military networks to plant-floor controllers, sit on private links that no single fault reaches. A scenario that required every one of them to fail in the same minute would need a cause with no known counterpart.

So this article uses a narrower definition and states it plainly. A total outage here means a correlated failure that takes the commercial internet away from most users in most regions for at least several days, leaving local islands that work and little else. It does not require every cable to be cut or every server to be wiped. It requires that at least three of five layers fail together: physical transport (fibre, subsea cables, mobile networks), naming and routing (DNS and BGP), cloud and delivery platforms, identity and sign-in, and the applications on top.

“Online” needs a boundary too. In the sense that matters for daily life, an online system is any system that needs a round trip to a machine its user does not control. That covers a card terminal asking a bank for permission, a pharmacy checking an insurance claim, a warehouse scanner receiving its next pick, a rail signaller consulting a timetable server, and a mobile phone whose network core runs on internet protocols. It leaves out a light switch, a gas stove, a mechanical lock and an AM radio. The gap between the two lists is the size of the problem. In many countries the traditional telephone network is also moving onto internet protocols, which removes one more fallback.

Three facts keep the scenario from sliding into fiction. First, correlated failures already occur when providers share a dependency, and the frequency is not small. Beyond the 18 major outages Control Plane counts for 2026, a thermal event in a single AWS us-east-1 availability zone in May took 21 hours and 30 minutes to reach majority recovery. Second, the longest public outages measured so far run from hours to a few days. TechCrunch described the September 2026 Microsoft disruption as lasting days, and Microsoft blamed a core authentication configuration. Third, nothing on record has lasted weeks across regions.

That third fact sets the limit of what can be called evidence. Everything in the first 72 hours can lean on documented incidents. Anything beyond day three is extrapolation from components, and the text says so each time it crosses that line. The article therefore reads in three horizons: the first hour, the first 72 hours, and the first two weeks.

The tone is deliberately hard on the way modern systems are built and deliberately cautious about claims. Dependency chains that nobody mapped are a legitimate target for blunt criticism. A confident forecast of riots in week one is not, because the Iberian blackout, the best large-scale natural experiment Europe has had in two decades, produced queues, shelter beds and traffic improvised by volunteers rather than collapse. Where the evidence is that mild, the text says it is mild. Where the evidence is that bad, as with emergency calls, it says that too.

The article does not assign probabilities to a total outage. Published estimates of that kind either hide their assumptions or mix incompatible causes. A later section ranks five credible routes to a near-total failure by plausibility and damage, and that ranking is an editorial judgement, not a forecast.

The internet as a stack of dependencies, not a switch

People talk about “the internet going down” as if it were a lamp on a wall. It is closer to a building with forty floors where the lift, the stairs and the water pump are all run from the top one. A page loads because a dozen separate systems agree, in sequence, in under a second. If any layer disagrees, the page does not load, and the user sees the same blank screen whatever the layer.

The bottom layer is physical: fibre in the ground, cables on the seabed, mobile masts, data centres and the electricity that feeds all of them. Above it sits routing, the protocol called BGP through which independent networks tell each other which addresses they can reach. Above routing sits naming, the DNS that turns a readable name into a machine address. Then comes the encrypted connection, which needs a valid certificate and a correct clock. Then the platforms, the clouds and content delivery networks that host the code. Then identity, the system that decides who you are. Last comes the application, and behind the application the business process: a card payment, a prescription, a delivery.

A single card payment shows the sequence. As an explanation rather than a measured fact: the terminal looks up an address through DNS, opens an encrypted session, and sends a message through an acquirer to a card network, which routes it to the issuing bank. The issuer’s fraud engine runs in some cloud region and checks a database in another. The reply travels the same path in reverse. The round trip finishes in a couple of seconds, it touches easily half a dozen independent organisations, and none of them is visible to the cashier.

The October 2025 AWS failure is the cleanest published demonstration of how a bottom-layer fault climbs. AWS’s own summary traces it to a latent race condition in the automation that manages DNS records for DynamoDB’s regional endpoint in Northern Virginia. Automated components applied conflicting plans and left an empty record: the name existed, but it pointed to no address. From 11:48 PM Pacific on 19 October, every system that needed DynamoDB through its public endpoint in that region failed to connect. Engineers pinned the cause to DynamoDB’s DNS state at 12:38 AM, and DynamoDB errors ended at 2:40 AM. EC2 launch failures lasted until 1:50 PM, because new servers could not start while the systems that manage them worked through a recovering backlog. Network load balancers had their own faults between 5:30 AM and 2:09 PM. Nothing was hacked and nothing was physically broken, and one missing record took about fourteen and a half hours to unwind.

The geography of the damage fooled many readers. Analyses of AWS’s post-event summary point out that customers outside Northern Virginia were hit when authentication, deployment or control-plane services depended on that region, and one such analysis cites AWS’s own account of Redshift customers in other regions meeting an identity-service dependency there. Running servers in a second region is not the same as being operationally independent of the first. A firm can keep its web servers and database replicas in Frankfurt and still fail because the sign-in service it relies on lives in Virginia.

The Microsoft incident has the same shape on a larger scale. Microsoft first traced the outage to cloud-based server problems in the Americas, which it said overloaded the remaining infrastructure and spread the disruption to other regions. The mechanism is familiar to anyone who has watched a motorway jam form. Healthy capacity absorbs the traffic of failed capacity, becomes overloaded and fails in turn, and every client that retries adds load. Recovery then takes longer than the fault, because a server that restarts has to rejoin services that are themselves overloaded. That is explanation, not Microsoft’s published account, which at the time of writing is still thin.

Cloudflare’s November 2025 outage adds a smaller, more human detail. The first hypothesis inside the company was a hyper-scale DDoS attack, partly because Cloudflare’s own status page, hosted off its platform, happened to fail at the same moment. The real cause was a permissions change in a ClickHouse database that doubled the size of a configuration file for bot management. The file crossed a hard-coded limit of 200 features, an unhandled error crashed the proxy software, and for a while the network flipped between working and failing every few minutes as good and bad versions of the file alternated. During an incident, the status page of the provider is a dependency too.

Each layer fails at a different speed and is repaired by a different method. A bad DNS record or routing change gets fixed by a rollback, in minutes to hours, if the people who own it can still reach their own tools. Certificate and clock errors need hands on individual machines. Physical faults need ships, trucks and spare parts, in days to months. A total outage becomes dangerous in proportion to how many layers need manual repair at the same time. The Parametrix chief executive advised firms to map their service providers and assess their dependence on each, and the advice is sound. It also describes a task that almost nobody has finished, including the operators themselves.

Concentration risk in three clouds and a handful of gatekeepers

Synergy Research Group’s third-quarter 2026 figures put worldwide spending on cloud infrastructure services at about $168 billion for the quarter, up 55% on the year and more than double the level of the same quarter in 2024. Amazon holds 26% of the market, Microsoft 19% and Google 16%. Three companies therefore carry 61% of the money spent, and the United States accounts for 44% of the global total. A year earlier the same three held roughly 63%. They are slowly losing share to neoclouds built for AI work, but the market grew so quickly that their absolute capacity is larger than ever, and AI-specific services now make up about a third of everything sold. Growth is moving concentration around more than it is reducing it.

The pattern repeats at other layers. Cloudflare’s reverse proxy sat in front of about 20.5% of all websites at the end of 2025, according to W3Techs figures cited by the incident-tracking firm ilert, which put its share of the reverse-proxy market near 81%. In July 2024 CrowdStrike’s sensor sat inside roughly 8.5 million Windows machines, less than 1% of all Windows devices, yet the crash reached about a quarter of the Fortune 500, all six of the airlines in that group and about three quarters of its health and banking firms. A small share of devices carried a large share of the damage because they were the right devices: check-in desks, hospital workstations, trading floors.

Identity is the quietest concentration. Most people sign in to dozens of services with a small number of accounts, and recovery for those accounts usually runs through email. During the Microsoft outage the security researcher Troy Hunt wrote that he was locked out of several services that use email for login, and said that with a handful of companies supplying the infrastructure, an ordinary business has little it can do to plan for the failure of one. It is a pessimistic view, but it matches the way the dependency chain is built.

The honest counterpoint is that concentration also buys quality. Parametrix found in the CrowdStrike case that cloud-based systems recovered faster than traditional computing setups. A large provider employs more engineers, runs more monitoring and keeps more spare parts than a small firm’s single server room ever will. The trade is between frequency and correlation. A thousand firms with a thousand separate server rooms each fail rarely and independently, and the economy keeps running around the gaps. The same thousand firms on one cloud region fail less often and all at once. A total outage lives entirely in the correlation, not in the frequency.

Why does concentration persist? Price, features, hiring and compliance all favour the big platforms, and none of them prices the spillover. A firm that picks a single provider bears its own outage costs, not the economy’s. Parametrix put the average direct loss at $44 million for each affected Fortune 500 company and expected cyber insurance to cover only 10% to 20% of the total. CyberCube estimated insured losses from the CrowdStrike event between $400 million and $1.5 billion and called it potentially the worst loss in the cyber insurance market in 20 years. Insurers cannot absorb a systemic event, so they cap their cover, and the risk returns to firms and, at the edge, to the public.

Spare capacity is the other missing price. Nobody is paid to keep idle servers for the benefit of strangers, yet idle servers are exactly what absorb the load of a failed neighbour. One comparison of the three providers’ third-quarter results describes all three as short of capacity while AI demand grows. I cannot verify failover headroom from outside, and the providers do not publish it. It is nevertheless reasonable to read the Microsoft account of overloaded remaining infrastructure as a sign that headroom is thinner than the market shares suggest. That is a judgement, and it is the first of several in this article that rest on what operators do not disclose.

Four failures, one pattern: small changes with global reach

Four recent incidents can be laid side by side. They differ in cause and in duration. What they share is more telling than what separates them.

Four large failures compared, 2024 to 2026

The table is deliberately plain, and its main message is in the “trigger” column. None of the four is known to have involved an attacker. A quality-control bug, a race condition, a permissions tweak and an as yet unexplained server failure were enough, and in the first three cases the trigger was a routine change pushed through trusted automation. CrowdStrike needed about six days to bring 97% of the affected machines back, because fixing a machine that cannot boot means touching the machine. The other three recovered in hours because the repair was a rollback that the operator could push from a central point.

Several traits repeat. The change was small and routine. The automation that applied it was trusted and fast, so it reached the whole fleet before any human could look. The blast radius had not been tested, because nobody had imagined that file, that record or that permission as a global switch. The recovery took longer than the fault, since restarting systems queue behind each other. And the first diagnosis was uncertain. Cloudflare suspected a DDoS attack. Microsoft’s status page first said the outage involved no security issue, then revised the line to say it was not aware of any malicious activity. Neither company lied; both were reporting the limit of what they knew in the first hours.

That uncertainty is a hazard in itself. In a real total outage the first question every government and operator would ask is whether it is an accident or an attack, and the answer determines the response: isolate and rebuild, or fix and restore. An attacker who understands this can hide inside the ambiguity. A defender who guesses wrong in either direction loses days. It is one of the reasons accident data is a fair guide to the worst case. Accidents show the mechanism a deliberate actor would copy: a small change, pushed through trusted automation, with global reach.

There is also a lesson in what the four did not do. None of them took down every provider at once. When AWS failed, Microsoft and Google ran. When Cloudflare failed, most sites that did not use it stayed up. The world’s online systems are less synchronised than the headline “half the internet is down” suggests, and that mismatch is the only reason the previous incidents ended in costs measured in billions rather than in a crisis. The scenario of this article removes that mismatch. It assumes the same kind of trigger acting on a layer that every provider shares: a common library, a common certificate authority, a common time source, a common update channel or a common cable corridor.

Which shared layers exist is not secret. Time is one, and a later section covers GPS. Software supply chains are another, and the CrowdStrike incident is the proof of concept. Routing is a third: the global BGP table has no central authority, and a bad announcement from one network can reach the rest within minutes, as Cloudflare has described in earlier incidents. DNS root and top-level infrastructure is a fourth, resilient by design but not independent of the operators who run it. None of these is a prediction. Each is a place where a small change could have a global reach, and the history above shows that small changes already do.

The first sixty minutes of a worldwide outage

What follows is scenario extrapolation, built from the incidents above and labelled as such. It assumes a cause that takes down cloud platforms, major content networks and the identity services layered on top of them, while power stays on and most physical networks stay intact. That is the mildest version of a total outage, and it is already severe.

In the first five minutes nobody knows what is happening. Users see apps spin and pages fail. Inside companies, the monitoring tools that would announce the problem often run in the same clouds that have failed, so the dashboards go dark or freeze. The Microsoft incident showed the pattern in small: administrators could not reach management consoles and learned about the outage from public trackers, which themselves depended on the working parts of the internet. In a total outage the trackers would fail too. An organisation would not even be able to check whether it is the only one affected.

By minute fifteen, card payments start to fail in earnest. A terminal that cannot reach its acquirer cannot approve a purchase, and online banking, mobile wallets and transfers stop. Airline check-in, boarding and crew-scheduling systems stall, much as they did in July 2024, when CrowdStrike’s update contributed to more than 3,000 flight cancellations and delayed 23,900 more. Ride and delivery apps go quiet. Offices cannot reach email or documents. Mobile voice calls might continue for a time, because voice has traditionally run on separate signalling, but the core networks of modern operators run on internet protocols and cloud-hosted components, so how long voice survives is an open question, and the answer differs by country and carrier.

By minute thirty, behaviour changes. The Iberian blackout of 28 April 2025 offers the best European record of how people react in the first hours, and it is gentler than the film version. ENTSO-E’s expert panel found that the system went from normal to blackout in about 90 seconds. Within hours, stores in Barcelona were selling battery radios, generator shops in Terrassa had run out, queues formed for emergency supplies in Portugal, and civilians directed traffic at dead junctions in Madrid and Barcelona. Spain’s prime minister asked the public to call emergency services only if really necessary. People searched for information with the one tool that still worked, the radio.

Information is the scarcest resource in this window. Governments and broadcasters have working alternatives, since radio and television transmitters have their own power and the mobile network can still push cell-broadcast alerts in some countries, although how many handsets would receive them without a working data connection is uncertain. But official messaging depends on the people who write it being able to reach one another. The cabinet that must meet by video link cannot. The emergency coordinator who must check hospital capacity through a web portal cannot. In the Iberian case, the Spanish government convened its national security council the same afternoon, because the people involved were in the same city. A country with its crisis staff in one place coped better than a company with its staff on four continents.

By minute sixty the first measurable harms arrive. Emergency calls are the sharpest. In the Optus failure, 13 hours of blocked calls produced about 600 failed calls and at least four deaths, on a single carrier and with other networks working. In a worldwide outage the question is not whether some calls fail but how many dispatch centres can still receive and route them, and whether an ambulance crew still gets an address. Hospitals begin to lose electronic records. Pharmacies cannot verify claims or prescriptions. Transport networks that rely on live scheduling start to improvise.

The first hour produces few dead and many unanswered questions. It is the hours that follow that turn inconvenience into harm, because the grace periods built into modern life, a charged phone, a full tank, a store’s stock, a bank balance that is still readable, begin to run out one after another. The next sections take each of those clocks in turn.

Cards, ATMs and the cash gap

Payment is where a total outage becomes personal within minutes. Card authorisation is an online round trip: the terminal asks, the issuing bank answers. If the terminal cannot reach its acquirer, the purchase either fails or falls back to an offline mode whose behaviour depends on how the merchant and the acquirer configured it, usually with low limits and often switched off. Most customers would find out at the till, and most cashiers would have no instruction for what to do next.

The Iberian blackout shows how this looks in practice, with a caveat worth keeping. On 28 April 2025 the Bank of Spain said electronic banking was working adequately on backup systems. At the same time residents reported ATM screens going blank, and in Portugal ATMs and electronic payment systems were affected. The ledgers survived, but the front doors did not. That split is the pattern to expect from a network failure: balances sit in redundant data centres, while the terminals, apps and links that let a person reach them stop working. Banking is also not a sector that escapes losses by staying open. Parametrix assigned $1.15 billion of the CrowdStrike damage to Fortune 500 banks.

Retail shows the same weakness from the shop floor. One account of the spring 2025 attacks on Marks & Spencer and the Co-op says that online systems were shut down in response, that payments could not be accepted and that shelves emptied as supply chains stalled. Those were two companies, with every other retailer and bank still working. A shop that cannot reach its payment provider also usually cannot reach its price file, its stock system or its loyalty database, because they sit in the same cloud. A till is one thing; a till that knows what a litre of milk costs is another.

Then comes the cash question. On 3 November 2026 the European Commission published guidance telling households to be able to cope on their own for at least 72 hours in a crisis. The guidance says households should keep cash, including small notes and coins, in case digital payment systems fail, and where possible a digital payment method that works offline. It is a communication, not a law. It names seven categories of need, sets no quantities and imposes no obligations. No statistic tells us how many households hold three days of cash. The fact that officials felt the need to say it is evidence that they suspect many do not, and that suspicion is a judgement I share.

An ATM has the same dependencies as a till and two more. It needs a network connection to authorise a withdrawal, and it needs a cash-in-transit firm whose dispatch, routing and vault systems are themselves online. A customer with a healthy bank balance, a valid card and a working ID could therefore stand in front of a closed machine and a closed branch, because a branch cannot confirm identity or move money without its systems. Cash is a stock, not a flow, and a total outage turns a flow economy into a stock economy overnight. The ones who fare well are those who already hold stock: small shops with cash boxes, market traders, tourists carrying notes, and older people who never stopped using cash.

Behind the retail layer sits wholesale money. The UK government has said that about £1.4 trillion in daily UK transactions depends on the subsea cable industry, and that about 65 cables connect the country. Central banks and payment operators run private networks and rehearse failovers, and it would be unfair to assume they have no plan. I have found no public test, however, of a simultaneous loss of the public cloud layer and the networks that carry settlement. In that gap sits a problem that no outside observer can size: transactions caught in flight. A transfer that was accepted by one system and not yet recorded by another leaves two ledgers that disagree, and settling the disagreement can take days even after the connection returns.

The ledger gap has a human side. When systems restart, the first priority is to bring up the ones that move money safely, and the second is to reconcile what happened during the gap. Customers whose salary or benefit payment fell inside the window may wait longer than customers whose money did not move. People living close to the edge, who spend their income as it arrives, carry the heaviest burden of any short-term freeze. A payments failure that lasts 24 hours is an inconvenience for a household with savings and a crisis for one without.

For that reason payments are both the first system to fail and the first that individuals can partly repair themselves, with a few notes and some coins. It explains why cash appears in every official kit list. But cash only works if there is something to buy, and stocks of goods behave on a different clock. That is the subject of a later section.

Telecom networks and the emergency call that never connects

The Optus failure of 18 September 2025 is the best documented case of an emergency system failing without anyone inside the company knowing. Optus began a routine firewall upgrade at about 12:30 AM. The upgrade blocked calls to the Triple Zero emergency number for customers in South Australia, Western Australia, the Northern Territory and New South Wales. Ordinary calls kept working. The safety net that should have routed an emergency call through another carrier’s network, called camp-on, did not work either. Optus learned of the fault shortly after midday, stopped the upgrade and restored emergency calling after about 13 hours.

Chief executive Stephen Rue said no alarms had told the company that some emergency calls were failing. A customer had phoned a contact centre at around 9 AM to complain, and at least five customers contacted overseas centres during the outage, where operators did not escalate the warnings. A later report found at least ten mistakes by technicians and described bad instructions from the company. It also noted that Optus’s process did not capture “grey” devices that had been bought online or overseas and might not comply. The first estimate was about 600 failed calls. The Australian communications regulator later found that 2,145 people had been denied emergency call access, and that Optus had not carried out welfare checks on 369 of those who tried to call. At least four people who tried to call died, and the independent report tied the upgrade’s failures to two of those deaths. The regulator has since started Federal Court proceedings.

Emergency calling is a service where silence looks identical to success. A dispatch centre that receives no calls looks fine, a monitoring dashboard that counts only completed calls looks fine, and the failure shows up only when a person who is not breathing is not reached. That property matters for a total outage, because the monitoring that would catch a failure depends on the same network and the same operational discipline that has just broken.

Scale the Australian case up. An emergency call passes through the access network, which is the radio mast or the fixed line, then through the operator’s core, which is increasingly software and in some operators partly cloud-hosted, then across interconnection points between operators, then through the routing layer that picks the correct dispatch centre, and finally into the dispatch centre’s own software that locates the caller and assigns a crew. In many countries the circuit-switched telephone network, which tolerated a surprising amount of abuse, is being retired, and emergency services are moving to internet protocols. That move brings better location data and richer media. It also ties the emergency call to the same dependency chain as everything else, and that trade deserves more public debate than it has had.

The evidence for mobile networks under stress comes from the Iberian blackout, where the cause was power rather than internet failure. The AP reported that millions of people lost phone and internet coverage, that calls were impossible on most mobile networks and that some apps worked sporadically. In a scenario where power stays on but cloud services fail, masts would keep radiating, and the answer would depend on how each operator built its core. Some networks would hold. Others would fail. I cannot name which ones, and neither can most regulators, because the dependency maps are private.

Dedicated radio networks used by police, fire and ambulance crews run separately in most countries and would probably keep working. The weak link is the public’s route to them. A person with a dead phone needs a working landline, a neighbour whose phone works, a fire station or a police station within walking distance, or a lift from someone who is heading that way. In a rural area that is a long list of ifs. Welfare checks, the routine step that follows any known failure, would become the main emergency task. After the Optus incident, South Australia Police carried out 154 welfare checks on one carrier’s customers within about two days. In a worldwide outage the number of people who would need checking, many of them old, isolated or dependent on powered devices such as oxygen concentrators, runs into the millions.

The Iberian authorities understood the risk. Spain’s prime minister asked the public to call emergency services only if really necessary, and Portuguese police put more officers on duty to cope with calls for help, including from people trapped in elevators. Those are the instruments of a state that still has a working command chain. The European Commission’s November 2026 package includes a non-binding recommendation on operational continuity and stress-testing, although it covers the national contact points of the EU Civil Protection Mechanism and not public emergency calling. Until stress tests include the loss of the public cloud layer, the honest description of emergency calling in a total outage is this: the dedicated radios would probably work, the public’s access would probably not, and no one knows by how much.

A power grid that needs its own communications

The electricity grid is the one dependency that all the others share, and the Iberian blackout of 28 April 2025 is the best evidence Europe has of what its failure feels like. A 49-member expert panel under ENTSO-E, the association of European transmission operators, spent almost a year on the case and published a 472-page final report in March 2026. It called the event the most severe in Europe in 20 years. At about 12:33 CEST the system went from a normal day to a blackout in roughly 90 seconds, and around 60 million people lost power.

The report is a warning about unknown unknowns. ENTSO-E found no single cause. It described a rapid rise in voltage, oscillations, uneven control of voltage by individual generators, limited reactive power capacity and a cascade of generator disconnections, many of which were inverters tripping on overvoltage. Earlier reporting called it the first known blackout caused by excessive voltage, and an analysis of the final report in POWER magazine says that the existing defence architecture was not equipped to interrupt an overvoltage cascade. The grid’s own engineers had not planned for the mechanism that took it down. That sentence deserves to sit beside any confident claim about what a different, larger failure would or would not do.

The restart tells the second half of the story. Spain had recovered more than 92% of its power by 5 AM on Tuesday, roughly 16 hours after the collapse, although some areas waited longer for stable supply. At 8:35 PM on Monday only 35% of demand had been restored. Electricity was pulled in from Morocco and France to restart the south and the north. Hospitals and emergency services ran on generators, gas stations stopped working, and the German outlet heise reported that at least seven people died of indirect consequences, three of them from carbon monoxide poisoning caused by emergency generators. The most dangerous object in a long blackout can be the machine people buy to survive it.

Now add the internet. Protection equipment inside substations acts locally in milliseconds and needs no network to open a breaker. That is by design, and it is why a loss of cloud services would not by itself switch the lights off. What degrades is everything above the protection layer: coordination between control centres, remote dispatch of wind and solar plants, market systems that schedule generation, forecasting, smart-meter data, demand response, and the remote access that lets an engineer reconfigure a substation from a desk. Operators run private networks for the most sensitive control traffic, and I cannot see inside those. I can say that the share of grid operations that touch IP-based systems has grown steadily, and that the dependence is circular. Masts and data centres need power, and the grid needs communications that run through masts and data centres.

In the first hours of a pure internet outage the grid would probably cope, because its core control loops are local and its operators are trained to run it in degraded modes. The risk rises with time and with the fraction of generation that is small, distributed and remotely controlled, such as rooftop and farm solar. The more of the system that is a million small devices and the fewer large synchronous machines, the more the grid depends on software and communications to stay stable. The Iberian report found Spain’s system short of the voltage control it needed on that day. A grid short on control and also short on communications is a worse place to be.

The combined case is the true nightmare for restoration. Restarting a grid after a collapse, called black start, needs control centres to talk to plants, plants to talk to each other, and neighbouring operators to agree when to reconnect. In Iberia all of that was possible, and it still took most of a day. If the communications layer were also degraded, restoration would likely take longer. That is my judgement from the way black start works, not a published result, and I know of no public exercise that tests it end to end.

The grid is also a target as well as a victim. US agencies assessed that the Chinese state-sponsored group Volt Typhoon had compromised IT environments in the communications, energy, transportation and water sectors and had remained inside some networks for as long as five years. Their stated concern was access that could allow movement into operational technology, including heating and cooling in server rooms and the control of energy and water systems. The agencies also said they had not seen the group use that access to disrupt anything. A later section returns to this.

For households the lesson of Iberia is practical. A grid collapse lasting 16 hours produced shelters, queues and improvised traffic control, but no breakdown of order. A collapse lasting a week would be a different event, because refrigerated food, medicines and heating all run on clocks measured in hours and days. Battery radios, cash, water and a safe way to run any generator are the unglamorous items that appear in every official list for that reason.

GPS time as the silent synchroniser

Most people think of GPS as a map. For the infrastructure of the internet it is mainly a clock. Cellular networks use satellite-derived time to hand calls between towers and to avoid interfering with each other. Power utilities use it to compare measurements taken in different places at the same instant. Financial systems use it to timestamp transactions. Data centres use it to keep distributed databases consistent. Remove the signal and the receivers fall back on local oscillators that drift, slowly at first and then fast enough to matter.

The best-known estimate of the cost is a 2019 study for the US National Institute of Standards and Technology by RTI International. It put the loss from a GPS outage at about $1 billion per day, rising to $1.5 billion in the April and May planting season. One of the authors, Kyle Clark-Sutton, called a billion dollars a day the floor rather than the ceiling. Another estimate, by the Brattle Group for the terrestrial-positioning firm NextNav, put a month-long US outage at $58.2 billion, and since NextNav sells a backup system the figure should be read with the commercial interest in mind. The RTI study also found that, after 30 days, wireless networks would work at about 60% of normal capability in the best case.

GPS is not the internet, and an internet outage does not turn it off. The dependence runs the other way, and that matters for the total outage scenario because a time failure would hit many layers at once. Time is the one shared dependency that almost every layer quietly uses. A server with the wrong clock rejects valid security certificates. A phone network with drifting timing drops calls. A grid with no common reference loses sight of how its own oscillations spread. This is explanation, not measurement, and the length of time that backup oscillators hold depends on the equipment installed, which operators rarely publish.

Two events show how fragile the margin is. In May 2024 the Gannon geomagnetic storm degraded GPS accuracy by tens of metres for hours. A report cited by Risk & Insurance puts the error at up to 70 metres for about six hours, and Kansas State University’s Terry Griffin estimated that tractors drifting off their guidance lines cost farmers in the US Midwest more than $500 million during planting. Most of the damage was to precision farming rather than to networks, because infrastructure operators had backups and early warnings. The second case is deliberate. Jamming and spoofing of satellite signals is routine in conflict regions, and a determined actor could cause local timing faults far from any front line. I do not have a measured figure for how often that happens in Europe, so I will not give one.

Europe is better placed than most. It operates its own Galileo satellites, and most modern receivers can use several constellations, so the loss of one does not blind them. The weakness is that all constellations are exposed to the same space weather and to the same jamming. Terrestrial alternatives to satellite timing exist, among them long-wave radio navigation and time delivered over fibre, but they are not deployed at the scale the dependence would justify. The cost of a backup is easy to see, and the cost of a failure that has not happened yet is not.

Hospitals that fall back to paper they no longer have

A hospital runs on three kinds of memory: the record of who the patient is and what has been done, the stream of orders and results, and the supply chain behind both. In 2024 two attacks hit different parts of that memory, and between them they give the clearest preview of what a total outage does to care.

On 21 February 2024 ransomware hit Change Healthcare, a UnitedHealth subsidiary that handles an estimated one in three US healthcare transactions. Hospitals, pharmacies and doctors’ offices use it to verify insurance, obtain prior authorisations, submit claims and route payments, and about 67,000 pharmacies dealt with systems that ran through it. The company shut systems down to contain the spread. For weeks pharmacies struggled to fill prescriptions, providers could not process claims, and practices scrambled to stay open. The data of about 192.7 million people was eventually counted as affected, and UnitedHealth lost $3.09 billion in 2024. Nothing was wrong with a hospital’s own computers, and care was harmed anyway. The weak point was a link in a chain that most patients had never heard of.

In June 2024 the London pathology provider Synnovis was hit by the Qilin ransomware group. NHS England reported that 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at two trusts, and about 1,100 cancer treatments were delayed. The lab could not match blood groups quickly, hospitals fell back on universal O-type blood, and stocks ran short. By the end of 2024 services had been restored. In June 2025 King’s College Hospital confirmed that one patient had died unexpectedly during the attack and that the contributing factors included a long wait for a blood test result. The trust said it could not determine whether the attack caused the death directly, and an earlier report had counted at least two cases of severe patient harm. A King’s College London study cited by The Record found that digital outages cascade through clinical care wherever services depend on integrated systems and real-time data.

In both cases the failing component was outside the hospital and narrow in function: insurance and claims in one, pathology in the other. In a total outage every external service fails together, along with most of the internal systems that now live in the cloud: electronic patient records, imaging archives, laboratory and pharmacy systems, e-prescribing, medication cabinets, patient identification, bed management and ambulance dispatch. Hospitals keep downtime procedures, meaning paper forms, printed medication charts and runners who carry results by hand. But paper is a skill as well as a stock. Forms must be printed and stored, staff must know the workflow, and many clinicians trained in the past 15 years may have little or no experience of running a ward without a screen. I know of no audit that tests how many wards could work for 72 hours without their records. The reports of the incidents above suggest the answer is not many, and that is a judgement, not a measurement.

Care splits by urgency, and the clock differs for each type. Time-critical conditions such as stroke, heart attack, sepsis and major trauma depend on imaging and laboratory results within minutes to hours, and delays kill quickly. Chronic dependence, in patients on dialysis, home oxygen or ventilation, relies on powered devices and on regular deliveries. Scheduled care, which covers cancer therapy and surgery, depends on a pipeline of tests and approvals, and weeks of delay cause harm that is hard to see and real. The Synnovis numbers belong to this third kind. They are what a narrow, local outage looks like. A total outage would scale them by a factor nobody has measured.

The Iberian blackout adds evidence from a power failure. Hospitals in Madrid and Catalonia suspended routine work and treated critical patients on backup generators, and homebound patients who depend on oxygen machines were among those hit hardest. The deaths from carbon monoxide came from generators, not from hospitals. In an internet-led outage with power on, hospitals would keep their lights and their ventilators running. The loss would be information, and Parametrix’s numbers for CrowdStrike show how heavily healthcare carries that exposure: it took the largest sector loss, $1.94 billion, and about three quarters of the Fortune 500 healthcare companies were hit.

Medicines and supplies are a second chain. Hospitals order drugs and consumables electronically from wholesalers who run just-in-time stock, and hold little spare. Pharmacies in countries that have moved prescribing into national electronic systems, which includes Slovakia and the Czech Republic, depend on those systems to dispense chronic medication. I have not found a public statement of what a pharmacy there would do if the system were unreachable for a week. The answer may exist in an emergency plan that was never published. It deserves to be public, because the people who would need it are exactly those who cannot improvise.

None of this means hospitals are badly run. They are generally good at power failures, mass-casualty drills and flu surges. They are poor at the one thing a total outage removes, the shared digital record that lets a team of strangers treat a patient safely, and the weakness comes from how health care was digitised, not from carelessness. The failure mode is a safe hospital that no longer knows who is in it.

Food systems built for a three-day buffer

A modern food supply chain holds very little between the farm and the plate. Supermarkets keep stock measured in days, and fresh goods in a day or two. They order by forecast, and software replenishes shelves from distribution centres that run on tight schedules. Trucks are routed by software, refrigeration is monitored remotely, and orders to suppliers move through electronic data interchange. That efficiency is why the shelves are full on a normal Tuesday. It also means the buffer is short, and the EU’s 72-hour guidance rests on it.

The clearest recent test came in spring 2025, when attackers hit Marks & Spencer and then the Co-op. The Co-op shut down parts of its supply chain and logistics operation to contain the intrusion. Shoppers reported stores without milk or fresh produce for days, and The Grocer described availability as crippled. Two weeks into the incident, staff told Recorded Future News that deliveries from the Co-op’s large depots were well below 20% of normal capacity. On the Scottish island of Islay, where the Co-op is the only large grocery store, the company had to bring in a temporary supply. M&S paused online orders, saw empty shelves and sent warehouse workers home.

Those two cases are the nearest thing on record to a food-supply stress test, and they carry two lessons. First, shelves emptied within days, not weeks, even though only one retailer was affected. Second, in most places other shops could fill the gap. As The Record noted, outside places like Islay customers could shop elsewhere. A total outage removes the neighbour who can absorb your customers. Every retailer, wholesaler and haulier would be disrupted at once, and every distribution centre would be trying to restart manually in the same week.

The mechanism behind the speed is worth spelling out. A modern warehouse does not know where its goods are without its software. Pickers follow instructions on handheld devices, pallets are tracked by scans, and trucks are dispatched against orders that arrive from stores overnight. When the software goes, the goods are still on the shelves of the warehouse, but nobody can find, pick or dispatch them quickly. A manual restart with paper lists and phone calls is possible. It is slow, and the Co-op’s figure of under 20% of normal depot throughput gives one data point for how slow, from a company that still had working phones and partly working systems. I use it as a reference, not a forecast.

Primary production is exposed as well. Dairies schedule milk collection by software, because milk cannot wait. Greenhouses and cold stores depend on power and remote monitoring. Precision farming leans on GPS, and the May 2024 geomagnetic storm cost US Midwest farmers more than $500 million during planting, while the 2019 NIST study put the daily cost of a GPS outage at $1.5 billion in the planting season. Timing matters. The same outage in January would hit cold chains and heating. In April it would hit sowing, and a missed planting window cannot be recovered later in the year.

Expect behaviour to amplify the physical shortage. Shoppers who see a bare shelf buy more of what remains, which empties the next store faster. The EU stresses that its guidance is not a call for panic buying or stockpiling, and the advice is sensible: a modest, steady household reserve built in calm weather works against the rush, because it removes the reason to join the queue. The reserve is the only part of the food system an individual controls.

A rough timeline follows, offered as judgement based on the Co-op, Iberian and EU evidence. In the first day, fresh items thin out and queues form where cash is accepted. By day three, bread, milk and produce are scarce in many urban shops, and rural shops with long delivery chains are worse off. By day five to seven, ambient goods, which have more shelf life, start to thin as panic buying and the failure of replenishment meet. Warehouses would still hold stock, and the question is how quickly manual dispatch can move it. The central point is that hunger is not the first-week problem; distribution is. The food exists. The system that finds it and moves it does not.

Fuel, ports and the logistics that run on messages

Every physical movement in a supply chain is preceded by a message that authorises it. A truck leaves because an order was released, a container leaves a port because customs and the shipping line cleared it, a tanker discharges because a nomination was confirmed. Take the messages away and the trucks, ships and tankers still exist, but nothing tells them where to go. The best evidence for how fast that matters comes from four incidents that each removed a different part of the message layer.

The first is Maersk and NotPetya in June 2017. The malware wiped about 45,000 PCs and 4,000 servers across the shipping group, and 76 port terminals were affected. Chairman Jim Hagemann Snabe later said the company reinstalled 4,000 servers, 45,000 PCs and 2,500 applications in ten days, work that he said would normally take about six months. He also noted that a ship carrying 10,000 to 20,000 containers docks into a port every 15 minutes. Employees managed to process about 80% of the normal work volume by hand, and the incident still cost Maersk between $250 million and $300 million. Manual operation held up, but at a price that a company with a working global network around it could pay.

The second is Colonial Pipeline in May 2021. A ransomware attack hit the company’s billing and business systems, and the operational pumping systems were not compromised. Colonial shut the pipeline down anyway, to stop the malware spreading, and it stayed shut for six days. Fuel shortages appeared at filling stations on the fourth day, made worse by panic buying, and the company warned that it would take days more for supply to return to normal. The pipeline did not fail. The ability to bill for the fuel failed, and a company that cannot bill cannot responsibly ship. That detail should be read twice by anyone who thinks the physical layer is safe because it is physical.

The third is the Iberian blackout, a failure of power rather than data. Gas stations stopped working because pumps need electricity. Spain’s transport minister said trains could not be restarted that evening even after power returned. Traffic lights went out across both countries, and metro systems in Madrid, Barcelona and Lisbon stopped. In a power-on internet outage pumps would run, but the pump is only the last metre of a long chain: payment authorisation, tanker dispatch, terminal release and refinery scheduling all run on messages, and a station with no delivery has no fuel to pump.

The fourth is aviation in July 2024. The CrowdStrike failure caused more than 3,000 flight cancellations and delayed 23,900 more, and all six airlines in the Fortune 500 cohort took direct losses, the highest average per company at $143 million. Air traffic control networks are largely separate and kept working. What failed were airline systems for check-in, crew scheduling, aircraft weight and balance, and baggage, plus the airports’ own desks and screens. A plane can still fly without them. It cannot be legally dispatched without the paperwork they produce.

Put these together and a rough shape emerges. In a total outage ports and terminals would revert to paper. Throughput would drop, and with every line, terminal and customs service affected at the same time, nobody could borrow capacity from a neighbour. Ships at sea would keep navigating, with some reliance on GPS that has backups, but ships arriving at a port that cannot release containers would queue. RTI’s 2019 study found that a 30-day GPS outage would cost the maritime sector more than $10 billion, mainly through port delays and the supply-chain disruption that follows from them, and that estimate assumes GPS is the only layer lost.

Road freight depends on dispatch apps, telematics and routing software, with drivers who work from the screen. A haulier with phones and paper could still move goods, and many would, but without payment systems and without fuel that is not guaranteed. Logistics does not stop; it slows to the speed of paper and goodwill. Paper moves a fraction of what software moves, and the fraction is the number that decides how fast shelves empty.

The practical consequence is an ordering of priorities that governments would face in the first week. Fuel for hospitals, water works, emergency services and food distribution would take precedence over private use, and rationing by decree would require a way to communicate it. It is the least discussed element of preparedness plans: not the stock of fuel, which exists, but the means to release it to the right people on the right day, without the systems that normally do the releasing.

Water, heating and the control systems nobody sees

Most people never think about the machines that keep water clean and flowing. Pumps lift it, plant controllers dose chemicals and monitor turbidity, valves route it, and a network of sensors reports to a control room. Wastewater plants do the reverse. Industrial control systems, known as operational technology or OT, do the work, and they have historically been separated from the office network. That separation has eroded as utilities added remote monitoring to save staff trips to distant sites.

Two kinds of failure should be kept apart. A loss of connectivity means operators can no longer see or command remote sites from a central desk. A loss of control means someone or something is operating the equipment wrongly. A total internet outage would produce the first, not the second, and for water systems the first is manageable for some time. Plant controllers run locally, pumps keep pumping while they have power, and staff can drive to sites. It is slow and labour-intensive, and it fails when staffing is thin.

The second kind is the one security agencies worry about. The US advisory on Volt Typhoon said the group had obtained access to information about water treatment plants, water wells and an electrical substation, in addition to operational technology systems and network security devices. Water and wastewater were among the four sectors where the group had compromised IT environments. The agencies said they had not seen the actors use that access to disrupt services. They described the access as preparation for a crisis, and the sectors involved are the ones a total outage would hit hardest if the loss were deliberate. I come back to that in the section on hostile states.

Power is the real dependency of water. In the Iberian blackout the Portuguese water supplier EPAL warned that supplies could be disrupted, and queues formed for emergency supplies including lamps, generators and batteries. A water tower stores a day or two of pressure. Towns pumped from deep wells or with long, flat distribution networks depend more heavily on continuous electricity. Wastewater lift stations need power as well, and when they fail in a heavy rain the result is a public-health problem within days. These effects appear in blackout plans, but a plan that assumes a blackout of 16 hours is not a plan for a week.

Heating adds a seasonal dimension. This article is dated 13 November, the beginning of the heating season in Central Europe, and a total outage in January would be a different event from one in July. District heating plants, common in the region, rely on control systems and pumps. Gas networks rely on remote monitoring and dispatch. Buildings rely on thermostats and boilers with electronic controls. Many of these keep working locally if the internet fails, which is a strength of OT design. The danger is cold combined with a power cut, and the evidence from Iberia is that people who lose power improvise with equipment that kills. Three of the seven deaths linked to that blackout were carbon monoxide poisonings from emergency generators.

Even the building around you has a cloud. Elevators with remote monitoring, access-control systems, smart locks, fire-alarm panels with remote reporting and building management systems may degrade or lock into safe modes when they lose the network. In Portugal police received requests for help from people trapped in elevators. The Volt Typhoon advisory also warned that access to a facility’s IT could allow tampering with heating and cooling in server rooms. That is a reminder that data centres, the machines behind most of the scenarios here, rely on air conditioning that is itself a networked system.

The conclusion for this section is deliberately modest. Water and heating would probably survive the first days of an internet-only outage, because their control loops are local and their operators are trained to run them in degraded modes. They become the main risk when the outage is combined with a power failure, or when the loss is not accidental. The invisible machinery is more resilient than the visible apps, and the margin of resilience is the staff who can still drive to the site.

Identity lock-out when email becomes the skeleton key

The first thing most people notice in a big cloud outage is not that a site is down. It is that they cannot get into something else. During the Microsoft failure, security experts pointed out that users could not reset passwords, create new accounts or, in some cases, receive sign-in codes for multifactor authentication and single sign-on that depend on email. Troy Hunt, who runs the Have I Been Pwned breach service, said he was locked out of several services that use email for login. His comment was a reminder of how many of the digital locks in a life share one key, an inbox.

Identity is the quiet spine of the stack. A single sign-on system lets one account open dozens of services. A multifactor system proves a second factor, by text message, authenticator app, push notification or hardware key. A recovery system, nearly always email or phone, restores access when the others fail. Each of those verifies something with a remote server. Passkeys and hardware keys are stronger against phishing and keep the secret on the device, but the service that checks them is still online. The device may be in your pocket and working, and the door it unlocks is somewhere else.

The most instructive case is Maersk. When NotPetya wiped the company’s domain controllers, the servers that hold the directory of who is allowed to do what, the group lost not only its data but its ability to say who anyone was. Recovery began with identity. A single domain controller in Ghana that had been knocked offline by a local power cut just before the attack held an intact copy of the directory, and engineers flew it to the United Kingdom to rebuild from. That account comes from WIRED’s reconstruction and is not an official forensic report, but the pattern matches how recovery teams describe the order of work: restore authentication first, then everything that depends on it. Identity is the keystone; when it falls, everything built on it waits.

Consider what the Microsoft outage did to workplaces that run on cloud identity. Outlook and Teams went down, but so did the Intune console, which administrators use to manage devices, and some users reported trouble reaching cloud-based Windows desktops. Defender, Microsoft’s security tooling, was among the services affected, so companies lost both the work surface and part of the system watching for attacks. In a total outage that coupling would reach banks, hospitals and public agencies, which run on the same identity stacks as everyone else.

Fallbacks exist, and they are rarely exercised. Security practice calls for emergency “break-glass” administrator accounts that do not depend on the main identity provider, stored offline and tested. Many organisations have one on paper. Few have tested it with the identity provider itself unreachable, and an untested break-glass account is a belief rather than a control. That is a judgement from the pattern of incident reports, not a survey result.

For individuals the problem is smaller and more personal. A password manager that syncs through the cloud may be unreachable, though most keep a local encrypted copy, which works if the device is already set up. A phone that has lost its authenticator app, or whose bank app wants a fresh verification, becomes a locked brick for finance. Printed recovery codes, a paper list of critical accounts and one offline copy of key documents are the dull measures that make the difference, and they appear again in the practical section near the end.

Fraud thrives in the confusion. After the CrowdStrike failure in 2024, reports said criminals used the outage to target the company’s customers, and the pattern is old: a crisis produces urgent requests, unfamiliar procedures and workers who want to help. In a total outage, with verification channels down and normal controls suspended, social engineering would be easier than ever. Some system administrators joked during the Microsoft outage that phishing and spam dropped sharply while it lasted, a small comfort that disappears the moment the services return and the backlog of fake support messages arrives.

Last, there is the matter of proving who you are in person. A passport or national ID card works without a network, as it always has. The digital layers on top, a mobile identity app, an electronic signature, a one-time code from the bank, do not. A person with a physical document and cash can still do much in a shop, a bank branch or a municipal office, as long as the clerk has a way to accept them. In practice that last condition is the one that fails first, because staff were told to use the system and have no process for accepting a paper copy.

Governments, courts and registries without their databases

The state is a database with a flag. Land and company registers, tax and social insurance systems, vehicle and driver records, civil registries, court case files and border checks all depend on records held in systems that are increasingly in the cloud or reached over the internet. When the Microsoft outage spread in November 2026, the list of affected organisations named by BankInfoSecurity included banks, hospitals, courts and schools, and CNN reported that US city governments were waiting for services to return. Those were disruptions to productivity, and for most people they were annoyances. A total outage turns the annoyance into a stop.

The Iberian blackout offers a measure of how a state behaves when infrastructure fails. Portuguese courts stopped work, the Spanish parliament closed, and both countries convened emergency cabinet or security council meetings within hours. People in the same building and the same city could still run the response. The weak points were not command but information: governments could talk to each other and to their emergency services, but could not easily talk to the public, and in the first hours the public used battery radios to hear them.

Estonia is the clearest example of a country that planned for this. After the cyberattacks of 2007 exposed how much of the state existed as data, Estonia built the world’s first data embassy: a government-operated Tier 4 data centre in Luxembourg, with the status and protections of an embassy, holding copies of critical registers and the means to start systems from them. The Luxembourg facility backs up information on taxes, land, businesses, identity documents, pensions, legislation and the census. An Estonian government spokeswoman described its main goal as digital continuity: the capacity to start the systems when necessary and retrieve data from externally stored versions. Monaco later made a similar arrangement with Luxembourg. The idea is simple and under-copied: a state’s records should survive the loss of its territory, its networks and its capital.

Most countries have not done this at scale, and the gap matters in a scenario where the loss is of connectivity rather than data. A data embassy protects against loss of data. It does not keep the land register open when no one can reach it, and it does not pay benefits when the banks are closed. The practical question for any government is which transactions have a paper or offline fallback and which do not. Pension and benefit payments depend on bank rails. Property transfers need a registry stamp. Business registration needs a database lookup. Policing needs access to warrant and vehicle records. Border control needs checks against watch lists, which a guard can replace with a visual inspection only at the price of throughput and some security.

Governments also run separate networks for sensitive work, and that is an advantage worth stating plainly. Classified and emergency government communications generally travel on private networks, which is why officials can coordinate even when the public internet fails. The difficulty is the boundary: many civilian services that governments must keep running, such as health insurance, tax and welfare, run on the commercial cloud, and the officials who manage them often work from ordinary laptops using ordinary identity systems. The Microsoft incident, which hit email and collaboration for institutions across many countries, is an example of how thin that boundary can be.

Legal continuity is the less obvious gap. Deadlines, filing windows and limitation periods are written for a world where the system works. A court that cannot receive filings for a week has to decide whether time stopped. Contracts have force majeure clauses, and states have emergency powers, but few have rehearsed the paperwork of a general suspension of digital deadlines. Estonia’s work on digital continuity is one of the few public attempts to answer that kind of question. Elsewhere the answer would be invented under pressure, by officials who are themselves cut off from the systems that record their decisions.

The sober reading is that governments would function in a degraded way for days, because the core of the state, a few hundred people with phones, radios, cars and secure links, can keep operating. What would stop is the long tail of routine services that the public experiences as the state. A government can survive a total outage far more easily than a citizen can transact through one.

The money ledger of downtime

Every large outage produces a bill, and the bills so far are a guide to scale even though none of them measures a total outage. The CrowdStrike failure of July 2024 cost the US Fortune 500, excluding Microsoft, an estimated $5.4 billion in direct losses according to the insurer Parametrix, an average of $44 million for each company affected. Parametrix told Reuters that the global figure could reach roughly $15 billion. Airlines bore the highest cost per firm, at about $143 million. Insurance covered only a fraction: Parametrix expected cyber policies to pay between 10% and 20%, and CyberCube put insured losses between $400 million and $1.5 billion, which it called potentially the worst loss in the cyber insurance market in two decades.

Attacks cost more because they last longer. Maersk put the NotPetya damage at $250 million to $300 million. UnitedHealth lost $3.09 billion in 2024 from the Change Healthcare attack. The Cyber Monitoring Centre, a UK non-profit whose technical committee is chaired by a former head of the National Cyber Security Centre, estimated that the 2025 Jaguar Land Rover attack cost the UK economy £1.9 billion, with a plausible range from £1.6 billion to £2.1 billion, about 5,000 affected organisations and production halted for roughly five weeks. It called the incident the most financially damaging cyber event to hit the UK, and most of the loss came from lost manufacturing output at JLR and its suppliers. JLR reportedly had no cyber cover in place at the time, and a government loan guarantee of £1.5 billion followed. The Microsoft outage of November 2026 may end up costing billions in lost productivity, according to CNN, although no one has yet published an estimate.

Adding these up is tempting and misleading. They are single-company or single-sector events, and the economy around them kept working. A thousand JLRs at once would not be a thousand times worse, because the system that makes the damage tolerable, the ability of unaffected firms and customers to absorb the shock, would be gone. The relationship is not linear. In the first day the losses are mostly delayed work and idle staff. By the third day, inventories run out and orders cannot be placed. By the second week, suppliers who have no revenue cannot pay their own suppliers or their staff, and the credit that keeps trade moving begins to seize.

Estimates for continuous failures show how wide the error bars run. The 2019 RTI study for NIST put a GPS outage at $1 billion a day, which the Engineering journal calculates as 1.7% to 2.6% of daily US output. Critics argue that figure is far too low for a loss that would hit 14 of 16 critical infrastructure sectors. A GPS World commentator pointed to the February 2021 Texas power crisis, a single state and a single sector over a week, which has been estimated to have cost $195 billion and at least 57 lives. A Texas freeze is a rough comparator for a worldwide outage, not an equivalent. It does, however, show how far a week of one broken utility can exceed a tidy daily average.

That is why I do not give a single number for the cost of a total outage. Any figure would be an extrapolation from component events, with error bars wider than the number itself. The more honest unit is days of output at risk. If an outage took away a fifth of normal economic activity for a week, the loss would be about one and a half days of annual output. If it took away half for two weeks, the loss would be about a week of annual output. These are arithmetic, not forecasts, and the share of activity that actually stops is the unknown that every earlier section of this article tries to bound.

The distribution of loss matters as much as the total. Insurance caps its exposure, so firms carry the rest. Governments step in when the failure threatens an employer or an industry large enough to matter politically, as the JLR loan guarantee shows. Small suppliers, who have thin cash buffers and no insurance, go under first, and they are the part of the economy that cannot be rebuilt in a day when systems return. The CMC rates events on a one-to-five scale, comparing it to hurricane categories, and placed JLR at category three. A total outage would be off that scale. The Co-op, M&S, JLR and Change Healthcare cases should be read as the early warnings of a risk that insurers and regulators already know is systemic.

Day three to day seven, where the physical chain breaks

Everything before this section leaned on documented incidents. From here, the text is extrapolation, and the reader should treat dates as ranges. The shape comes from the clocks that run in a household and in an economy, and the best way to read a total outage is as a set of those clocks running down at different speeds.

Cash runs first. Without working terminals, a household’s usable money is the notes in a drawer, and that clock is measured in hours to days. Fuel runs next, at stations and in tanks, and the Colonial Pipeline case shows shortages emerging on the fourth day of a shutdown with panic buying added. Fresh food follows, with the Co-op showing shelves emptying within days. Water holds as long as pumps have power. Chronic medication depends on how much a patient has at home, and for most people that is days to weeks, with specific exceptions such as insulin and oxygen that carry far shorter margins. Heat depends on the season.

On day three the clocks begin to cross. A shop that still has stock has no way to take payment, and a household that still has cash has nothing to buy. A factory that has stock of parts cannot place the next order, and a supplier that could ship cannot be told where to. JLR’s production halt of about five weeks is a measure of how quickly a modern manufacturer stops when its systems stop: automotive plants run on days of parts, and the loss spread to about 5,000 organisations. In a total outage no manufacturer would be spared, and the second-order effect would reach every sector that buys from them.

By day five the weakest links give. Small shops and care homes with no spare generator or cash run out of supplies. Hospitals with paper downtime procedures reach the limit of their paper stock and the endurance of their staff. Pharmacies that cannot dispense chronic medication send patients to emergency departments, which are already overloaded. Delivery of oxygen, dialysis supplies and specialist drugs, all dependent on routing and dispatch systems, slow or stop. These are the quiet deaths, the ones that do not make headlines because each is one person, and they dominate the mortality of the period. The Synnovis attack offered a small-scale image of that pattern: a single patient death among more than 10,000 disrupted appointments.

By day seven the dominant risk is no longer technical. Chains of trust fray. A town that has not seen a delivery for a week starts to ration informally, and authority passes to whoever has stock and a way to communicate: mayors, police, local shops, churches, community groups. The Iberian blackout lasted about 16 hours and still produced improvised traffic control, volunteers directing cars and shelters for people stranded away from home. Imagine that sort of local organisation under strain for a week, with no way to know when it will end. The infrastructure fails over days. The social order is tested over weeks.

Authorities face an ordering problem. Restoring service means choosing a sequence, and the sequence is dictated by dependencies: power first, then the transport layer, then naming and routing, then identity, then the platforms, then applications. At each step the people doing the work need the thing they are restoring in order to coordinate. In 2017 Maersk spent ten days rebuilding its own estate with an intact network and a company-wide mobilisation. A national or global restart would have no such luxury. Which services come back first would be political as much as technical, and the choices would be made under the pressure of public demand and rumour. The next section looks at why even the technical sequence is harder than it sounds.

The restart problem: systems that need each other to start

Fixing a fault and ending an incident are different events. The October 2025 AWS outage shows the gap in numbers. DynamoDB’s errors ended at 2:40 AM Pacific. EC2 launch failures continued until 1:50 PM, more than eleven hours later, because the subsystem that manages server capacity had to rebuild its state while a backlog of requests pressed on it. AWS’s remedies target both halves of the event: preventing the empty DNS record in the first place, and limiting the blast radius when dependent services recover under load. The first half is a bug. The second is a property of every large system, and it is the one that decides how long a total outage would last.

The Microsoft outage of November 2026 is the live example. At the twelve-hour mark Gergely Orosz wrote that Microsoft had not worked out why servers died when brought back online. Kentik’s Doug Madory reported traffic returning to Microsoft’s services after about 18 hours. Early reporting on Microsoft’s account mentioned failed health checks and a strategy of redistributing traffic, which is what an operator does when it must bring capacity back in small steps to avoid being flattened by the returning load. The pattern is not unique to one firm: restart is a controlled, gradual, supervised process, and it is slower than the fault by design.

The core difficulty is circularity. A cloud platform’s control plane, the software that starts virtual machines, is itself a set of programs that run on machines. Identity services need DNS to be found, DNS servers need certificates and correct clocks, clocks need a time source, and the monitoring that tells you whether any of this is working often needs the same cloud. Each system is built on the assumption that the others are already running, so the first to start must start without them, using a manual procedure that someone has to know, have written down and be able to reach. A restart is not the reverse of a shutdown. It is a different procedure that most organisations have never run end to end.

Maersk is the proof. The company had lost every domain controller, and the surviving copy in Ghana was, in the words of one account, saved by luck rather than by a recovery plan. Without that blackout in an obscure office, the rebuild of the identity layer would have been far longer. The company’s chairman called the ten-day reconstruction of 4,000 servers, 45,000 PCs and 2,500 applications a heroic effort, and said it would normally take six months. Heroism and luck are not planning assumptions, and a worldwide outage would call for both at once, thousands of times over, with competing demands on the same scarce engineers.

Power adds a physical dimension that software people tend to forget. Data centres are very large electrical loads. In Ireland they accounted for 21% of national electricity consumption in 2023, according to figures from the country’s statistics office cited in an industry presentation, with a projection of about a third by 2026. Bringing a data centre back means starting cooling plants, UPS systems and thousands of servers in sequence, because a simultaneous start draws a surge that grids and backup generators are not built to meet. A grid that had just recovered from its own trouble could be hit by hundreds of facilities all demanding restart power in the same hour. Operators would have to stage the restart, which is one more reason it would take days rather than hours. That is explanation, not measurement, and operators rarely publish their restart procedures.

The returning load is a hazard of its own. When networks come back, every device, app and server tries to reconnect at once, retrying aggressively, and a service that has just come up can be knocked down by the crowd. Cloudflare’s 2025 incident showed a milder form: the network flipped between working and failing every few minutes as good and bad configuration files alternated. Mobile networks face a version of it as millions of phones re-register. Operators handle it by throttling, admitting traffic in batches and keeping some services deliberately off. That means that even when the fault is fixed, the user experience is one of partial and unstable service for a long time.

There is a human problem too. Runbooks, the written procedures for recovery, are often kept in the same wiki or ticketing system that is down. Staff are exhausted after the first 24 hours, and the engineers who understand the oldest and most critical systems are few and often close to retirement. Communication between teams, which in normal times runs on chat and video, would have to fall back on phones, paper and meetings in person. The Microsoft incident revealed a minor version of this: administrators were reading each other’s reports on public social networks because their own channels were unreliable.

Finally there is data consistency. After a long outage, replicated databases may disagree about which version of a record is right, payments may be recorded in one place and not another, and backups may be too old or on systems that cannot be reached. Some data would be lost, some would be duplicated, and a great deal would have to be reconciled by hand. The restart problem is the reason I regard the two-week horizon as the most uncertain one in this article. The first 72 hours depend on stocks and buffers. Everything after depends on whether the people and procedures needed to start the machines exist, and in too many places the honest answer is that nobody has checked.

Submarine cables, the part that cannot be rebooted

Nearly all intercontinental data crosses the seabed. Between 500 and 600 cable systems, depending on how they are counted and which source is read, carry more than 99% of international traffic across roughly 1.7 million kilometres of cable, according to the International Telecommunication Union and industry trackers. They are the physical foundation under every cloud. Satellites carry a small fraction, and the capacity gap is wide: a modern cable can carry hundreds of terabits per second.

Damage is routine. The International Cable Protection Committee counts 150 to 200 faults each year, roughly three to four a week, and about 80% have human causes, mostly ship anchors and fishing gear. Despite a 77% increase in global cable length since 2013, annual repairs have stayed around 200, according to a TeleGeography analysis summarised by the engineering firm SMEC. Repairs cost between $1 million and $3 million each and need specialised cable ships with trained crews, and they can take weeks or months. Most faults never reach the public, because traffic reroutes without anyone noticing.

Rerouting works only while somewhere else to route exists. On 6 September 2025 cables including SMW4 and IMEWE were cut near Jeddah in the Red Sea, and a telecoms company and a US official said that about 25% of the data traffic between Asia and Europe was affected. Microsoft told Azure customers to expect higher latency, then rerouted traffic and said service was restored by the evening of 7 September, although repairs would take longer. Cloudflare reported delays of up to 30% between India and Europe. An earlier cut of the AAE-1 cable in December 2024 took until 7 April 2025 to repair, about four months, according to one chronology. Rerouting buys days; ships and permits decide months.

The risk is concentration in a few narrow places. The Red Sea corridor squeezes many systems through one shallow strait where ships anchor to wait for the Suez Canal, and the Kentik analyst Doug Madory has called it a dangerous place for submarine cables. Other chokepoints exist at landing stations, in the Strait of Malacca, in the Luzon Strait and across the Baltic. SubTel Forum counted 46 incidents in 2024, the highest figure since 2013 and up from 15 the year before, according to Recorded Future, and three of them damaged multiple cables at once, with prolonged disruption in countries lacking alternative routes. The shortage of repair ships and the difficulty of obtaining permits in conflict zones lengthen the outages.

For the UK, the dependence is stated in official figures. The government has said that around 65 cables connect the country and that about £1.4 trillion in daily transactions relies on the subsea cable industry, and in October 2026 it set out new rules to protect cables from sabotage. A single cable fault is an inconvenience. A coordinated cut of many cables, which would be a deliberate act by a capable state, is a different scale of event. I have not found a public, independent estimate of how many simultaneous cuts a regional network could survive, and operators are understandably reluctant to publish the answer.

What would a multi-cable event do? Traffic between continents would fall to whatever capacity remained, and the first casualties would be the services that depend on distant servers: cloud regions on another continent, global platforms, international payments and messaging. Domestic traffic would keep working where the content is local, which is why countries with domestic data centres, internet exchange points and local content would degrade more gracefully than those that depend on foreign hosting. Europe has a good position in that respect, and small island states and countries with one or two cables have a poor one.

This is also the part that cannot be restarted from a console. Software faults are fixed by rollbacks, and power faults by operators switching on plants. A severed cable is fixed by a ship sailing to a location, recovering both ends from the seabed, splicing and relaying them, while the weather, the politics and the availability of the ship decide the schedule. In a scenario where many cables were cut within a short window, the queue for repair ships alone would stretch recovery into months. Of all the layers in the stack, this is the one where the word total fits least and the word prolonged fits best.

Space weather, the scenario without a culprit

Most scenarios in this article have an owner: a vendor, an operator, a state. Space weather has none. On 10 and 11 May 2024 a series of coronal mass ejections struck Earth in rapid succession, with faster ones catching slower ones in what scientists call a pile-up, and NOAA rated the result a G5 geomagnetic storm, its highest category and the first since 2003. The storm was the strongest in more than two decades and the best modern test of how much of the technical world it can reach.

The results were mixed in an instructive way. Utilities that had received early warnings took precautions, and widespread blackouts were avoided. GPS was less lucky. A report summarised by Risk & Insurance says that GPS errors reached 70 metres for about six hours, that roughly half of the approximately 10,000 active low-orbit satellite payloads had to manoeuvre, and that decay rates reached 180 metres per day, which made collision assessment impossible for a time. Kansas State University’s Terry Griffin estimated that GPS errors in tractor guidance cost US Midwest farmers more than $500 million during the planting window. The grid held because it was warned; the farmers lost money because nobody had warned their tractors. A NOAA forecaster said afterwards that the public should understand a blackout could occur in future storms of this magnitude or stronger.

The reference events are larger. In March 1989 a storm roughly three times weaker than the Carrington event of 1859 collapsed the Hydro-Québec grid, left about five million people without power for nine hours and damaged a transformer in New Jersey. The Carrington storm itself, the largest recorded, disrupted telegraph networks across continents. Estimates of its strength fall between 800 and 1,750 nanoteslas on the Dst index, against 412 for the 2024 storm and 589 for 1989, and radiocarbon records in tree rings point to even larger events, such as one around 993 CE. Lloyd’s of London estimated that a Carrington-class storm today would cost the United States alone between $600 billion and $2.6 trillion, with power outages lasting from 16 days to two years. Published estimates of recurrence run from 80 to 420 years, a range that shows how little is known.

Where does the internet come in? An electrical engineer writing in The Conversation warned that a Carrington-scale storm could induce currents in the long cables of the backbone and in the data centres that hold the content, and that outages could last weeks. I treat that as a plausible hazard rather than a measured one, because the exposure of specific repeaters and landing stations has not been publicly tested at that intensity. What is better established is the first-order damage: induced currents in long conductors such as power lines damage large transformers, and large transformers are custom-built machines whose replacement takes months. A grid that has lost a large number of them cannot be switched back on by a restart procedure.

That is where the logic of this article changes. In a Carrington-class event the internet is a secondary casualty. The primary casualty is electric power, over a large region and for a long time, and the 72-hour guidance that the European Commission set for household self-sufficiency becomes too short by an order of magnitude. Everything that depends on the grid, from water pumping to refrigeration to hospital oxygen plants, runs on a clock that generators and fuel stocks cannot cover for weeks. I would class it as low in probability and extreme in consequence, and as the one scenario here in which the question of food and heat dominates the question of data.

Two points keep it from being a fatalistic story. The first is warning time. A coronal mass ejection takes roughly one to three days to reach Earth after it is observed leaving the Sun, and operators can reconfigure grids, reduce loads and delay maintenance in that window, as they did in 2024. The second is that protective measures are known: blocking devices, operating procedures, spare transformers and tougher timing systems. They cost money, and the benefit is the avoidance of an event that has not yet happened in the modern grid. Space weather is the clearest case in this article where preparation is cheap relative to the loss and still underfunded.

The sun is also in an active period. Reports describe solar cycle 25 as peaking between 2024 and 2026, and a G4 storm followed in June 2025. Activity does not make a Carrington-class storm more or less likely in any given year in a way that forecasters would endorse, but it does mean the nearest decade is not a quiet one. For a reader planning around the worst case, the sensible stance is neither dread nor dismissal. It is to treat the grid, not the data, as the dependency that would decide the outcome.

Hostile states, pre-positioned access and machine-speed vulnerability discovery

Deliberate attacks have already shown what a large accident only suggests. NotPetya, released in June 2017 through a compromised update of a Ukrainian accounting package, was attributed by the US government to Russia’s military intelligence unit known as Sandworm. It was aimed at Ukraine and escaped. Maersk lost between $250 million and $300 million. One summary lists Merck at $870 million and FedEx’s TNT unit at $400 million, and puts global damage near $10 billion, a figure widely quoted for the incident. A weapon built for one country spread to shipping, pharmaceuticals and logistics worldwide within hours, and that spillover is the route by which a regional attack becomes a near-global one.

The second pattern is quieter. In 2024 the US Cybersecurity and Infrastructure Security Agency, the NSA and the FBI, with partners in Australia, New Zealand and the UK, assessed with high confidence that the Chinese state-sponsored group Volt Typhoon was pre-positioning itself on IT networks to enable lateral movement to operational technology. It had compromised organisations in communications, energy, transportation, and water and wastewater, and in some cases had held access for as long as five years. The group typically exploited vulnerabilities in internet-facing network devices to get in, then used the legitimate tools already on a machine, a technique known as living off the land, to avoid detection. The agencies said they had not seen the actors take steps to disrupt functionality. In May 2026 the US government launched a further initiative, CI Fortify, in response to the same activity.

What does a hostile state want from a total outage? Probably less than the title suggests. A global collapse would damage the attacker’s economy as much as anyone’s, and its allies’ too. The credible aims are selective: to slow an adversary’s military mobilisation, to degrade ports, rail, telecoms and power in a theatre of conflict, or to create bargaining pressure. An official quoted by CyberScoop described the early-conflict goal as disrupting the adversary’s ability to mobilise. That is a regional, targeted denial and not a planetary blackout. The risk of near-total failure comes from the combination of three things: pre-positioned access in many countries, tools that spread, and shared dependencies that carry the effect beyond the target.

This is where the newest variable enters. In April 2026 Anthropic announced Project Glasswing and said its unreleased Claude Mythos Preview model had found thousands of zero-day vulnerabilities, including some in every major operating system and web browser, among them a 27-year-old flaw in OpenBSD. By early June the company said partners had surfaced more than 10,000 high or critical vulnerabilities, and it extended access to about 150 more organisations across more than 15 countries, including operators of power, water and healthcare systems. In its own scan of over 1,000 open-source projects, it flagged 23,019 potential vulnerabilities and estimated 6,202 as high or critical, and an independent review of 1,752 findings confirmed more than 90% as valid. Anthropic is a vendor in this field, and these are its claims. Security commentators noted that, because access is limited to partners, the wider community has not verified them.

The implication is double-edged, and I will not pretend to resolve it. If models can find serious bugs faster than human teams, defenders who get access early can fix flaws before attackers find them, and Anthropic says that is the purpose of the programme. The same capability in other hands, or in successor models without access controls, shortens the time between a flaw existing and a flaw being exploited. Over the whole system, the balance depends on something unglamorous: how fast fixes reach millions of devices that nobody is watching. Volt Typhoon got in through unpatched edge devices, which is a patching failure and not a discovery failure. Faster discovery helps only if distribution of fixes keeps pace, and the history of network devices suggests it often does not.

For the total outage scenario, this matters in one specific way. A shared component, such as a library, a management tool, a firmware image or an update channel, that is found vulnerable and exploited before it can be patched could reach many systems within hours. CrowdStrike showed the delivery mechanism by accident. NotPetya showed it on purpose. What AI-accelerated discovery changes is the supply of such flaws and the speed at which someone can turn one into a working exploit. I would not put a number on that change. I would say it moves the hostile route to a near-total failure from the category of the theoretical to the category of the plausible, and it is the clearest reason this article exists in 2026 and would have read differently in 2016.

A scenario matrix ranked by plausibility and damage

The previous sections described layers. This one ranks routes. Five credible paths lead to something close to a total outage as defined at the start, and they differ more in how they would be repaired than in how they would begin.

Five routes to a near-total outage compared

The ratings are my relative judgements, not probabilities, and they rest on how often each type of event has already happened. The first route is rated high because it is happening now: Control Plane counts 18 major cloud and CDN outages in 2026, and the Microsoft incident was still being repaired on the day this article was dated. The second is rated medium because Iberia proved that a grid in a rich, well-run region can collapse in 90 seconds from a mechanism its operators had not planned for. The last is rated low because the best published estimate of recurrence for a Carrington-class storm is once every 80 to 420 years, a very wide range.

The recovery column is the most useful one. Rollbacks fix the first route in hours, because the operator controls the change. Black start, the sequence by which a collapsed grid is rebuilt from a few self-starting plants, took most of a day in Iberia with working communications. Ships and permits govern the third route, and a repair ship cannot be rushed by a motivated executive. A rebuild from clean backups governs the fourth, and Maersk’s ten days with a global workforce shows the floor, not the ceiling. Transformer manufacture governs the fifth, and a factory schedule is not something that crisis management can compress. The duration of an outage is set by its slowest repair method, not by the size of the trigger.

Rank by expected damage and the order shifts. A cloud cascade is the most likely and the least damaging. A superstorm is the least likely and the most damaging. In between, the grid collapse and the cable cut have the most room to surprise, because their worst cases have not yet been seen. My ordering of concern, weighing both columns, would be the grid collapse first, because everything else rests on it and because Iberia showed the mechanism is still not fully understood. The multi-cable cut would come second, because repair capacity is thin and the chokepoints are known. State sabotage would come third, and I place it there because of the spillover problem, not because I expect a deliberate global shutdown. The cloud cascade would come fourth in concern and first in frequency. The superstorm would come last in probability and first in the severity of what follows.

The most dangerous cases are compounds, and the history of large failures is full of them. A cloud failure that coincides with a power cut in a heating season. A cable cut in a corridor where a conflict is already raising ship traffic and reducing repair access. A state attack that uses a vulnerability found by a machine and deployed through a vendor update. No single route needs to reach the far end of its range for the combination to produce the scenario defined in the opening sections. Compounds are also harder to rate because each component is partly independent, which means the sum is less likely than any part and more damaging than all of them.

One more caution belongs here. A ranking invites the thought that the top item is the one to prepare for. The better reading of the matrix is that the five recovery paths need five different kinds of preparation: tested rollbacks and staged restarts, black-start exercises that include communications, repair-ship capacity and cable diversity, offline backups and independent identity, and space-weather warnings and spare transformers. A government or company that prepares for only the most likely route leaves four others untouched. The next sections look at the people those routes would hit hardest, and then at what works.

The people with the least margin

The ordinary citizen of a rich country is not the main victim in a total outage. The people with the least margin are. Margin means stock, cash, mobility, health and neighbours, and some groups have little of each. The evidence from past events is consistent about who they are.

Older people living alone are the first. In Spain, homebound patients who depend on oxygen machines were among those most affected by the blackout, and the German outlet heise reported at least seven indirect deaths, three from carbon monoxide poisoning caused by emergency generators. People who live alone have no one to notice that they have not called. After the Optus failure, South Australia Police carried out 154 welfare checks in about two days, for one carrier’s failure. The knowledge of who needs a check lives in databases and in the memory of local services, and databases are the part that would be offline.

People who depend on powered or connected medical devices come next: home dialysis, ventilation, oxygen concentrators, insulin pumps with connected monitoring, and refrigerated medicines. Some of these keep working locally, and some lose features without a connection. I do not have a verified list of which devices fail in which ways, and I suspect most clinics do not either. The Synnovis case is a reminder that the harm is often indirect: a patient waiting on a blood test, not a machine switching off. The deaths in a total outage would mostly be quiet ones, caused by delay.

Rural residents are third. On the island of Islay the Co-op was the only large grocery store, and when its depots ran below 20% of normal capacity the company had to bring in a temporary supply. In a total outage every rural community is an Islay. Distances to hospitals are longer, delivery chains are longer, and alternatives are fewer. The same applies to small islands, mountain villages and anywhere with one road and one shop.

Low-income households come fourth, for a plain reason. They hold the least cash and the smallest stock of food, and many spend income as it arrives. A payments freeze that a middle-class household barely notices can be a crisis for a family one pay cheque from empty, and the reconciliation delays after a restart fall hardest on those who need the money first. Gig workers whose income comes through apps lose it the minute the app stops. Hourly workers lose wages when the workplace closes.

Tourists and travellers are an underrated group. In Lisbon, terminals closed and throngs of tourists sat outside waiting for news of flights, and Barcelona set up shelters for people who could not get home. A stranger in a foreign city with a dead phone has no cash in the local currency, no map, no translation app and no one to call. At a European scale, that is millions of people on any given day.

The picture has a twist that is worth stating. Groups that are usually described as digitally excluded may cope better in the first days. A pensioner who pays in cash, keeps a paper address book and listens to the radio has a margin that a young professional who lives on a phone does not. The vulnerable group is not simply the old or the poor. It is anyone whose daily life depends on a service that cannot be bought with cash or fetched on foot, and who has nobody nearby who would notice.

For planners, the lesson is practical. Welfare-check lists should exist on paper in the hands of local services, not only in a database. Care providers need a plan for visits when scheduling software fails. Pharmacies need a procedure for dispensing chronic medication without the national system, and the public should be told what it is. None of this is expensive. All of it requires someone to decide, before the failure, that a list of names is critical infrastructure.

Panic, rumour and a public that forgot paper

The evidence on how people behave when systems fail is more reassuring than the genre suggests, and less reassuring than officials like to say. The Iberian blackout produced improvised cooperation. Civilians directed traffic at dead junctions, authorities in Barcelona opened shelters, and the owner of a Madrid ice-cream shop gave his stock away after two hours without power because it would spoil anyway. Co-op shoppers facing bare shelves told reporters they were managing and being thrifty. Nothing in those accounts looks like a breakdown of order.

The same evidence also shows where behaviour does damage. When Colonial Pipeline shut down for six days in 2021, fuel shortages appeared on the fourth day and were made worse by panic buying. Within a week, a tracker cited by The New Republic marked 71% of North Carolina’s filling stations as out of fuel. The supply interruption was real, and panic buying turned it into empty pumps in places the pipeline serves. Panic does not create the shortage; it brings it forward and makes it worse. That is why the European Commission’s guidance stresses steady, modest reserves built in calm weather and says plainly that it is not a call for panic buying.

History offers a sharper contrast. The New York blackout of July 1977 lasted a little over a day. By the time power returned, more than 1,600 businesses had been looted, over 3,700 people arrested and firefighters had fought more than 1,000 fires, according to PBS. In August 2003 a far larger blackout, covering about 50 million people across eight states and part of Canada, passed with far less disorder, although New York recorded six blackout-related deaths. Analysts attribute the difference mainly to the condition of the city, including its poorer areas, and some credit a post-9/11 civic mindedness and a well-coordinated emergency response. The duration and cause were similar. The social conditions and the visible presence of organised authority were not. Behaviour in a long outage depends less on the outage than on the society it lands on.

For a total outage that finding cuts two ways. A society with trust, organised local institutions and visible authority would probably hold for days. A society with high inequality, low trust and thin local capacity would be more exposed, and the same outage would produce worse outcomes. That is why a single prediction for Europe is unrealistic, and why the variance between regions would be large. The Iberian result applies to Iberia in April 2025. Extending it to a week, or to other places, is judgement.

Rumour is the third force. In the first hours of the Iberian blackout, Spain’s prime minister said all hypotheses remained open and asked the public to refrain from speculation. Portugal’s National Cybersecurity Centre said there was no sign of a cyberattack. Microsoft’s status page changed its wording about security during the November outage. Each of those statements was an attempt to fill a gap that rumour would otherwise fill. In a total outage the gap would be larger, official channels thinner and the number of voices claiming to know the truth higher. The old channels of rumour, word of mouth and handwritten notices, would return, and they would spread claims about causes, shortages and safe places just as quickly as they did in earlier eras.

The last element is a public that has forgotten some of the skills of the paper age. This is an observation, not a statistic. In Barcelona a shop clerk said she could not even call her boss because nothing worked. A woman waiting at a bus stop said she had been there for almost three hours trying to find a lift to the airport and could not talk to her family who had just arrived. Many adults find their way with a phone, store contacts on a phone, hold tickets on a phone, pay with a phone and open their homes or cars with a phone. A person who has lost the phone has lost a good part of memory, orientation and agency, and it is not hard to imagine the effect on decision-making in the first hours.

What reduces panic is not exhortation. It is early, plain, repeated information from a source that people can reach, a visible local authority, a way to get cash and basic goods, and household reserves that remove the urge to join a queue. The EU guidance on risk communication says authorities should give citizens timely, accessible and reliable information before, during and after a crisis. The word that matters is before. A radio frequency or a notice board that people have been told in advance to check is worth more on the first day than the best statement written on the second.

Radio, broadcast and the fallback that still reaches homes

When systems failed in Iberia, the technology that people reached for was a battery radio. Reporters described residents of Barcelona walking into stores to ask for them, and a street vendor sold radios and torches in the city the following day. The detail is small and it is a useful test of preparedness: how many households own a radio that works without the grid, and how many know which station would carry official information?

Radio and television have properties that the rest of the stack lacks. A transmitter sends one signal to unlimited receivers, so it does not suffer from the load that crushes services in a crisis. A battery or wind-up receiver needs no network, no identity and no payment. Many transmitter sites have their own generators. Broadcast is the one medium that can inform millions of people at once without any of the layers that fail in a total outage, at least for as long as the studio can feed the transmitter. That condition is where the risk hides, because a modern broadcaster’s studios, playout systems and links to transmitters often depend on IP networks and cloud services. I have found no public audit of which stations could stay on air if their cloud tools failed, and I would not assume the answer is all of them.

Receivers are a gap of their own. Many households have no radio apart from the one in a car, and many smartphones either lack FM reception or have it disabled. Digital radio and television need powered, more complex sets. A car radio with a petrol tank is a practical receiver and a practical charger for a phone, and it is worth remembering as a fallback. The EU guidance lists a battery radio among the basic items for a 72-hour kit, and the cost is a few euros.

Other alerting systems have narrower uses. Cell-broadcast messages can reach all phones in an area through the mobile network’s radio layer in countries that have implemented them, although that depends on the operator’s core and on handsets receiving broadcast messages. Sirens, where they still exist, need power and a trigger. Neither replaces a station that people know to tune to. The simplest policy is the most underused: tell the public, now, which station will carry official information in a crisis, and print it on the same leaflet as the 72-hour guidance.

There is a lesson here about how the stack is built. The oldest technology in the list, a one-way analogue broadcast, is the most resilient part of the information system, and the newest, a personalised service tied to identity and cloud, is the least. That does not mean going backwards. It means keeping an old and cheap layer alive precisely because the new layers are more capable and more fragile at the same time. The case for radio is not nostalgia; it is that its failure modes are different from everyone else’s.

Regulators writing rules after the failure

The regulatory response to the failures of 2024 to 2026 is under way, but its shape shows what is and is not being tested. On 3 November 2026 the European Commission presented four non-binding guidelines on population preparedness: 72-hour household self-sufficiency, preparedness in schools, inclusion of people with disabilities, and risk communication. The document is a Commission Communication, numbered C(2026) 8250 and dated 30 October. The Commission also proposed an annual EU Preparedness Day on 23 October from 2027, and adopted a non-binding Recommendation asking countries to stress-test the national contact points of the Civil Protection Mechanism so that they can run around the clock even when disruption hits them.

Behind those household measures sits a harder layer of law. The Critical Entities Resilience Directive has applied since 18 October 2024, replacing the older European Critical Infrastructure Directive. A Council Recommendation invites member states to update risk assessments and run stress tests based on common scenarios, beginning with energy. In July 2026 the Commission adopted a Communication with non-binding guidance on technical, security and organisational measures for critical infrastructure. A policy-intelligence scan reports that seven member states were referred to the Court of Justice in April 2026 for failing to transpose the directive, and I treat that as a secondary report pending the Commission’s own record. In March 2026 the Commission published a report on preparedness in the financial sector, which lists the rules on operational resilience, ICT resilience, business continuity and crisis management that already apply to banks and market infrastructure.

Elsewhere the pattern is similar. In the UK, the government set out new rules in October 2026 to protect subsea cables from sabotage, and in April 2025 it published plans for a Cyber Security and Resilience Bill. In Australia, the regulator has started Federal Court proceedings against Optus over the 13-hour emergency-call failure, after a Senate inquiry and an independent review. These are the right kinds of responses to the failures that caused them.

Look at what they share. Almost all address one entity, one sector or one asset class. The stress tests start with energy. The Optus case yields rules on emergency calling. The cable rules protect cables. The household guidance relies on individuals. I know of no regulation that requires a cross-sector, cross-provider test of a simultaneous loss of a hyperscale cloud region, a major identity provider and a payment network, which is the pattern of the more severe scenarios above. Rules are written for the last failure, and the next one is likely to cross the boundaries they draw. An EU Observer commentary on the 72-hour guidelines adds a further criticism: policy commitments often lack operational detail, participation by organisations of people with disabilities is frequently ad hoc, and continuity of support remains a persistent weakness. The author argues for a human continuity test.

What would a stronger set of rules contain? My proposals, offered as editorial judgement, are five. First, require operators of critical services to disclose their dependency on major cloud, identity and DNS providers to their regulator, with tests of what happens when each fails. Second, run cross-provider exercises that remove a hyperscale region and a sign-in service at once. Third, set minimum offline capability for payments and for basic food retail so that people can buy food and fuel for a defined period. Fourth, require emergency-call monitoring that works from outside the operator’s own network, which is the lesson of Optus. Fifth, treat paper lists of vulnerable people held by local services as part of critical infrastructure.

Resilience also carries a privacy cost that regulators should name. Continuity means copies, and copies of health, identity and tax records multiply the places where data can be stolen. The Change Healthcare breach, which touched about 192.7 million people, shows what a single concentrated repository can mean. Data embassies and offline backups solve one problem and sharpen another, and the answer lies in encryption, access control and a clear legal status for the copies, as Estonia’s treaty with Luxembourg tried to provide. A country that builds continuity without building privacy protections has exchanged one risk for another.

Resilience that already works, from Estonia to a shoebox of cash

Most of what makes a society resilient to a total outage is cheap, old and dull. The measures below come from the failures described above, and each is tied to a lesson that an actual incident taught. They are grouped by who has to act, because the same measure can be trivial for a household and expensive for a state.

For households, the baseline is the European Commission’s 72-hour guidance, with the caveat that it is a floor. The list is short: water, long-life food, medicines, lighting, a battery or wind-up radio, a power bank and cash in small notes and coins. The Commission also advises, where possible, a digital payment method that works offline, and identity documents in a waterproof pouch. Add paper copies of the phone numbers and addresses that matter, a paper map of the local area, printed recovery codes for the accounts that would hurt to lose, and a list of the neighbours who are old or alone. Know which radio station carries official information. Avoid the one purchase that killed people in Iberia: do not run a generator or a gas stove indoors. Three of the seven deaths linked to that blackout were carbon monoxide poisonings.

The amount of cash is a personal decision, and the Commission names no figure. A reasonable test is whether the notes in the drawer would pay for three days of food, fuel and transport if every card terminal were dead. That is enough to matter, and not so much that theft or loss becomes a worse risk than the outage. Steady, modest reserves built in calm weather also remove the temptation to join a panic queue, which the Colonial Pipeline episode shows is a hazard in itself.

For businesses, the first task is the one the Parametrix chief executive described: map the providers and assess dependence on each. The AWS outage shows why the mapping must reach the control plane. Servers in a second region are not independence if sign-in, deployment or secrets still live in the first. Specific measures follow from incidents. Keep a break-glass administrator account that does not depend on the main identity provider, store its credentials offline and test it. Keep backups that cannot be altered by whoever controls the network, because Maersk recovered from a single stray copy and no company should plan on that. Print the runbooks. Keep an out-of-band channel for the crisis team, such as phones and a radio, that does not run through the cloud. Host the status page somewhere else. Cloudflare’s own post-mortem lists validating even internally generated configuration files with size limits among its fixes, and the CrowdStrike and AWS cases argue for staged rollouts with a kill switch.

A day-without-the-cloud drill costs a morning and tells a company more than any audit. Have the tills work offline, have the warehouse pick from paper, and see how long the team can take orders by phone. Companies in food retail, pharmacy, healthcare and logistics, where the harm lands on the public, should run it first. Insurance should be read for what it does not cover: Parametrix expected only 10% to 20% of CrowdStrike losses to be insured, and JLR reportedly had no cyber cover at all.

For states, Estonia remains the model on continuity of data. The Luxembourg data embassy holds copies of critical registers and the means to start systems from them, under a legal arrangement that gives the servers an embassy’s protection. The country’s X-Road data exchange and its history of rehearsing failures are part of the same approach. Other states can copy the pattern at lower cost: offline copies of civil, land, tax and health registers, with a tested procedure to start from them, and a list of transactions that must have a paper fallback. Governments should also publish which radio station carries official information, keep fuel reserves for hospitals, water works and emergency services with a way to release them, hold welfare-check lists on paper with local services, and fix the rules for suspending digital deadlines in a prolonged outage before one occurs.

For operators of networks and grids, the priorities are specific. Emergency-call monitoring needs a measurement that works from outside the operator’s own systems, which is the Optus lesson. Black-start plans should be exercised with degraded communications, because the Iberian restart took most of a day with communications intact. Data-centre restart plans should be coordinated with grid operators, given that data centres reached 21% of Irish electricity consumption in 2023. Cable operators and governments should fund repair-ship capacity and cable diversity in the known chokepoints.

A caution applies to all of it. Preparedness has costs, and they fall unevenly. A household list that assumes a car, a cupboard and cash is hard for a person with a disability or a low income to meet, and the EU Observer commentary on the 72-hour guidance makes that point. The Commission’s guidelines on disability-inclusive preparedness exist for this reason, and they should be read as part of the same package, not as an appendix. Resilience that works only for the people who already have margin is not resilience; it is a transfer of risk to the people who do not.

Open questions and a calibrated reading of the worst case

The evidence in this article is strong on what has already failed and weak on what has never been tested. Several questions cannot be answered from public sources, and I list them because the answers would change the conclusions.

How long do backup oscillators and batteries hold timing and signalling across operators when GPS or grid power is lost? How many mobile networks run their cores on public clouds, and what happens to voice calls if those clouds fail? Are the private networks that carry interbank settlement independent of the same fibre, power and operational staff as the public internet, or only logically separate? How much stock do grocery distribution centres, hospital pharmacies and fuel terminals hold, measured in hours, and how fast can each be dispatched on paper? How many wards could run for 72 hours on downtime procedures? How many simultaneous cable cuts could a given region survive, and how long would repair ships take to reach the sites? In what order would a government restore services, and who would decide? None of these has a public answer that I could find, and most should.

There are also open questions about the present. On the day this article is dated, Microsoft had not published the root cause of its 12 and 13 November outage. If the report shows that a shared component or a change process was behind it, that would strengthen the case for the first route in the matrix. If it shows something else, the text above would need to be revised, and I would rather say so now than pretend to a certainty I do not have. The effect of AI-accelerated vulnerability discovery on the balance between attackers and defenders is also unsettled, and the available figures come largely from the companies that sell the tools.

With those limits stated, a calibrated reading of the worst case runs as follows. A literal outage of every online system at once is not credible. A multi-day, multi-layer failure of the commercial internet for most users in a region is credible and low in probability, and it has precedents in each of its parts. For the first 72 hours the order of failure would be payments, communications and workplace systems within minutes to hours, emergency calling and hospital information shortly after, then cash, fuel and fresh food over days. The severity of the second week would depend almost entirely on whether the people and procedures needed to restart the machines exist, and on whether power stayed on.

The worst cases are compounds, especially those that include the loss of electricity or the loss of intercontinental cables, because those have the slowest repairs. The most severe single event would be a Carrington-class storm, and it is also the one with the lowest probability and the cheapest preparation. The most likely event, a cloud and identity cascade, is also the least damaging, and it is the one we are rehearsing every few weeks. Frequent small failures are a better predictor of the shape of the big one than any fictional scenario, because they show the same mechanisms at a scale we can survive.

The criticism that this article set out to make is not that a total outage would be catastrophic. That is obvious. It is that the failures of 2024 to 2026 have repeated the same lessons, a small change reaching everything, a restart slower than the fault, identity and time as shared dependencies, and the public learned about each of them by living through it. Regulators have started to test single sectors. Nobody has published a test of the combination. The measures that would matter most, a radio, a drawer of cash, a printed list of vulnerable neighbours, a tested break-glass account, an off-platform status page, a dependency map and a cross-provider exercise, cost very little against a single day of the failure they address.

Questions readers ask about a worldwide internet outage

Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency

This article is an original analysis supported by the sources cited below

CrowdStrike outage costs Fortune 500 $5.4 billion, Parametrix says
Loss estimates by sector, share of affected companies and insurance coverage for the July 2024 incident.

97% of devices disrupted by CrowdStrike restored
Recovery progress about six days after the update and the insurer’s global loss estimate.

Summary of the Amazon DynamoDB service disruption in US-EAST-1
AWS’s own post-event account of the October 2025 DNS race condition and its three impact periods.

Race condition in DynamoDB DNS system: analyzing the AWS US-EAST-1 outage
Technical commentary on the AWS summary and its lessons for dependency design.

Cloudflare outage on November 18, 2025
Cloudflare’s post-mortem on the oversized bot-management file and its remediation steps.

Microsoft’s latest email outage turned into a full blown global cloud crisis
Reporting on the November 2026 Microsoft outage, its roughly 18 hours of downtime and the unpublished cause.

Microsoft cloud service outage triggers global disruption
Affected services, identity and sign-in effects and expert reactions during the Microsoft outage.

Microsoft has suffered a global outage: a tech expert explains what went wrong
Explanation of the affected services and the shifting account of the cause.

Microsoft outage exposes risks of growing reliance on tech providers
Expert comment, Downdetector reach across 74 countries and Microsoft’s description of overloaded infrastructure.

Cloud outage tracker: major AWS, Azure, Google Cloud and Cloudflare outages since 2020
Counts and durations of major cloud outages in 2026, including power and cooling events.

Submarine cables face increasing threats amid geopolitical tensions
Fault statistics, repair costs and recent multi-cable incidents.

Govt sets out new UK rules to protect subsea internet cables from sabotage
UK figures on cable dependence and the October 2026 protection rules.

Internet disruptions in Middle East and South Asia after Red Sea cable cuts
Account of the September 2025 cuts to SMW4 and IMEWE near Jeddah.

Anatomy of a blackout: findings from the Spain-Portugal grid collapse final report
Analysis of the ENTSO-E final report and the 90-second collapse.

Combination of voltage and oscillation caused Iberian blackout, says ENTSO-E report
Summary of the expert panel’s findings on overvoltage and cascading disconnections.

Major power outage in Spain and Portugal knocks out subway networks, traffic lights and ATMs
Associated Press report on the first day of the April 2025 blackout.

EU preparedness guidelines: households should be self-sufficient for 72 hours
Summary of the Commission’s November 2026 guidance, including cash and offline payment advice.

Brussels asks EU citizens to put together a 72-hour emergency kit
Coverage of the March 2025 Preparedness Union Strategy and its emergency kit.

Guidelines on population preparedness under the EU Preparedness Union Strategy
The Commission Communication C(2026) 8250 final as transmitted to the Council.

Jaguar Land Rover cyber attack financial impact, Cyber Monitoring Centre
The £1.9 billion estimate, its range and the number of organisations affected.

Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors
Classification of the attack on the Cyber Monitoring Centre’s category scale.

Ten mistakes marred firewall upgrade at Australian telco
Report findings on the Optus emergency-call failure and its links to deaths.

Optus firewall upgrade behind 13-hour Triple Zero outage
Timeline of the September 2025 failure and the company’s account.

Project Glasswing
Anthropic’s description of the programme and its claims about vulnerabilities found by Claude Mythos Preview.

Anthropic’s Project Glasswing signals potential AI-driven shift in cybersecurity
Independent commentary noting that the claims remain unverified by the wider community.

Change Healthcare data breach toll reaches 192.7 million
Scale of the 2024 attack and Change Healthcare’s share of US transactions.

Patient dies as a result of cyber attack on NHS pathology provider
Figures on postponed appointments and procedures and the confirmed patient death after the Synnovis attack.

Maersk reconstructed entire IT infrastructure in 10 days following NotPetya
The chairman’s account of rebuilding 4,000 servers and 45,000 PCs and the $250 to $300 million cost.

Economic impact of GPS outage
Summary of the 2019 NIST and RTI study on daily GPS outage costs.

Severe space weather could cost trillions and challenges traditional insurance
Lloyd’s estimates, recurrence ranges and the effects of the May 2024 Gannon storm.

May 2024 solar storm cost $500 million in damages to farmers
Study of GPS errors and agricultural losses during the Gannon storm.

Synergy: enterprise cloud infrastructure spending jumped 55% in Q3
Third-quarter 2026 cloud market size and provider shares.

Fears hackers still in the system leave Co-op shelves running empty
Depot throughput, shortages and the Islay case during the 2025 Co-op attack.

CISA and FBI warn of China-linked hackers targeting critical US infrastructure
Advisory details on Volt Typhoon’s pre-positioning in water, energy, communications and transport.

Data embassy, e-Estonia
Official description of Estonia’s data embassy in Luxembourg.

Colonial Pipeline hack explained
Timeline of the 2021 shutdown, shortages and panic buying.

The NYC blackout of 1977 explored on PBS American Experience
Looting, arrest and fire figures from the 1977 blackout, set against the calm of 2003.

Critical infrastructure resilience at EU level
European Commission overview of the CER Directive and the Council Recommendation on stress tests.

Those who can’t wait 72 hours for help left behind in EU crisis plan
Commentary on gaps in disability inclusion in the 72-hour guidance.

Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency

This article is an original analysis supported by the sources cited below

CrowdStrike outage costs Fortune 500 $5.4 billion, Parametrix says
Loss estimates by sector, share of affected companies and insurance coverage for the July 2024 incident.

97% of devices disrupted by CrowdStrike restored
Recovery progress about six days after the update and the insurer’s global loss estimate.

Summary of the Amazon DynamoDB service disruption in US-EAST-1
AWS’s own post-event account of the October 2025 DNS race condition and its three impact periods.

Race condition in DynamoDB DNS system: analyzing the AWS US-EAST-1 outage
Technical commentary on the AWS summary and its lessons for dependency design.

Cloudflare outage on November 18, 2025
Cloudflare’s post-mortem on the oversized bot-management file and its remediation steps.

Microsoft’s latest email outage turned into a full blown global cloud crisis
Reporting on the November 2026 Microsoft outage, its roughly 18 hours of downtime and the unpublished cause.

Microsoft cloud service outage triggers global disruption
Affected services, identity and sign-in effects and expert reactions during the Microsoft outage.

Microsoft has suffered a global outage: a tech expert explains what went wrong
Explanation of the affected services and the shifting account of the cause.

Microsoft outage exposes risks of growing reliance on tech providers
Expert comment, Downdetector reach across 74 countries and Microsoft’s description of overloaded infrastructure.

Cloud outage tracker: major AWS, Azure, Google Cloud and Cloudflare outages since 2020
Counts and durations of major cloud outages in 2026, including power and cooling events.

Submarine cables face increasing threats amid geopolitical tensions
Fault statistics, repair costs and recent multi-cable incidents.

Govt sets out new UK rules to protect subsea internet cables from sabotage
UK figures on cable dependence and the October 2026 protection rules.

Internet disruptions in Middle East and South Asia after Red Sea cable cuts
Account of the September 2025 cuts to SMW4 and IMEWE near Jeddah.

Anatomy of a blackout: findings from the Spain-Portugal grid collapse final report
Analysis of the ENTSO-E final report and the 90-second collapse.

Combination of voltage and oscillation caused Iberian blackout, says ENTSO-E report
Summary of the expert panel’s findings on overvoltage and cascading disconnections.

Major power outage in Spain and Portugal knocks out subway networks, traffic lights and ATMs
Associated Press report on the first day of the April 2025 blackout.

EU preparedness guidelines: households should be self-sufficient for 72 hours
Summary of the Commission’s November 2026 guidance, including cash and offline payment advice.

Brussels asks EU citizens to put together a 72-hour emergency kit
Coverage of the March 2025 Preparedness Union Strategy and its emergency kit.

Guidelines on population preparedness under the EU Preparedness Union Strategy
The Commission Communication C(2026) 8250 final as transmitted to the Council.

Jaguar Land Rover cyber attack financial impact, Cyber Monitoring Centre
The £1.9 billion estimate, its range and the number of organisations affected.

Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors
Classification of the attack on the Cyber Monitoring Centre’s category scale.

Ten mistakes marred firewall upgrade at Australian telco
Report findings on the Optus emergency-call failure and its links to deaths.

Optus firewall upgrade behind 13-hour Triple Zero outage
Timeline of the September 2025 failure and the company’s account.

Project Glasswing
Anthropic’s description of the programme and its claims about vulnerabilities found by Claude Mythos Preview.

Anthropic’s Project Glasswing signals potential AI-driven shift in cybersecurity
Independent commentary noting that the claims remain unverified by the wider community.

Change Healthcare data breach toll reaches 192.7 million
Scale of the 2024 attack and Change Healthcare’s share of US transactions.

Patient dies as a result of cyber attack on NHS pathology provider
Figures on postponed appointments and procedures and the confirmed patient death after the Synnovis attack.

Maersk reconstructed entire IT infrastructure in 10 days following NotPetya
The chairman’s account of rebuilding 4,000 servers and 45,000 PCs and the $250 to $300 million cost.

Economic impact of GPS outage
Summary of the 2019 NIST and RTI study on daily GPS outage costs.

Severe space weather could cost trillions and challenges traditional insurance
Lloyd’s estimates, recurrence ranges and the effects of the May 2024 Gannon storm.

May 2024 solar storm cost $500 million in damages to farmers
Study of GPS errors and agricultural losses during the Gannon storm.

Synergy: enterprise cloud infrastructure spending jumped 55% in Q3
Third-quarter 2026 cloud market size and provider shares.

Fears hackers still in the system leave Co-op shelves running empty
Depot throughput, shortages and the Islay case during the 2025 Co-op attack.

CISA and FBI warn of China-linked hackers targeting critical US infrastructure
Advisory details on Volt Typhoon’s pre-positioning in water, energy, communications and transport.

Data embassy, e-Estonia
Official description of Estonia’s data embassy in Luxembourg.

Colonial Pipeline hack explained
Timeline of the 2021 shutdown, shortages and panic buying.

The NYC blackout of 1977 explored on PBS American Experience
Looting, arrest and fire figures from the 1977 blackout, set against the calm of 2003.

Critical infrastructure resilience at EU level
European Commission overview of the CER Directive and the Council Recommendation on stress tests.

Those who can’t wait 72 hours for help left behind in EU crisis plan
Commentary on gaps in disability inclusion in the 72-hour guidance.

This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.