Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Shared provider failure that overlaps a power or network loss

A conditional statement under stated assumptions, never a prediction.

2 min read0 figures0 tables3 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
    1. 5.1 Assumptions
    2. 5.2 The cascade, step by step
    3. 5.3 The scenario as a table of steps
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

5.1Assumptions

Scenario SCN-SR10-DPI-01: what is assumed, and what is held constant.

Baseline
the 2026 reference state in this edition
Drivers
a configuration or DNS fault at a shared cloud or edge provider, coinciding with a regional power or network loss
Analogues
cloud event, October 2025; edge event, November 2025; software outage, 2024345
Interventions
none modelled: the specification describes the unmitigated case
Run state
narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

  1. 1

    INF → DAT

    a shared provider fault removes a regional endpoint or an edge network

    2025

  2. 2

    DAT → FIN

    payment and identity checks fail or time out at dependent services

    2025

  3. 3

    ENE → INF

    a regional power loss cuts exchanges and data centres to batteries and generators

    2026

  4. 4

    DAT → HLT

    records, claims and dispatch services degrade

    2024

  5. 5

    DAT → DEV

    services with no offline path exclude users with no fallback

    2025

  6. 6

    INF → FIN

    payments pause; losses accumulate

    2024

5.3The scenario as a table of steps

How the shock in scenario SCN-SR10-DPI-01 would travel through Digital Public Infrastructure and Systemic Cyber Risk’s coupled systems, step by step, under the assumptions the edition states.

StepWhat happensSource
01 Infrastructure to datA shared provider fault removes a regional endpoint or an edge network. Analogue or source: 2025.Edition SR-10, scenario SCN-SR10-DPI-01, step 1
02 DAT to financePayment and identity checks fail or time out at dependent services. Analogue or source: 2025.Edition SR-10, scenario SCN-SR10-DPI-01, step 2
03 Energy to infrastructureA regional power loss cuts exchanges and data centres to batteries and generators. Analogue or source: 2026.Edition SR-10, scenario SCN-SR10-DPI-01, step 3
04 DAT to healthRecords, claims and dispatch services degrade. Analogue or source: 2024.Edition SR-10, scenario SCN-SR10-DPI-01, step 4
05 DAT to developmentServices with no offline path exclude users with no fallback. Analogue or source: 2025.Edition SR-10, scenario SCN-SR10-DPI-01, step 5
06 Infrastructure to financePayments pause; losses accumulate. Analogue or source: 2024.Edition SR-10, scenario SCN-SR10-DPI-01, step 6

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Digital Public Infrastructure and Systemic Cyber Risk 2026, scenario SCN-SR10-DPI-01 (2026); Digital Public Infrastructure and Systemic Cyber Risk 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 5: Shared provider failure that overlaps a power or network loss. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices