UniSuper mirrored backups across two Google Cloud regions — one bug deleted both

On May 2, 2024, UniSuper's online accounts, app and phone systems went dark for its 647,000 members. The cause, disclosed in a joint statement with Google Cloud, was an 'inadvertent misconfiguration' during the provisioning of UniSuper's Private Cloud subscription — a rare private-cloud product Google runs on customer-supplier-managed infrastructure. The misconfiguration deleted UniSuper's entire cloud subscription outright, not a single system or dataset within it.

UniSuper had built its redundancy the standard way: the account was duplicated across two separate geographic regions specifically so that a failure in one would not touch the other. The deletion did not respect that boundary. Because the trigger removed the subscription itself rather than data inside it, both regions' copies were deleted together, in the same event — the fault Google's architecture was supposed to isolate.

Google's own systems had no path back. Restoring hundreds of virtual machines, databases and applications took nearly two weeks of joint manual recovery work by UniSuper and Google Cloud engineers, running from May 2 to May 15. What kept the outage from becoming permanent data loss was a decision UniSuper had made independently of Google: it also held backups with a separate cloud provider, outside Google's infrastructure entirely. Those backups minimised data loss and gave engineers a source to rebuild from once the Google-side recovery was under way.

Google Cloud CEO Thomas Kurian called it 'an isolated, one-of-a-kind occurrence' that had never happened to any Google Cloud customer before. The joint statement was blunter about fault: 'This should not have happened. Google Cloud has identified the events that led to this disruption and taken measures to ensure this does not happen again.' Member balances were confirmed up to date once services returned, but two weeks of locked-out retirement accounts, for a fund holding $135 billion in other people's savings, was the visible cost.