Root cause

Operator action

A manual command, script or maintenance step did more than intended.

Incidents per month

December 2025November 2026

in 12 months

major or critical

None

median duration

most affected

Incidents

MajorFeb 6, 2025, 08:14 UTC

Cloudflare: R2 object storage disabled during a phishing report remediationWhile remediating a phishing URL report, an employee disabled the R2 Gateway service instead of a single bucket.lasted 1h 22mOperatorPostmortem

CriticalApr 5, 2022, 07:38 UTC

Atlassian: Maintenance script deletes 883 customer sitesA script meant to deactivate a legacy app was given the IDs of entire cloud sites and run in permanent delete mode, deleting 883 sites belonging to 775 customers between 07:38 and 08:01 UTC.lasted 12d 16hOperatorPostmortem

CriticalFeb 28, 2017, 17:37 UTC

AWS: Mistyped command removes S3 index servers in US-EAST-1An S3 team member ran an established playbook command with one input entered incorrectly, removing far more servers than intended, including those behind the index and placement subsystems.lasted 4h 17mOperatorPostmortem

CriticalJan 31, 2017, 23:00 UTC

GitLab: Primary database data accidentally deleted, 18-hour restoreWhile fighting replication lag under spam load, an engineer accidentally removed data from the primary database server.lasted 19hOperatorPostmortem

Questions

How common are outages caused by operator action?

0 incidents in the last 12 months across the vendors tracked here were traced to operator action in the vendors' own words.

How is this cause identified?

From the sentences where the vendor explains why the incident happened, or by hand for landmark postmortems. Symptoms like "elevated error rates" are never counted as a cause.