R2 object storage disabled during a phishing report remediation
Feb 6, 08:14 UTCFeb 6, 09:36 UTC
Duration
1h 22m
Impact
Major
Root cause
Operator
Cloudflare, 90 days
56 incidents
Affected
R2Durable ObjectsStreamImagesGlobal
Lesson: Abuse tooling needs the same guardrails as production changes: scope checks and a second pair of eyes before an action can disable a whole service.
What happened
While remediating a phishing URL report, an employee disabled the R2 Gateway service instead of a single bucket. Operations against R2 failed at a 100% error rate from 08:14 to 09:13 UTC, and reconnecting clients overloaded the metadata layer until 09:36 UTC.
More from Cloudflare
Full history| Started | Incident | Impact | Duration |
|---|---|---|---|
| Sep 2500:03 UTC | Issues with Durable Objects | minor | Ongoing |
| Sep 2420:40 UTC | Intermittent 500 errors for backend services on Replicate | minor | 1h 54m |
| Sep 2417:33 UTC | Delays Starting Cloudflare Workers Builds | minor | 3h 19m |
| Sep 2417:26 UTC | Browser isolation session data sync issues | minor | 5h 11m |
| Sep 2415:20 UTC | Cloudflare Access updates delayed | minor | 3h 5m |
| Sep 2410:22 UTC | Customers using BYOIP can have issues updating their BGP prefixes, including advertising or withdrawing prefixes. | minor | 3m |
Also caused by operator action
All| Started | Vendor | Incident | Impact | Duration |
|---|---|---|---|---|
| Apr 507:38 UTC |  Atlassian | Maintenance script deletes 883 customer sitesAtlassian | critical | 12d 16h |
| Feb 2817:37 UTC |  AWS | Mistyped command removes S3 index servers in US-EAST-1AWS | critical | 4h 17m |
| Jan 3123:00 UTC |  GitLab | Primary database data accidentally deleted, 18-hour restoreGitLab | critical | 19h |
Sources: vendors' own status pages, published postmortems and SEC 8-K Item 1.05 filings, read daily. Times as reported. Logos via logo.dev; trademarks belong to their owners.