UniSuper, a major Australian superannuation provider, recently faced a significant data loss incident when Google’s Cloud service accidentally deleted primary data and all backups associated with UniSuper’s customer account. This incident, which occurred due to an inadvertent misconfiguration during the provisioning of UniSuper’s Private Cloud services, led to a prolonged downtime period from May 2 to May 15.
Fortunately, UniSuper was able to recover from this mishap because it had taken the precaution of backing up its data on another service. However, the incident raised concerns about the reliability and safeguards of Google’s Cloud platform.
In a joint statement published on UniSuper’s website, UniSuper CEO Peter Chun and Google Cloud CEO Thomas Kurian addressed the issue. Kurian acknowledged that this unprecedented sequence of events should not have happened and assured that measures have been taken to prevent such incidents in the future.
The restoration of UniSuper’s data was delayed due to the deletion occurring across multiple geographies. While UniSuper had duplication in two geographies as a safeguard against outages and loss, the deletion of the Private Cloud subscription caused data loss in both locations. This failure of Google Cloud’s safeguards against account deletion highlights the need for stronger protective measures.
Although Google confirmed that the incident was not a cyberattack and no unauthorized access to data occurred, questions remained regarding the exact cause of the outage. Software engineer Daniel Compton analyzed the incident and discovered that a simple bug was responsible for the problem. When UniSuper’s account was created, an incorrect value was entered, resulting in a one-year subscription for the private cloud instead of a perpetual one. Consequently, after one year passed, Google Cloud automatically deleted the private cloud.
Compton criticized Google for its vague language and lack of clear communication regarding the incident. By remaining silent, Google allowed millions of people to believe that the company had deleted an entire Google Cloud environment. Compton expressed his hope that Australia’s superannuation regulator, APRA, would investigate the incident to ensure transparency and accountability.
This incident serves as a reminder of the importance of data backup and the need for businesses to have redundancy measures in place. While relying on a single cloud service may seem convenient, this incident demonstrates the potential risks involved. It is crucial for organizations to diversify their data storage and backup strategies to mitigate the impact of such incidents.
In conclusion, UniSuper’s experience with Google Cloud’s accidental deletion of data highlights the significance of data protection and the potential vulnerabilities of relying solely on a single cloud service. Businesses must prioritize data backup and redundancy to safeguard against such mishaps. Additionally, incidents like these call for improved communication and transparency from service providers to maintain trust and ensure accountability.
