Exposed is not the same as affected
Every severe incident that four large infrastructure providers declared between 8 October and 1 November 2026, set against the 80 bank and payment services on our radar. No institution is named: this is a sector view.
Largest single-provider exposure36%AWS, 29 of 80 services
Provider incidents (severe)15declared by the providers
Exposed services measurably down0across all 15 incidents
Unrelated outages in the same windows7services not on the provider; coincidence
01
Exposure of the sector
Share of the 80 monitored services in the categories "Banks & payments" and "Payments & fintech" that depend on the provider at any infrastructure layer.
| Provider | Services | Share |
|---|---|---|
| Amazon Web Services (hosting, CloudFront or Route 53) | 29 | 36% |
| Cloudflare (CDN or DNS) | 20 | 25% |
| Akamai (CDN or DNS) | 17 | 21% |
| Google Cloud (hosting or DNS) | 3 | 4% |
02
Every incident
As declared on the providers' own status feeds. Exposed = on that provider; Down = DOWN episode overlapping the incident.
| Date | Provider | Official title | Minutes | Exposed | Exposed and down | Result |
|---|---|---|---|---|---|---|
| 2026-10-08 | Google Cloud | GCS elevated latencies and error rates on upload or write | 1707 | 3 | 0 | no measurable impact |
| 2026-10-10 | Vercel | Delays in Drains, Observability and Workflow (iad1) | 81 | 0 | 0 | no exposure |
| 2026-10-12 | Vercel | Increased build and deployment failures | 396 | 0 | 0 | no exposure |
| 2026-10-13 | Cloudflare | Cloudflare Service Issues | 28 | 20 | 0 | no measurable impact |
| 2026-10-15 | Cloudflare | Network performance issues in London | 13 | 20 | 0 | no measurable impact |
| 2026-10-15 | Cloudflare | Network performance issues in Eastern North America | 50 | 20 | 0 | no measurable impact |
| 2026-10-16 | Cloudflare | FedRAMP dashboard and Access | 73 | 20 | 0 | no measurable impact |
| 2026-10-20 | Cloudflare | Zero Trust connectivity | 192 | 20 | 0 | no measurable impact |
| 2026-10-20 | Google Cloud | Multiple services with issues in europe-west2 | 360 | 3 | 0 | no measurable impact |
| 2026-10-21 | Cloudflare | Elevated errors for R2 and Durable Objects in ENAM | 127 | 20 | 0 | no measurable impact |
| 2026-10-22 | Cloudflare | Network Error Log processing unavailable | 330 | 20 | 0 | no measurable impact |
| 2026-10-22 | Cloudflare | Delayed audit log delivery for WARP and Zero Trust | 398 | 20 | 0 | no measurable impact |
| 2026-10-23 | Cloudflare | Network connectivity issues affecting services in North America | 176 | 20 | 0 | no measurable impact |
| 2026-10-27 | Cloudflare | ERR_TIMED_OUT and ERR_EMPTY_RESPONSE observed by customers | 164 | 20 | 0 | no measurable impact |
| 2026-10-30 | Amazon Web Services | Increased invoke error rates (API Gateway us-west-2) | 0 | 29 | 0 | no measurable impact |
Limits: one vantage point (AWS us-east-1); front doors only, not logged-in functions; a provider incident can still slow or break features behind a working front door. "0 down" means our probe did not see an outage, not that no customer was affected.
03
What this means for your assessment
| Question | Answer |
|---|---|
| Where would one outage hit several critical functions? | The exposure table, per provider and layer: that is the concentration under DORA Art. 29. |
| Did it happen this month? | Not measurably at the front door. Record that as evidence, with dates and sources. |
| What should the file contain? | Exposure per provider, the provider incidents in the period, what was measured, and what remains unknown. |
Your own vendor list, measured the same way: free vendor scan · institution packages.