Cloudflare on December 5, 2025: After the November blackout, Cloudflare is unstable again – The fragile backbone of the internet.

When the digital backbone breaks: The new reality of internet infrastructure

Not "if," but "when": Why we have to get used to permanent micro-disturbances

The events of December 5, 2025, fit seamlessly into a worrying series that has made 2025 a turning point in the history of digital infrastructure. On that Friday morning, millions of internet users worldwide experienced once again what has become a painful routine: websites displaying HTTP 500 errors, services unreachable, and even outage reporting portals like Downdetector succumbing to the onslaught of error reports. While the current Cloudflare outage may not reach the scale of the devastating November failure, it mercilessly illustrates a fundamental problem in our digitized economy: the supposedly decentralized architecture of the internet has long since given way to a highly centralized structure in which a handful of companies decide how our networked society functions.

Suitable for:

• Global Cloudflare outage – After almost a month of AWS failure – From decentralized utopia to internet oligopoly

The November 2025 earthquake and its aftershocks

On November 18, 2025, at 11:20 UTC, a chain of events began that will go down in the annals of internet infrastructure history. Cloudflare, the service that claims to protect around 20 percent of all websites worldwide and holds a market share of nearly 80 percent in content delivery networks, experienced its worst outage since 2019. The impact was devastating: X, ChatGPT, Canva, Discord, and countless other services were plunged into digital darkness for hours. The cause was neither a sophisticated cyberattack nor malicious activity, but a simple internal error in a configuration file of the bot management system.

The technical chain of events reveals the alarming fragility of modern internet architecture. A change to database permissions in the ClickHouse system caused a feature configuration file to exceed its expected size of fewer than 200 entries. This breach of a hardcoded limit triggered a crash in the central proxy system that handles traffic for Cloudflare's customers. HTTP 5xx errors cascaded down to millions of end users. Troubleshooting proved particularly insidious: because the problematic file was automatically regenerated every five minutes and the database nodes were updated incrementally, corrupted data only appeared sporadically. Systems would crash, appear to recover, and then fail again. Cloudflare engineers initially and incorrectly suspected a massive DDoS attack, wasting valuable time investigating the wrong scenarios.

The domino effect swept through the entire Cloudflare infrastructure. The core CDN returned HTTP 5xx errors, Turnstile failed to load, Workers KV reported drastically increased error rates, and access authentication failed for most users. Main traffic only returned to normal around 2:30 PM UTC, and the complete restoration of all services took until 5:06 PM UTC. For almost six hours, one of the internet's most critical infrastructure providers had been operating with limited functionality.

The economic dimension of a three-hour blackout

The economic consequences of such an outage are beyond the immediate imagination of most users, who are merely confronted with frustrating error messages. A detailed analysis of the German e-commerce landscape illustrates the scale of the problem. With approximately 663,719 German online shops, of which an estimated 80 percent secure their systems and infrastructure using Cloudflare services, this results in an affected base of over 530,000 shops. The German e-commerce sector generates annual revenue of around €47 billion. A three-hour outage results in a direct revenue loss of approximately €12.87 million in German online retail alone.

These figures may seem moderate at first glance, but they only capture the direct loss of revenue. The consequential costs increase exponentially: advertising budgets for wasted campaigns, payment backlogs due to unprocessed transactions, SLA violations with business partners, the loss of new customers who migrated to Amazon or other marketplaces during the outage and never returned, and support costs for handling complaints far exceed the pure revenue losses.

The risk analysis firm CyberCube estimated the insurable losses from the AWS outage in October 2025 alone at $450 million to $581 million. This outage crippled more than 70,000 businesses worldwide, including over 2,000 large enterprises. Gartner calculates that one minute of downtime costs an average of $5,600; for large companies, this figure rises to over $23,000 per minute. Extrapolating this to a Cloudflare outage lasting several hours, with its even greater reach, reveals the full economic impact.

From an economic perspective, the dependencies are even more dramatic. A survey by the consumer portal Verivox revealed that a complete internet blackout would cost Germany almost seven billion euros per day. More than half of the working professionals surveyed rely on the internet daily; only 13.6 percent stated that they do not need the internet or only rarely need it for their job. Commerce collapses when card payments cannot be accepted, digital production facilities grind to a halt, and online bookings cannot be processed.

The oligopoly of digital infrastructure

The concentration of cloud infrastructure in the hands of a few providers has reached proportions that even critical observers would have considered impossible a decade ago. Amazon Web Services controls 29 to 30 percent of the global cloud infrastructure market, Microsoft Azure holds 20 percent, and Google Cloud 13 percent. These three American corporations together dominate 63 percent of the global cloud market, which reached a volume of $99 billion in the second quarter of 2025. For the full year 2025, revenue is projected to exceed $400 billion for the first time.

The remaining 37 percent of the market is divided among a fragmented landscape of smaller providers, none of which holds more than four percent market share. Alibaba Cloud accounts for approximately four percent, Oracle for three percent, and Salesforce and IBM Cloud for two percent each. The largest European cloud provider, OVHcloud, generates annual revenue of around three billion euros, which is less than three percent of what AWS generates.

The concentration is even more extreme in the content delivery network (CDN) sector. Cloudflare is used by 79.9 percent of all websites that rely on CDNs. The three largest CDN providers together account for 89 percent of customers in this market. Cloudflare now operates a network with over 330 locations in more than 100 countries and processes over 46 million HTTP requests per second. These figures illustrate a simple truth: When Cloudflare sneezes, the entire internet catches a fever.

Market concentration is not an accident of history, but the logical result of inherent market dynamics. Cloud computing exhibits several structural characteristics that favor natural oligopolies. Operating global data center networks requires billions in investments in infrastructure, energy, cooling, network capacity, and technical personnel. Amazon invests over $60 billion annually in its cloud infrastructure, Microsoft over $40 billion. These investment volumes create barriers to entry that are virtually insurmountable for newcomers.

The illusion of decentralized architecture

The internet was originally conceived as a decentralized, redundant, and therefore inherently resilient network. When Paul Baran developed his groundbreaking concepts for packet-based data transmission in 1960, the underlying military-strategic consideration was to create a network without a single point of failure. The vision of ARPANET was based on the principle of distributed architecture: each node should be able to function autonomously, data packets should find their own way through the network, and the failure of individual components should not affect the overall system.

Today's reality directly contradicts this principle. If an AWS region goes down, globally distributed services collapse. If Cloudflare experiences an internal outage, millions of websites become inaccessible. Most companies are unaware of the transitive dependency of many seemingly independent services on the same underlying infrastructure providers. Numerous software-as-a-service providers host their solutions on AWS or Azure. If these platforms fail, the entire chain collapses, even if companies formally use multiple providers.

The AWS outage of October 2025 exemplified this phenomenon. Not only were Amazon's own services like Alexa and Prime Video affected, but also hundreds of seemingly independent SaaS applications: collaboration tools like Jira and Confluence, design platforms like Canva, and communication services like Signal. These hidden dependencies make true redundancy a complex challenge that goes far beyond simply using multiple providers.

Our global industry and business expertise in business development, sales and marketing - Image: Xpert.Digital

Industry focus: B2B, digitalization (from AI to XR), mechanical engineering, logistics, renewable energies and industry

More about it here:

• Xpert Business Hub

A topic hub with insights and expertise:

• Knowledge platform on the global and regional economy, innovation and industry-specific trends
• Collection of analyses, impulses and background information from our focus areas
• A place for expertise and information on current developments in business and technology
• Topic hub for companies that want to learn about markets, digitalization and industry innovations

Europe's digital sovereignty at a crossroads

The recurring outages have sparked a debate about digital sovereignty that extends far beyond purely technical considerations. The fact that three American corporations effectively control Europe's digital infrastructure raises fundamental questions about independence. Over 90 percent of Scandinavian companies rely on American cloud services, in the UK 94 percent of technology companies use the American technology stack, and even critical sectors like banking and energy are over 90 percent dependent on US providers.

The case of the International Criminal Court dramatically illustrates the geopolitical implications of this dependency. In May 2025, Microsoft blocked the email account of Chief Prosecutor Karim Khan after the US government imposed sanctions on the ICC. The institution effectively lost control of its digital communications infrastructure because it was dependent on an American provider. The ICC subsequently decided to switch entirely to open-source solutions.

The European response to this dependency manifests itself in initiatives like Gaia-X. Launched in 2019, the project aimed to create a high-performance and competitive data infrastructure for Europe. However, by spring 2025, doubts had arisen as to whether the project's goal could ever be achieved. Scaleway CEO Yann Lechelle justified his withdrawal by citing obstruction from large US IT companies, which he claimed were blocking and sabotaging any progress toward a vendor-neutral, portable model through delays. Frank Karlitschek, on the occasion of Nextcloud's withdrawal in February 2025, declared Gaia-X dead and that the original goal of establishing a European cloud alternative was no longer being discussed. The Frankfurter Allgemeine Zeitung wrote in the same month that Gaia-X was considered dead, citing excessive fragmentation, bureaucracy, and conflicting special interests.

78 percent of German companies consider their dependence on US cloud providers too great, while 82 percent would prefer European hyperscalers that can compete with AWS, Azure, and Google Cloud. At the same time, 53 percent of cloud users feel at the mercy of their providers, and 51 percent expect costs to rise. These figures reflect a fundamental dilemma: The economic advantages of cloud usage are undeniable for many companies, but the strategic risks of this dependence are becoming increasingly apparent.

Suitable for:

• AI sovereignty for companies: Is this Europe's AI advantage? How a controversial law is becoming an opportunity in global competition.

The growing cascade of failures

The year 2025 saw a worrying spate of infrastructure outages. Just four weeks before the Cloudflare disaster in November, an outage at Amazon Web Services crippled more than 70,000 businesses worldwide. Signal, Snapchat, Fortnite, Canva, and numerous other services were unavailable for hours. The cause was a DNS problem at Amazon DynamoDB in the US-EAST-1 region, one of the most critical infrastructure nodes in the American cloud landscape. Over 80 AWS services failed simultaneously, creating a cascading effect that brutally demonstrated the vulnerability of a highly interconnected system.

On July 14, 2025, a configuration change in the service topology caused an outage of Cloudflare's DNS resolver 1.1.1.1, which lasted 62 minutes. The UK Competition and Markets Authority determined in 2025 that Microsoft and AWS together controlled 60 to 80 percent of the UK cloud market and were abusing their dominant market position. The Microsoft Azure outage of October 29, 2025, caused estimated costs of up to $16 billion and crippled airlines such as Alaska Airlines and Hawaiian Airlines, as well as supermarket chains, coffee shops, and internet providers.

The frequency and severity of outages show no signs of decreasing; on the contrary, with increasing reliance on cloud infrastructure, the potential extent of the damage is rising. Studies by the Uptime Institute show that 55 percent of companies have suffered at least one major IT outage in the last three years, ten percent of which had serious or critical consequences. Society is facing an uncomfortable truth: the next major disruption is coming; the question is not if, but when.

Ways out of digital vulnerability

The recognition of this vulnerability has led to increased discussions about countermeasures. Multi-cloud strategies are increasingly being promoted as best practice. The idea behind them is simple: By distributing workloads across multiple cloud providers, companies can reduce their dependence on a single provider and minimize the risk of outages. Companies with multi-cloud approaches are significantly more resilient in the event of outages because they can switch critical applications to alternative providers.

However, the practical implementation of a multi-cloud strategy is complex and costly. Different cloud providers use proprietary APIs, different architectural concepts, and incompatible management tools. Migrating workloads between clouds often requires significant adjustments to the application architecture. Container technologies like Docker and Kubernetes theoretically offer vendor-independent abstraction layers, but cloud providers offer proprietary extensions and managed services that again limit portability.

For individual online retailers or website operators, more pragmatic approaches exist. Cloudflare allows the configuration of customized error pages where support numbers or contact options can be displayed. An emergency order hotline could have saved revenue during the November outage. Those who maintain a streamlined secondary installation of their shop without Cloudflare, reduced to the essentials and without external checkout dependencies, could have switched over in minutes.

The CDN market itself is experiencing rapid growth. The global content delivery network market is projected to grow from $27.8 billion in 2025 to over $79.2 billion by 2034, representing a compound annual growth rate (CAGR) of 12.3 percent. While this expansion could theoretically create room for more competition and diversification, the structural advantages of the established hyperscalers make genuine market fragmentation unlikely.

The paradox of networked efficiency

The fundamental tension between economic efficiency and systemic resilience permeates the entire debate surrounding cloud infrastructure. Centralized systems are more efficient, cost-effective, and offer better performance. Decentralized systems are more resilient, robust, and independent, but more expensive and complex to manage. This trade-off is fundamental and not easily resolved.

However, recent outages have shown that the pendulum has swung too far in favor of efficiency. Neglecting redundancy and resilience generates costs that are often not adequately factored into calculations. Sixty-two percent of German companies report that they would grind to a complete halt without cloud services. This dependence is not limited to individual sectors: the financial sector, healthcare, critical infrastructure such as energy and telecommunications, e-commerce, logistics, and even government agencies are fundamentally reliant on the availability of cloud services.

Cloudflare itself continues to grow rapidly. In the third quarter of 2025, the company generated revenue of $562 million, a 30 percent increase year over year. Revenue for the full year 2025 is projected to exceed $2 billion. The number of customers spending more than $1 million annually grew to 173, a 47 percent increase year over year. These figures illustrate that market concentration continues to increase despite the obvious risks.

The AWS and Cloudflare outages in the fall of 2025 should be seen as a wake-up call. Not as unfortunate operational mishaps, but as a symptomatic manifestation of a systemically fragile infrastructure that urgently needs realignment. The decentralized vision of the early internet has given way to an economic reality in which efficiency and economies of scale have displaced resilience and redundancy. The result is a fragile architecture that produces global cascading effects in the event of isolated failures. The costs of this fragility—immediate financial losses, productivity losses, reputational damage, and long-term strategic risks—add up to a considerable economic burden, the full extent of which is only slowly dawning on the public.

Independent AI platforms as a strategic alternative for European companies - Image: Xpert.Digital

Ki-Gamechanger: The most flexible AI platform-tailor-made solutions that reduce costs, improve their decisions and increase efficiency

Independent AI platform: Integrates all relevant company data sources

• Fast AI integration: tailor-made AI solutions for companies in hours or days instead of months
• Flexible infrastructure: cloud-based or hosting in your own data center (Germany, Europe, free choice of location)

• Highest data security: Use in law firms is the safe evidence
• Use across a wide variety of company data sources
• Choice of your own or various AI models (DE, EU, USA, CN)

More about it here:

• Independent AI platforms vs. hyperscalers: Which solution is right for you?

Konrad Wolfenstein

I would be happy to serve as your personal advisor.

contact me under Wolfenstein ∂ Xpert.digital

call me under +49 89 674 804 (Munich)

LinkedIn
 

Benefit from Xpert.Digital's extensive, fivefold expertise in a comprehensive service package | R&D, XR, PR & Digital Visibility Optimization - Image: Xpert.Digital

Xpert.Digital has in-depth knowledge of various industries. This allows us to develop tailor-made strategies that are tailored precisely to the requirements and challenges of your specific market segment. By continually analyzing market trends and following industry developments, we can act with foresight and offer innovative solutions. Through the combination of experience and knowledge, we generate added value and give our customers a decisive competitive advantage.

More about it here:

• Use the 5x expertise of Xpert.Digital in one package - starting at just €500/month