Blank provisioning parameter leads to automatic deletion of a customer's private cloud (UniSuper / Google Cloud, 2024)
An input parameter was left blank in an internal provisioning tool, so the system assigned an unknown default fixed one-year term to the customer's VMware Private Cloud.
What happened
- When that term ended the Private Cloud was deleted; no customer notification was sent because the deletion was not triggered by a customer request.Sharing details on a recent incident impacting one of our customers
The failure pattern
Watch the pattern: Destructive operation without verified recovery
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Never let a blank input silently choose a default lifetimeRequire explicit values for expiry and deletion parameters, and reject missing ones.
- Soft-delete with grace periods and independent backupsDelay irreversible deletion, notify the customer, and keep backups in an independent location.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Deletion script given site IDs instead of app IDs removes 775 customers' sites (Atlassian, 2022)
A script meant to retire a deprecated app was given IDs for entire customer sites and did not check whether an ID referred to the app or the whole site.
Engineer deletes the production database directory and every backup method fails (GitLab, 2017)
While working on replication, an engineer ran a data-directory deletion on the production database server instead of the secondary, removing about 300 GB before stopping it.
iLearningEngines, Inc. discloses a cybersecurity incident (SEC 8-K, November 2024)
iLearningEngines, Inc. (the “ Company ”) recently became aware of a cybersecurity incident.
HTTP Server and Oracle Weblogic Server Proxy Plug-in issue could allow unauthorized access
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as…
Security issue reported in Enterprise
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
Database permissions change doubles a bot-management feature file and crashes edge proxies (Cloudflare, 2025)
A ClickHouse access-control change made table permissions explicit, so a query without a database filter returned duplicate rows and doubled the size of the Bot Management feature file.