Deletion script given site IDs instead of app IDs removes 775 customers' sites (Atlassian, 2022)
A script meant to retire a deprecated app was given IDs for entire customer sites and did not check whether an ID referred to the app or the whole site.
What happened
- It deleted 883 sites belonging to 775 customers within about 23 minutes; restoration took up to 14 days for a subset of customers.Post-Incident Review: April 2022 Atlassian outage
The failure pattern
Watch the pattern: Destructive operation without verified recovery
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Validate the scope of every ID in destructive scriptsCheck whether an ID refers to an app or an entire site and require a dry-run and review before deleting.
- Soft-delete and rehearse large-scale restoreDelay permanent deletion and practise restoring many customers at once.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Blank provisioning parameter leads to automatic deletion of a customer's private cloud (UniSuper / Google Cloud, 2024)
An input parameter was left blank in an internal provisioning tool, so the system assigned an unknown default fixed one-year term to the customer's VMware Private Cloud.
Engineer deletes the production database directory and every backup method fails (GitLab, 2017)
While working on replication, an engineer ran a data-directory deletion on the production database server instead of the secondary, removing about 300 GB before stopping it.
iLearningEngines, Inc. discloses a cybersecurity incident (SEC 8-K, November 2024)
iLearningEngines, Inc. (the “ Company ”) recently became aware of a cybersecurity incident.
HTTP Server and Oracle Weblogic Server Proxy Plug-in issue could allow unauthorized access
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as…
Security issue reported in Enterprise
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
Database permissions change doubles a bot-management feature file and crashes edge proxies (Cloudflare, 2025)
A ClickHouse access-control change made table permissions explicit, so a query without a database filter returned duplicate rows and doubled the size of the Bot Management feature file.