Global platform outage due to Google Cloud failure

On June 12, 2025, millions of users around the world were caught off guard by the simultaneous downtime of multiple digital services. The source of the problem was a critical outage in Google Cloud Platform (GCP) , specifically in its Identity and Access Management (IAM) system. This event generated authentication errors that spread rapidly, affecting dozens of platforms that rely on GCP to operate.

Below, we break down the key details of the incident and the compromised platforms, as well as some thoughts from a cybersecurity perspective.

What caused Google Cloud to go down?

The flaw originated in Google Cloud's Identity and Access Management (IAM) component. This infrastructure is essential for validating and managing authenticated access between users and services. A bug in this module led to a cascade of access token and credential validation failures, resulting in errors such as:

"Audiences in JWT are not allowed"

The affected systems were unable to authenticate sessions or requests, so they simply stopped responding or kicked out active users.

Digital platforms affected

The outage affected multiple services that use Google Cloud as a backend or for their critical operations. The main platforms affected included:

• Spotify

• Snapchat

• Discord

• Twitch

• Gmail

• YouTube

• Google Drive

• Google Docs and Sheets

• Google Home

• Nest (home automation services)

• Google Cloud Console

• Fitbit

• Airbnb (intermittent issues reported)

• Waze

• Uber (GCP-dependent segments)

• Slack (users with integration via GCP)

This event also affected some CDN and DNS services that handled part of the traffic, amplifying the impact.

What measures did Google take?

Google quickly acknowledged the incident, activating its incident response protocols. They confirmed that:

• They identified the root cause of the failure in the IAM module.

• Mitigation patches were applied to stabilize the environment.

• They began a gradual restoration of services around 3:00 pm ET.

• They posted constant updates through their official status panel.

Lessons for Cybersecurity

This incident leaves several important lessons:

1. Centralization has risks : Over-reliance on a single cloud provider can increase the impact of failures.

2. Distributed Resilience : Designing multi-cloud or hybrid architectures reduces the risk of total outages.

3. Monitoring and alerting : Having early warning systems in place can help mitigate the effects on customers and operations.

4. Identity Management as a Critical Point : IAM has become one of the most sensitive pieces of modern infrastructure.

5. Transparent communication : Google provided real-time updates, which helped contain chaos and preserve trust.

Conclusion

Although services have begun to be restored, this event is a stark reminder of the critical role cloud infrastructure plays in our digital lives. It also highlights the need to prepare contingency strategies that address not only external threats but also internal errors or configuration failures.

If you want to stay up-to-date on these events from a technical and critical perspective, be sure to follow my blog, where we analyze real incidents from an offensive and defensive cybersecurity perspective.