> series: anatomy_of_a_breach —— part: 010 —— target: microsoft_danger —— users_affected: 800,000 —— data_status: almost_certainly_lost<span class="cursor-blink">_</span>_
On 10 October 2009, T-Mobile sent a message to its Sidekick smartphone customers that contained some of the most alarming words in the history of cloud computing: 'Personal information stored on your device — such as contacts, calendar entries, to-do lists or photos — that is no longer on your Sidekick almost certainly has been lost as a result of a server failure at Microsoft/Danger.'
Approximately 800,000 users were affected. The Sidekick was designed around the cloud — all user data was stored on Danger's servers (Danger being a Microsoft subsidiary acquired for $500 million in 2008), not on the device itself. When the servers failed, and the backups were also destroyed, users lost everything — contacts, calendars, photos, notes, and to-do lists. TechCrunch called it 'beyond FAIL.' At the time, it was described as the biggest disaster in cloud computing history.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe incident began on 2 October 2009 when Sidekick users started experiencing data service outages. The root cause was a Storage Area Network (SAN) upgrade performed by contractor Hitachi Data Systems on the servers running the Sidekick cloud service. Something went catastrophically wrong during the upgrade — the primary database was corrupted, and the backup database, which should have provided a safety net, was also rendered unusable.
The Sidekick data loss was not a hacking incident — it was an operational failure. No attacker exploited a vulnerability. No malware was deployed. A routine storage upgrade, performed by a contractor, destroyed both the primary database and its backup. The lesson was not about perimeter security or access control — it was about the fundamental reliability of cloud infrastructure and the catastrophic consequences when backup and recovery processes fail.
This incident was not preventable through penetration testing in the traditional sense — it was an operational failure, not a security compromise. However, the controls that would have prevented it are controls we assess as part of our broader security and resilience evaluations.
| Failure | What Should Have Existed |
|---|---|
| No independent backup verification | Backup integrity should be verified regularly through test restoration — not just by checking that backup jobs complete, but by actually restoring data and confirming it is usable. Our infrastructure assessments include backup and recovery validation as a standard component. |
| Backup on same failure domain as primary | Backups must be stored on infrastructure that is genuinely independent of the primary systems — different storage, different network, ideally different location. The Danzell Cyber Essentials update has repositioned backup guidance prominently, signalling that resilience is becoming a certification concern. Our Cyber Essentials assessments evaluate backup arrangements. |
| No pre-upgrade snapshot or rollback plan | Any maintenance operation that touches production data should be preceded by a verified snapshot and a tested rollback procedure. This is standard change management — and its absence in a $500 million Microsoft subsidiary was inexcusable. |
| No continuous monitoring of data integrity | SOC in a Box monitors system health and data integrity continuously — detecting anomalies in storage, database, and backup systems that indicate a failure in progress, not just a failure after the fact. |
The Sidekick data loss occurred in 2009, when cloud computing was still novel and public trust was fragile. Sixteen years later, cloud services are ubiquitous — Microsoft 365, Google Workspace, AWS, Azure — and the assumption that 'it is in the cloud, so it is safe' is widespread. But the fundamental lesson of the Sidekick disaster remains: cloud providers can lose your data, and when they do, it is your problem, not theirs.
Our cloud configuration review service assesses the security and resilience of your cloud estate — verifying that backup and recovery procedures exist, that they are independent of the primary systems, and that they have been tested. For organisations that need continuous assurance that their cloud infrastructure is configured correctly and their data is protected, SOC in a Box provides 24/7 monitoring of cloud environments alongside traditional infrastructure. And when data loss or breach occurs, UK Cyber Defence provides the incident response capability to investigate, recover, and restore.
Our <a href="/penetration-testing/cloud-configuration-review">cloud configuration review</a> verifies that your Microsoft 365, Azure, AWS, or Google Cloud environment is configured securely and that your backup and recovery procedures actually work. Because the lesson of the Sidekick disaster — that cloud data can be lost — has not changed, even if the technology has.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call