
Executive Summary
The AWS US-EAST-1 outage on October 20, 2025 demonstrated, once again, that the backbone of Europe’s essential digital services remains tightly, and opaquely, tethered to an Amazon data center cluster in Virginia. European banks, national agencies, and healthcare providers all went dark when a DNS issue in the United States cascaded through global authentication and service management systems, taking down hundreds of companies and affecting millions of users. The incident exposed uncomfortable truths, not just about technical resilience, but also about transparency and compliance with GDPR. Even when EU companies believe their IT operations and data are limited to European regions, hidden architectural dependencies on US-EAST-1 can bring both outages and legal risks. Most critically, end users rarely know when their data, or command functions affecting their data, transit international boundaries.
This article analyses the technical anatomy of the October 2025 AWS outage, identifies specific European companies and sectors hit hardest, and investigates the transparency and compliance failures that allowed a US incident to reverberate throughout the EU. It also explains implications under Schrems II, exposes weaknesses in AWS’s terms of service for European customers, and calls for European CIOs and regulators to demand stronger guarantees, or face a recurrence that risks both business continuity and core data protections. Continue reading “The Dark Side of IT: How US-EAST-1 Took Europe Offline and Why GDPR is in the Crosshairs”








