← All incidents
Incident dossier · Rank #8

OVHcloud SBG2 Strasbourg Data-Center Fire (10 March 2021)

OVHcloud 2021-03-10 9h 27m core impact FirePower

In the early hours of 10 March 2021 a fire broke out in a ground-floor energy room at OVHcloud's SBG2 facility in Strasbourg, where the site's UPS units and their lead-acid battery banks were housed. Video surveillance and the fire panel traced the initiating event to a near-simultaneous electrical fault on UPS2 and its connected batteries. With no automatic suppression system in any of the five campus buildings, and a free-cooling design that used intumescent-treated raw-wood floors and single-skin cladding to aid airflow, the fire spread through the entire structure. De-energisation was slow because there was no accessible general site cut-off, forcing the grid operator to isolate an upstream substation; current was still present in the burning building well after the cut order. SBG2 was destroyed in its entirety, four of twelve rooms in adjacent SBG1 were partially destroyed, and the SBG2–SBG3 inter-building link was impacted. Roughly 30,000 servers were lost and about 3.6 million websites went offline. There were no casualties or injuries. French investigator BEA-RI could establish the fault location but not its precise cause, leaving several hypotheses open pending a court-expert examination.

Failure cascade

Failure cascade: trigger → fault → downstream impactTriggerPrimary faultDownstream impactTrigger — Fire (2021-03-10)Trigger · Fire2021-03-102021-03-10Primary fault at OVHcloud — SBG2 (Strasbourg campus)OVHcloudSBG2 (Strasbourg campus)SBG2Downstream service degraded by the fault: Bare Metal dedicated serversBare Metal dedicated serversDownstream service degraded by the fault: Public Cloud instancesPublic Cloud instancesDownstream service degraded by the fault: VPSVPSDownstream service degraded by the fault: Hosted Private CloudHosted Private Cloud+1 more downstream services

Trigger → primary fault → downstream blast radius, derived from the sourced root cause and affected-services record.

Facility & location

Operator
OVHcloud
Data center
SBG2 (Strasbourg campus)
Location
Strasbourg, France
Date
2021-03-10

Impact & scale

Users affected
~3.6 million websites taken offline; ~30,000 servers destroyed
Financial
Undetermined — total damages were still being assessed by a Strasbourg court-appointed expert panel at report time; no authoritative total was published
Scope
Catastrophic (total facility loss)
Services / systems down
  • Bare Metal dedicated servers
  • Public Cloud instances
  • VPS
  • Hosted Private Cloud
  • customer-hosted websites and databases

Impact data & metrics

SBG2 lead-acid battery bank~800 batteries, ~30 kg each
Detection-to-safe-de-energisation gapfirst alarm 00h35 -> site electrically secured ~02h30 (~1h55); full site dead only at 03h28
On-site fire-water supplysingle public hydrant, <60 m3/h; no owned reserve, no canal pumping
Fireboat EUROPA capacity3 pumps at 15,000 L/min + 2 foam/water lances at 4,500 L/min each
Foam concentrate consumed~4000 L
Personnel / casualtiesnight crew evacuated safely; 0 fatalities, 0 injuries
Building lossSBG2 (6-level) total loss; SBG1 partially damaged (4 of 12 rooms per BEA-RI); SBG3/SBG4 intact
Customer impact~3.6 million websites and 464,000 domain names ceased responding on 10 Mar
SBG2 capacitybuilt 2016, capacity ~30,000 physical servers
Estimated damage~EUR105 million
Litigation (first-instance, later cut on appeal)~EUR250k combined to two customers in 2023 (EUR100k Bati Courtage; ~EUR145k Bluepad), reduced to a few hundred euros each on appeal under contractual caps; 130+ in class action
Fire durationalarm 00h35 -> controlled ~06h45/07h00 -> extinguished ~10h02 (~9.5h)

Magnitude profile

Magnitude sub-scores (0–10)Magnitude sub-scores (0–10)Users 9Users affected (0–10) — breadth of the user/customer population impacted. — scored 9/10.Financial 8Financial impact (0–10) — direct + consequential cost. — scored 8/10.Duration 8Outage duration (0–10) — how long service was degraded/down. — scored 8/10.Blast 9Blast radius (0–10) — how wide the fault propagated across systems/regions. — scored 9/10.
Magnitude 8.6 = blast 9×0.35 + users 9×0.25 + financial 8×0.20 + duration 8×0.20 (sub-scores 0–10 · weighted composite)

Extreme user and blast-radius impact — an entire data center destroyed with ~3.6M websites offline and ~30k servers lost, plus collateral damage to SBG1 and the SBG3 link. Financial score reflects a very large but formally unquantified loss (court-expert assessment still open). Duration score spans the ~9.5h fire fight and the multi-week service-restoration tail (recovery from 17 Mar; ~99% of key products re-delivered by 23 Apr).

Sequence of events (SOE)

Phased sequence of events~23h15 (09 Mar) · TRIGGER — Ambient sensors on the rear of the SBG2 inverters log an anomalous humidity spike - later cited as supporting the liquid/humidity short-circuit hypothesis for ASI2.TRIGGER~23h15 (09 Mar)~00h30 · TRIGGER — A further marked humidity rise is recorded just after 00h30, followed by continuous temperature increase on the inverters ahead of failure.TRIGGER~00h3000h35 · DETECTION — Near-simultaneous electrical faults strike the lead-acid batteries AND inverter ASI2 in two separate ground-floor energy rooms; first fire alarm reaches the site security PC. Optical and aspirating detectors 'ont parfaitement joue leur role'.DETECTION00h3500h37 · DETECTION — Security guard reaches ground-floor energy room no.2 and finds thick black smoke; aspirating detectors sense smoke on all floors within ~15 minutes.DETECTION00h3700h39 · MITIGATION — SBG2 evacuated; the small night crew is accounted for - zero victims, zero injuries.MITIGATION00h3900h42 · DETECTION — OVH guard places the emergency call to the fire service (SIS/SDIS 67).DETECTION00h42~00h58 · MITIGATION — Order given to cut electrical supply to the whole site - but no accessible general cut-off exists to execute it quickly.MITIGATION~00h5800h59 · MITIGATION — Firefighters arrive, observe 'des arcs electriques dans le local energie', deploy a single water lance while awaiting de-energisation, and judge the building design will not permit containment.MITIGATION00h5901h13 · MITIGATION — SBG2 electrical supply cut by OVH.MITIGATION01h1301h28 · CASCADE — Water applied at the SBG2 facade; backup energies of SBG3/SBG1/SBG4 cut by OVH; SBG2 first floor is fully involved less than an hour after the first alarm.CASCADE01h2801h42 · CASCADE — Whole first floor taken; upper-floor spread now unstoppable; two lances working (ground level plus an aerial ladder).CASCADE01h42~01h49 · MITIGATION — Fireboat EUROPA requested because on-site water means are insufficient (single hydrant <60 m3/h).MITIGATION~01h49~01h50 · MITIGATION — SER cuts remotely at the upstream source substation (client HT posts inside the fire zone could not be operated) - remote cut becomes effective.MITIGATION~01h50~02h00 · IMPACT — Generalized flashover of SBG2; upper-floor temperature sensors saturate.IMPACT~02h0002h14 · IMPACT — Current is STILL present in the fully-ablaze building 2 - residual lead-acid battery supply (~20 min) and auto-started diesel generators keep it live.IMPACT02h14~02h30 · MITIGATION — Site judged electrically secured; massive water attack finally engaged - but SBG2 is fully involved and already spreading to SBG1 and SBG3.MITIGATION~02h30~02h57 · MITIGATION — Fireboat EUROPA arrives, adding 3 pumps at 15,000 L/min and 2 foam/water lances at 4,500 L/min each - described as decisive in sparing SBG1/SBG3.MITIGATION~02h57~02h30-03h00 · CASCADE — Fire spreads to SBG1 (container-type build, losing 4 of 12 rooms) and SBG3 (protected by a 2-hour firewall, though fire-stop doors were held open, degrading it).CASCADE~02h30-03h0003h28 · IMPACT — 'A partir de 03h28, il n'y a plus de courant sur le site' - the site is finally fully dead.IMPACT03h28~06h45-07h00 · RECOVERY — Fire declared 'maitrise' (under control).RECOVERY~06h45-07h00~10h02 · RECOVERY — Fire extinguished; ~4000 L of foam concentrate consumed over the intervention.RECOVERY~10h0210 Mar, morning · RESTORED — SBG2 declared a total loss; all customer data and backups stored in SBG2 lost. Netcraft measured ~3.6 million websites / 464,000 domains ceasing to respond that morning.RESTORED10 Mar, morning19 Mar 2021 · CASCADE — A second fire breaks out in a battery room of SBG1 ('un nouvel incendie a lieu dans un local a batteries du batiment SBG1'), forcing a fresh site power-down and delaying recovery.CASCADE19 Mar 20212023-2026 · RESTORED — First-instance courts awarded ~EUR100k (Bati Courtage, Lille 26 Jan 2023) and ~EUR145k (Bluepad, 9 Mar 2023) - together ~EUR250k to two customers; both were drastically cut on appeal (2025-2026) under OVH's contractual liability caps (six months' fees). 130+ customers pursue a class action.RESTORED2023-2026

Root cause

The fire ignited at approximately 00h35 on 10 March 2021 from near-simultaneous electrical faults inside TWO separate ground-floor "salles energie" (energy rooms) of the six-level SBG2 building: a fault on the LEAD-ACID backup batteries in the battery room, and a fault on an inverter/UPS designated "ASI2" (alimentation sans interruption) in the adjacent inverter room. A critical design detail per BEA-RI is that the inverter and its associated batteries were NOT in the same room ("l'onduleur et les batteries associees n'etaient pas dans la meme salle"). The battery bank was lead-acid (plomb): SBG2 held roughly 800 batteries of about 30 kg each. The report notes lead-acid chemistry is comparatively robust and internal short-circuits are rare on it, which is part of why the near-simultaneous dual departure is anomalous. The PRECISE failure mechanism was NOT established by BEA-RI, which explicitly deferred it to a pending judicial expertise ("Les causes precises des departs ... ne sont pas connues a la date du rapport"). The report lists candidate mechanisms for the ASI2 failure: (1) presence of liquid or humidity from the cooling system situated nearby, causing an internal short-circuit; (2) a malfunction linked to the maintenance intervention carried out that very morning; (3) operation of the inverter outside its normal operating ranges. Supporting the humidity hypothesis, ambient sensors on the rear of the inverters logged an anomalous humidity spike around 23h15 and a further marked rise just after 00h30, followed by continuous temperature rise and a new humidity peak at the moment of ASI2 failure. DISCLOSED EQUIPMENT UNCERTAINTY: the report does NOT name the UPS manufacturer, model or age, referring only to "l'equipementier qui a fourni les ASI." No abnormal grid event was recorded that night by Strasbourg Electricite Reseaux, ruling out an external electrical disturbance as the trigger. The LATENT root cause is design and defence-in-depth, not the ignition alone. First, OVH chose to equip NONE of the five SBG buildings with any automatic fire-suppression system ("OVH a choisi de n'equiper aucun des cinq batiments ... de systeme de protection incendie automatique") - the energy rooms had detection only. Second, the SBG2 construction - steel frame with prefabricated concrete cassettes, raw-wood floors with intumescent treatment, and single-skin aluminium-blade cladding designed for free-cooling airflow - made the building extremely permeable to air and smoke and let fire climb vertically at high speed. Third, the site had NO readily accessible general electrical cut-off, so the building could not be made safe until roughly 02h30, long after suppression water was needed. Fourth, the on-site fire-water provision was a single public hydrant delivering under 60 m3/h with no owned water reserve or pumping means from the Rhine canal. The MAINTENANCE thread is a documented contributing hypothesis, not a proven cause. ASI2 had undergone maintenance in the days before, and again the morning of the fire, "en raison de problemes recurrents de passage en mode by-pass inexpliques" (recurring, unexplained by-pass-mode trips). The maintenance and return-to-service reports "ne mentionnent aucun element singulier." Compounding this, the lead-acid batteries had NO condition monitoring ("Les batteries ne sont pas equipees de systeme de scrutation ou de supervision"), and OVH could not produce the inverters' operating parameters at the moment of failure ("OVH nous a indique ne pas en disposer"). Recurring unexplained faults on a critical inverter, a same-morning intervention, and the absence of battery/UPS telemetry together form the latent maintenance-and-monitoring gap, even though BEA-RI stopped short of formal causation.

Contributing factors

Correction of errors (COE)

Lessons learnt

Improvements & remediation

Comprehensive analysis

An ignition that was never fully explained - and did not need to be

BEA-RI is unusually candid that the precise mechanism of the near-simultaneous ASI2/battery faults was not established and was left to judicial expertise. The forensic weight therefore falls not on the spark but on why a spark in one ground-floor energy room became a total loss of a six-storey building and spread to two neighbours. The report's own hypotheses (cooling-system humidity, the same-morning maintenance, out-of-range inverter operation) are presented as candidates, not conclusions, and the equipment maker/model is deliberately unnamed. Any narrative that asserts a definitive electrical cause overstates the evidence.

The suppression void is the decisive finding

The single most consequential fact is that none of the five SBG buildings had any automatic fire suppression - a design choice, not an oversight. Detection performed flawlessly and saved every life, but detection without suppression only enables evacuation. With no sprinkler, mist or gas system, the only defence was hand extinguishers and the public water network, which was itself grossly undersized. This is the lever that would most plausibly have changed the outcome.

De-energisation as the true bottleneck

Even once firefighters were on scene, they could not commit water at scale because the building stayed live. No accessible general cut-off, client HT posts trapped inside the fire zone, generators auto-restarting on continuity logic, and ~20 minutes of residual lead-acid supply combined to keep current flowing until ~03h28. Flashover (~02h00) beat the safe-to-attack moment (~02h30). The electrical architecture, not firefighter effort, dictated the timeline.

Building physics engineered for cooling, not containment

Free-cooling drove the envelope design - high air permeability, ventilated single-skin cladding, raw-wood (intumescent-treated) floors - which is efficient thermally but carried smoke to every floor within ~15 minutes and gave fire a vertical chimney. Passive protection that should have compartmentalised (2-hour battery-room rating, fire-stop doors) was degraded in practice, with doors held open during evacuation. The same feature that made the DC efficient made it burn.

Blast radius and the limits of legal recourse

Netcraft measured ~3.6 million websites and 464,000 domains dropping offline; customers who relied solely on SBG2, including in-facility backups, lost data outright. Yet the litigation arc is a cautionary tale: first-instance awards of ~EUR100k and ~EUR145k to two customers in 2023 were largely gutted on appeal (2025-2026) under OVH's contractual liability caps, leaving token sums. The practical lesson for customers was self-provisioned geo-redundancy, because neither the facility nor the contract would make them whole.

Technical deep-dive

The forensic core is a defence-in-depth failure layered on an unestablished electrical ignition. DETECTION was present and effective but suppression-blind: the energy rooms carried automatic optical point smoke detectors PLUS aspirating (VESDA-type) smoke detection PLUS manual call points, and BEA-RI credits them ("Ces derniers ont parfaitement joue leur role de detection"). The first alarm reached the site security PC at 00h35; the guard reached ground-floor energy room no.2 at 00h37 and found thick black smoke; the building was evacuated by 00h39. The aspirating detectors sensed smoke on ALL floors within ~15 minutes, evidence of "une grande permeabilite du batiment a l'air exterieur et donc aux fumees." Detection is credited ONLY with enabling safe evacuation, never suppression. SUPPRESSION was ABSENT - the central finding. No gas inerting, no water mist, no sprinkler existed in any SBG building. BEA-RI stresses an automatic system would have applied water very early "sans meme attendre l'arret de la fourniture d'electricite, et sans exposer de personnel a un risque d'electrocution." With none present, the only site defence was trained staff with hand extinguishers plus the public network - one supply line, one hydrant under 60 m3/h. The DE-ENERGISATION delay is the mechanism that turned a contained ignition into a total-loss conflagration. The cut order was given ~00h58, but four factors prevented a safe electrical death of the building until ~02h30: (1) no easily accessible general site cut-off, so isolation required tripping the upstream source substation; (2) client-owned HT posts sat inside the firefighters' intervention zone and could not be operated - SER cut remotely at the source substation, effective ~01h50; (3) diesel generators, slaved to supply continuity, auto-started despite the fire and had to be neutralized manually; (4) charged lead-acid batteries were the last live source, giving ~20 minutes of residual supply. Result: at 02h14 there was STILL current in the fully-ablaze building 2, and only "a partir de 03h28, il n'y a plus de courant sur le site." Firefighters observed "des arcs electriques dans le local energie" and could not engage massive water until the electrical risk cleared (~02h30) - by which point SBG2 had reached generalized flashover (~02h00) and was spreading to SBG1 and SBG3. The fireboat EUROPA (providing 3 pumps at 15,000 L/min and 2 foam/water lances at 4,500 L/min each), requested at ~01h49 and on-scene at ~02h57, was described as decisive in sparing SBG1/SBG3 from worse loss; ~4000 L of foam concentrate were consumed. SBG3's 2-hour firewall held better, but firefighters reported fire-stop doors held open during evacuation, degrading it; the battery charge rooms that should have met 2-hour fire resistance under the 29/05/2000 arrete (rubric 2925) did not. NOTE: the granular BEA-RI-attributed times, flows and equipment figures in this section could not be independently re-verified this pass because the BEA-RI report host was unreachable; they rest on the report's attribution and are internally consistent, but are not corroborated by a second accessed source.

References & provenance

Sourced from public post-incident reports. Quotes are short attributed excerpts for provenance only; the analysis above is original and substantially shorter than its sources. Last verified 2026-07-31.

Root access required

The DC Incidents dossier is a root-only module. Sign in with an authorized account to continue.

Back to Home