On Tuesday morning, Revolut customers found card payments failing, transfers stalling and support chat unavailable. Reports linked the disruption to a power event at a Google Cloud data centre in London. The company said customer money and data were safe, and for anyone waiting at a till that reassurance changed little.

Security professionals separate confidentiality from availability, and this outage fell on the second. Revolut has faced questions on the first as well. Last month it disclosed that customer information had been shared with someone impersonating a government agency, and in 2022 attackers obtained the details of more than 50,000 customers. For a firm serving 80 million people, the episode shows how one cloud dependency and the susceptibility of staff to deception can reach a very large customer base.

Patient data in the NHS is held to a demanding standard, which reflects its sensitivity. Diagnoses, prescriptions, mental health notes and children's records all sit within the system. The service has built national cyber capability, including a security operations centre that monitors threats across organisations, and trusts complete an annual assurance process. As digital services expand through the NHS App, the Federated Data Platform and the ambition for a single patient record, more data will sit with commercial cloud and software suppliers. That is a reasonable route to better care, and it makes supplier resilience the natural next area of focus.

The 2024 ransomware attack on Synnovis, a pathology provider serving several London hospitals, shows why. Thousands of appointments and procedures were postponed and blood testing was restricted. Clinical and operational staff responded with considerable skill, prioritising urgent patients and keeping services running under strain. The experience left the NHS with practical knowledge of supplier failure that few other sectors possess.

Availability matters more in health than in banking. A customer locked out of an app can wait, whereas a clinician in an emergency department who needs a medication history or a pathology result cannot. Downtime procedures exist across trusts, and regular rehearsal keeps them effective as clinical work becomes more dependent on screens.

Financial regulators have begun to address concentration risk. The UK now has a regime for overseeing critical third parties to the financial sector, recognising that individual firms cannot manage dependence on a handful of cloud providers by themselves. Health has no direct equivalent. Cyber resilience legislation is before Parliament, and how it will apply to cloud and software suppliers to the NHS is still to be settled. That gives policymakers a chance to shape the framework deliberately rather than in response to an incident.

The timing adds weight. Public support for data sharing in health rests on confidence that records are protected, and programmes involving large technology firms attract close attention. With the functions of NHS England moving into the Department of Health and Social Care, clear ownership of digital resilience will help the reform programme carry public trust.

The practical steps are modest. Trust boards can ask suppliers where their services are hosted, whether failover sits in a separate region and when recovery was last tested against a realistic scenario. Policymakers can consider whether suppliers critical to health merit the scrutiny already applied to those serving finance, and health-tech companies selling into the NHS can expect these questions in tenders and prepare evidence in advance.

Revolut was able to tell its customers that their money was safe. The NHS, with its record of resilience under pressure, is well placed to give patients the same assurance about their records, and to add that those records will be available at three in the morning, when an emergency department needs them.

‍