OVHcloud has been ordered to pay €250,000 ($270,000) to two customers who lost data when its SBG2 data center in Strasbourg burnt down in 2021.
The two companies, Bati Courtage and Bluepad, both paid OVHcloud extra to backup their data - but when the data center burnt down it emerged that the backups had been kept in the same data center as the live servers, and both were lost. In the last month, the Commercial Court of Lille Métropole has ruled in the two cases that OVHcloud should pay, respectively, €100,000 and €150,000, because it had failed to deliver the backup service it had promised.
OVHcloud is appealing against both decisions, and other legal cases are pending.
Fire response
OVHcloud has four data centers at the Strasbourg business park on the River Rhine. SBG2 burnt down on the morning of 10 March 2021, and other facilities on the site including SBG1 were also damaged. The cause of the fire is believed to have been an electrical fault, which caused a fire in a battery room, which then spread uncontrollably throughout the building.
OVHcloud initially promised to publish a report quickly and fund research into fire prevention, but since the summer of 2021 has refused to discuss the cause. Initially, it said it would release its own investigation in 2022, following the release of official reports from other agencies.
The year passed without any word from OVHcloud, while official reports have been released by the Bhas-Rin fire service, and the French accident investigation agency BEA-RI (PDF).
These reports criticize OVHcloud for having no fire prevention system and no power cut-off on the site, for using wooden floors, and for a free-cooling design that created airflows that spread the fire. The reports also say that water was detected near electrical systems before the fire broke out.
More than 130 customers have joined a class-action suit, led by law firm Ziegler & Associates, that alleges OVHcloud failed its responsibility to care for its customers' data and has not given enough compensation to businesses that suffered. Although this action filed its complaint to OVHcloud during 2022, the case has not yet reached court - and may yet be settled outside court.
The cases brought by Bati Courtage and Bluepad are the first to be heard in court, as far as DCD can establish.
Bati Courtage
Commercial property firm Bati Courtage lost a lot of data in the disaster, which took down Bati Courtage's website and links to a network of customers, franchisees, and independent contractors. The company had paid for a virtual private server (VPS) and also an additional fee for the automated backup option to preserve data in the event of a disaster.
After the fire, Bati Courtage had to reconstruct the sites from older data the company had kept. Bati Courtage repeatedly asked OVHcloud to deliver its backups, but nearly a month later, on April 3, OVHcloud finally admitted that the data was lost, because "the backups were stored in the same building as the one where the main server was completely destroyed by the fire," according to Le Monde Informatique.
Bati Courtage sued OVH in the Lille Commercial Court in July 2021, claiming more than €6.5 million in damages. News site Clubic describes this as a "rather colossal sum" (all quotes translated by Google), pointing out that the company's entire turnover was only €2 million in 2018, the last year for which figures are available.
During 2022, Bati Courtage's case bounced in and out of court, in a series of eight dismissals, before finally being heard in November. The court ruled in February that Bati Courtage was entitled to compensation because it had subscribed to an automatic backup which was not delivered.
“Nowhere is the term local backup mentioned," says the court ruling. "Nowhere is it explicitly or implicitly stated that the backups will be stored in the same location or in the same data center as the main server data. On the contrary, the OVH contract relating to automatic backup stipulates that a backup of the VPS server is scheduled daily, exported, and then replicated three times before being available in the customer space, and that the storage space allocated to the 'back-up option is physically isolated from the infrastructure in which the VPS server is set up.'"
This statement leaves "no room for doubt" that OVHcloud would put the data in a different data center - but it failed to do so.
Lawyer Etienne Wery of Ulys, a law firm not directly in either case, notes that the judge's ruling was "severe." OVHcloud attempted to argue that its backup service only required it to keep "local backups" in the same room, but the judge pointed out that OVHcloud has plenty of data centers and could easily have kept the data elsewhere, but breached its contract by failing to do so: "keeping all the backup copies in the same place does not make it possible to protect the data, does not respect the state of the art of backup and does not allow the objective set by the contract to be achieved."
The court dismissed claims of negligence over fire safety, however. The fine includes €38,530 in compensation for Bati Courtage's financial loss for the year 2021, €26,472 for loss of intangible assets, €20,000 for brand damage, and €9,100 for work to restore the data and sites.
Bluepad
Software firm Bluepad ran a cloud-based SaaS service from OVHcloud's SBG2 data center which delivered project management software to tablets and smartphones. The company paid OVHcloud for a production server in the SBG1 building as well as a backup server in SBG2 for quick restoration. After the fire, OVHcloud told Bluepad that both servers were actually in SBG2, and all its data was lost.
Bluepad sued in the same Lille court as Bati Courtage, claiming €330,000 damages.
This case is different from Bati Courtage, points out Wery, because Bluepad did not subscribe to OVHcloud's automated backup. It managed its own backup, but OVHcloud was not telling the truth about the location of the servers.
The case is different, says Wery, "in the sense that the backup was not made by OVH but remained in the hands of the customer, the latter accusing OVH of having provided him with erroneous information as to the location of the servers, leading it to build on this belief a safeguard policy which proved to be ineffective."
Blupad backed its case against OVHcloud with the small print of its agreements, and screenshots, of the management console, which all specified that the main server was in SBG1 and the backup server was in SBG2.
In its defense, OVH attempted to claim that this data was a "simple internal reference" not a binding promise, reports Le Monde Informatique. The judge slapped that down, telling OVHcloud that the location of servers was contractual: OVHcloud's contract prohibited it from "modifying, without the customer's agreement, the location or geographical area provided for in the order.”
The ruling says Bluepad "never imagined that the company OVH, which presents itself as a European cloud leader, hosting specialist and which boasts ISO 27001 certification, may have misplaced a client's server or made a mistake in its location" Bluepad had no reason to doubt what OVHcloud said - and had "no means of verifying it by itself."
To make matters worse, OVHcloud added to Blupad's troubles later. On 1 April 2021, the company claimed its technical teams had succeeded in recovering the data from Bluepad's backup server. In fact, they messed it up further. The data was still there on the hard drive, but without telling the customer, OVHcloud switched the server on before returning it. At this point an automated system script ran, purging and erasing what appeared to be "old" data. Bluepad received an empty server instead of its backup data.
The €150,000 fine includes €21,600 for reconstitution of the customer database, €36,900 for loss of sales, €30,000 for additional resources Bluepad had to pay for, €6,000 for the reconstruction of internal data, €6,555 for miscellaneous costs, €2,000 for legal costs, €12,000 for loss of customers and turnover, and €30,000 for "non-pecuniary damage."
Bad news for some customers
In the Bluepad case, the Lille court declined to award damages over any claims to do with OVHcloud's level of fire precautions, implying that customers should expect to lose servers in disasters.
Wery says he is "unsatisfied" by this "surprising" ruling, which allows OVHcloud to operate an exclusion clause that says its disaster recovery service is not expected to recover from a disaster.
However, in the Bati Courtage case, the court ruled an OVHcloud exclusion clause was inadmissible, saying: “With such a clause, in the event of a claim, OVH is never required to carry out its mission when, however, it is necessary. Backup copies are of no interest in the absence of disaster and they are not used. Backup copies are only useful in the event of a disaster." So OVHcloud's attempt to escape any responsibility for a backup service it sold was ruled out ("unwritten") on the basis of article 1170 of France's Civil Code.
For customers who did not take out an automated backup service, or (as Bluepad did) operate their own one, things do not look so hopeful.
During 2022, two companies (Adomos and Cinetic-IT) sued OVHcloud for damages, having lost data and custom due to the fire - but the court dismissed these cases, as they had not deployed a backup system, or subscribed to OVHcloud's backup offering.
It is likely that the Ziegler class-action suit will include other customers in this position, who will be arguing that OVHcloud did not explain the risks sufficiently and oversold the reliability of its service, or was negligent in applying measures to prevent the eventual fire.
Wery suggests that the two cases now resolved show an increasing level of damages, and suggests that future awards may be limited by a point at which OVHcloud's insurance cover runs out, and it has to pay future settlements itself: "We imagine that the company, sound according to the information available, has the means to cover this risk. The fact remains that, as in all major claims files for which the insurer acts within the framework of a closed envelope, the first served always have an advantage over the others."
OVHcloud has not publicly stated how much it expects the fire to cost, but during the last two years it has had a successful stock market flotation, and received a €200 million loan from the European Investment Bank, to build up its international business. It is opening large numbers of new facilities in countries including the US, Australia, Singapore, and India.
The IPO documents in 2021 revealed that the company expects the fire to cost the company €105 million.
DCD has asked OVHcloud for comments - and received the following:
“We have been informed of the decision of the Tribunal de Commerce de Lille Métropole in the context of the litigation which opposes us to Bluepad. This decision has yet to be notified to us. As soon as this is the case, we intend to appeal this decision in order to defend all our positions.
"From the very first hour, OVHcloud has been mobilized to support its affected customers in order to help them in the best possible conditions. Commercial gestures were thus granted for all the services that were impacted and we keep on exchanging regularly with those of our customers who were in particularly difficult situations.
"We continue to monitor each case carefully and remain committed to assisting all of our clients in the best possible conditions.”