How Verizon caused regional outages at Cloudflare, Facebook, Amazon, and others after wrongly accepting a network misconfiguration from a small ISP in PA
'Normally you'd filter it out if some small provider said they own the internet' — Verizon sent a big chunk of the internet …
Context & Ripple Effects
Monday's outage was a route leak with a familiar defendant's name on it. Verizon has been here before: it was accused of routing millions of IP addresses for cybercriminals in 2016, and its own researchers documented how poor network hygiene exposed a water treatment plant the same year. The pattern is that Verizon's edge — where it connects to customers and smaller networks — keeps accepting routes it should reject.
What changed this time is blast radius: instead of abuse or a single customer, a misconfiguration announced by a small Pennsylvania ISP propagated through Verizon into the backbone, taking regional slices of Cloudflare, Facebook, and Amazon offline at once.
First-order effects
- Cloudflare, Facebook, Amazon, and other major platforms suffered regional reachability failures for as long as the bad route propagated — their own infrastructure was fine; the paths to it were poisoned.
- Verizon owns the immediate blame: its routers accepted a customer announcement covering address space the small ISP does not own, meaning the filtering failure sits on Verizon's side of the connection.
Second-order effects
- The affected platforms and transit operators face renewed pressure to deploy prefix filtering and origin validation on every peer and customer session, since today's incident shows upstream acceptance is the single point of failure.
- Verizon's accumulated routing record — the cybercriminal-routing accusations, the water-plant findings, now this — gives enterprise and peering counterparties leverage to demand contractual route-hygiene guarantees when negotiating with it.
Third-order effects
- If leaks like this keep propagating through tier-one accept-anything policies, the industry moves from trusting peer announcements to cryptographically validated routing (RPKI-style), changing what it means to be a trustworthy transit provider.
- A single customer's misconfiguration knocking out regional access to multiple hyperscale platforms strengthens the case for regulators and large buyers to treat routing security as critical-infrastructure compliance rather than voluntary best practice.
The trend: Internet routing is drifting from reputation-based trust between networks toward automated, verifiable route origin checks, pushed by each high-profile leak that slips through tier-one filters.