In August 2026, Nine PBS, a public television station in St. Louis, filed a lawsuit against Iron Mountain Data Centers in Denver to regain access to more than 50 terabytes of archival footage. The data spans 70 years of programming. It's irreplaceable.
The station's cloud storage provider, Open Source Storage (OSS), went defunct earlier this year. Their website went offline. No one answered the phone. The company's official records show it in delinquent status. Nine PBS had been a customer since 2019 and was in the process of renewing their contract when OSS simply vanished.
The data still exists, physically sitting on hardware in Iron Mountain's data center in Denver. But Iron Mountain won't release it without a court order, because their contract was with OSS, not with Nine PBS. So now a public television station is spending money on lawyers instead of programming, trying to recover their own data from a building they can point to on a map.
Nine PBS got lucky. The data exists on Iron Mountain's infrastructure, which suggests OSS was renting capacity rather than colocating their own hardware. If OSS had owned the equipment, they could have walked off with the drives to liquidate them. Instead, the hardware belongs to Iron Mountain, the bits are intact, and the problem is legal rather than physical.
Now imagine the scenario where the provider runs their own facility entirely. When that company folds, the hardware is an asset on a balance sheet. Assets get liquidated. Servers get wiped and sold.
This is what counterparty risk looks like in cloud infrastructure.
The Spectrum of Provider Risk
Not all cloud providers carry the same risk. There's a spectrum, and where your provider sits on it should be a first-class architectural decision.
Small and niche providers offer attractive pricing, specialized features, or simpler interfaces. But they're businesses, and businesses fail. When they do, your data becomes inaccessible: locked behind legal disputes, abandoned hardware, and defunct contracts. This isn't an edge case. It's the predictable outcome of trusting irreplaceable data to a company with no obligation to outlive your need for that data.
The hyperscalers (AWS, Azure, and Google Cloud) aren't going anywhere. They may raise prices. They may deprecate services. They may change terms in ways you don't like. But they won't vanish overnight. Amazon, Microsoft, and Google have the balance sheets, the customer base, and the operational maturity to ensure continuity. When you store data in S3, you're betting on the continued existence of Amazon. That's a pretty safe bet.
Oracle is the interesting asterisk. They're technically a hyperscaler, but their financial situation makes them a different kind of risk. Oracle has taken on roughly $130 billion in debt to build AI data centers, primarily for their OpenAI partnership. Their stock is down over 50% from its September 2025 peak. S&P Global Ratings cut their credit rating to BBB- in July, one notch above junk status, citing a widening free cash flow deficit and heavy reliance on OpenAI for revenue. And OpenAI itself has already dropped plans to expand the flagship Stargate site in Abilene, Texas because they want newer GPU generations that Oracle hadn't provisioned.
Oracle probably won't disappear. But "probably won't disappear" is a different risk profile than AWS or Azure. If you're building on OCI today, you should be asking what happens to your workloads if Oracle's cloud division gets restructured or deprioritized in a debt-driven cost-cutting exercise. That's not paranoia. It's reading the financial statements.
The False Economy of Cheap Storage
The pitch from smaller providers is usually price. And the numbers look good on a spreadsheet. $2/TB/month instead of $23/TB/month for S3 Standard. For 50TB, that's $100/month versus $1,150/month. Over a year, you're saving $12,600.
But if you're responsible enough to recognize that a small provider is a risk, you're going to back that data up somewhere else. And "somewhere else" almost certainly means a hyperscaler, because they're the ones you trust not to vanish.
So now you're paying your cheap provider and paying for backup storage. You're paying for data transfer to keep the backup current. You're building and maintaining synchronization tooling. You're managing two sets of credentials, two billing relationships, two support channels.
Your $100/month cheap provider plus $500/month in S3 Glacier Deep Archive backup plus transfer costs plus engineering time to maintain the sync pipeline might cost you more than just running on S3 from the start. And on S3, your primary copy sits on infrastructure with eleven nines of durability (99.999999999%), designed to sustain the concurrent loss of data across two facilities.
The Character of the Risk Changes at Scale
I'm not arguing that hyperscalers carry zero risk. AWS can suspend your account for non-payment, fraud flags, or compliance disputes. But they give you 30 days after suspension to reinstate, then 60 days after closure before permanent deletion. Compare that to "vendor disappeared, no one answers."
The character of the risk is different. With a small provider, the risk is existential: the company ceases to exist and your data is orphaned. With a hyperscaler, the risk is bureaucratic: you're locked out temporarily while humans resolve whatever triggered the lockout. One is a permanent loss. The other is an outage with a resolution path.
This distinction matters. Nine PBS's data still exists because they got a court preservation order in time. If Iron Mountain had reassigned that hardware before the lawsuit was filed, wiped the drives and provisioned them for a new customer, this would have become irrecoverable. The line between "access problem" and "permanent loss" was a matter of timing and legal paperwork. On a hyperscaler, that timeline is measured in months with documented processes, not days of silence before someone notices the company is gone.
Practical Takeaways
Evaluate providers on business viability, not just features. How long has the company existed? What's their revenue? Their debt load? Their customer concentration? If a single customer defaulting could threaten the provider's existence, that's your risk too.
Match the provider to the data's replaceability. For archival data that's irreplaceable (like 70 years of television programming), the provider's durability as a business matters more than their price per terabyte. For ephemeral compute workloads, the calculus is different.
Have an exit plan before you need one. Can you export your data? How long would a full export take? Do you have the tooling to restore from backup to a different provider? Test this before you're in crisis mode.
The Unsexy Truth
Your cloud provider is a counterparty. Treat the selection like you'd treat any other counterparty risk decision: evaluate their financial health, their operational maturity, and what happens to your data if they stop operating.
The hyperscalers are boring. They're expensive. They're bureaucratic. And those are exactly the qualities you want in the company holding data you can't afford to lose. Boring, expensive, and bureaucratic companies don't vanish overnight. When the provider goes dark, your data doesn't go with them, but your access does. And access is all that matters.
