Fall of Movistar and O2 on the 1st of October: what happened and what it teaches us about resilience operational

October 1, 2026, a fault in telecommunications infrastructure Spanish left without service to thousands of users and companies for about two hours. Movistar, O2 and Digi —who use Telephone infrastructure— experienced simultaneously interruptions in coverage, mobile data access, and fiber-optic internet. For professional digital production, render farms and equipment of remote work, the incident illustrated a truth operational critical: when the network fails, the whole chain of production stops. This case is especially relevant to IT leaders in all of Latin america that depend on distributed infrastructure.

What happened with Movistar and O2 on the 1st of October?

In the early hours of the morning of October 1, 2026, a fault in the network infrastructure is shared by major telecom operators spaniards caused thousands of reports on platforms such monitoring as Downdetector. The peak of reports occurred around 10:00 AM, when the number of users affected has reached its maximum.

The fall affected simultaneously Movistar (main national operator), O2 (brand secondary Movistar) and Digi (which uses the infrastructure of the Phone). The incident was so widespread that affected virtually all service segments: mobile, data, and connections for residential and business of optical fiber.

What specific services were affected?

The scale of the incident was exceptional due to its multidimensionality. Users experienced:

• Complete loss of mobile coverage: Inability to make or receive calls on mobile devices.
• Loss of mobile data access: data Traffic is limited or completely interrupted in cellular networks.
• Faults in fiber optic connections to residential and businessUsers with fixed connection without access to the internet.
• Lack of access to cloud services: platforms and Applications that were dependent on connectivity.

For the sector of digital production, the consequences were particularly severe.

What was the impact in the digital production distributed?

While the official statement is focused on end users, the true economic cost is expressed in the creative industry and digital production. Professional 3D animation and multimedia that depend on distributed infrastructures faced:

• Interruptions in sync cloud: 3D Projects stored in the cloud were inaccessible, paralyzing the work in real time.
• Render farms offline: Servers distributed processing were not able to receive tasks and submit results.
• Remote collaboration interrupted: Teams of distributed work have lost access to pipelines shared, assets shared communication and synchronized.
• Loss of productivity direct: Each hour of downfall represents man-hours of non-productive projects with deadlines that were set.

The impact was not just operational; it was economic. Studies on downtime in 2024-2026 indicate that large companies lose between $14,056 and $23,750 per minute. For a study of 3D production with distributed teams, two hours of a fall can mean tens of thousands of euros in lost productivity, in addition to the risk of failing to meet delivery times.

What was the cause of the incident?

The operators involved have not been detailed publicly the technical cause of the fault. So far, the communications officers confirmed they were faced with problems of infrastructure but did not specify:

• If it was a failure in hardware (switching center, routers, fiber optics)
• If it was a bug in a deployment or configuration change
• If it was a problem of scalability on demand
• If was a cyber attack or security incident

This lack of transparency is common in incidents of telecommunications, where to reveal technical details could allow malicious actors to replicate the fault.

How much did the incident?

The incident began early in the morning and there were reports of mass around 10:00 AM. The recovery was gradual during the afternoon, with service standard ‘past midday’ according to reports from professionals in the sector.

Approximate duration: 2 hours since the first report of mass to the substantial recovery of the service.

For telecommunications services, two hours is a critical incident. Affects work cycles are complete, interrupted processes in real time, and may be adverse legal consequences if service level agreements were violated. In fact, with this duration, many organizations could analyze the impact of using a calculator SLA to understand exactly how much downtime is acceptable according to their commitments to customers.

What impact it had on users and operations?

Although there is no official count of affected users, whereas Movistar and O2 together serve millions of Spanish users, it is safe to assume that the incident affected:

• Tens of millions of citizens with mobile services
• Hundreds of thousands of businesses with critical connectivity
• Especially vulnerable segments: hospitals, emergency services, e-commerce, financial services, digital production

For professional 3D and production, the impact was even more serious: a render farm interrupted for 2 hours means 2 hours of computer loss, time limits involved, and customers notified of any delays.

What can we learn from this incident?

The incident Movistar/O2 teaches several critical lessons about resilience operational:

1. The network is a critical component, not infrastructure fund

Many teams YOU assume that the network connectivity is always available. This incident shows that faults in the telecommunication infrastructure may paralyze the whole. For distributed teams, the redundancy of the network is not a luxury; it is a requirement.

2. The complex occurrences affect multiple layers simultaneously

When Movistar suffered a failure of central, not only failed a type of service: failed calls, data, and fiber optics. For support teams, receive thousands of reports fragmented (‘no coverage’, or ‘no internet’, ‘free WiFi’), without a clear connection can delay the identification of which it is a single incident systemic. This is exactly the reason why the difference between monitoring and incident management is critical: the monitoring detects symptoms, but the management of incidents connects those symptoms to the root cause.

3. Early detection allows for quicker responses

If the operators had detected the fault from their internal systems of monitoring before users reported the problem, they could have:

• Enabled protocols scaling immediate
• Advised corporate clients on expected impact
• Initiated recovery procedures with time-critical livestock

This directly relates to how to improve response times TI in your company, where incidents in minutes (not hours) is the difference between an event manageable and a crisis.

4. The communication is part of the management of the incident

Users never received an official statement clearly explaining what was going on, estimated duration, or recommended actions. This created panic, multiple reports of user unnecessary, and overload support channels.

5. The redundancy of connectivity is non-negotiable for critical operations

For production teams, the digital incident showed that having a single network connection is a risk. Professionals who have had access to connections alternatives (second operator, satellite connection back-up, the local cache) would have been able to continue working.

6. Visibility 24×7 requires proactive monitoring

Operators that were not ongoing monitoring of your infrastructure could have taken longer to detect that the problem is affecting multiple cities, multiple service types, and multiple clients.

How is it related to this case with the automatic management of incidents?

The incident Movistar/O2 exemplifies a fundamental challenge in IT operations: the difference between reactivity (responding to reports of user), and proactivity (to detect the problem before it affects the business).

In operations traditional:

1. User may not have access to a render farm → reports in email
2. Email comes to help desk → agent opens a ticket
3. Agent investigates → see that the internet is down
4. Agent-scale Network team → confirm problem
5. Network team start inquiry → 30-60 minutes after, it was confirmed that it is a problem operator

In modern operations with centralized monitoring:

1. Monitoring system detects that 1000+ connections to a render farm failed in 2 minutes → critical alert
2. System correlates alerts → looks that ruled connectivity ISP
3. Alert scale automatically → on-call network engineer is notified immediately
4. Context preevaluado → the engineer receives information showing that 5,000 users are affected
5. Response initiated → in the 5th minute of the incident, are activated recovery protocols

The difference is not of minutes; is proactive management versus management-reactive.

How can you help 24Cevent?

A system as 24Cevent is designed for scenarios exactly like the Movistar/O2. Although this was a failure of infrastructure ISP (outside the direct control of end-users), organizations that rely on critical connectivity can be used 24Cevent to:

Centralize alerts from multiple sources

An organization that suffered from this incident probably received alerts from:

• Monitoring uptime of render farms
• Alerts of connection of VPN clients
• Reports from users in chat/email
• Status pages of providers

24Cevent centralizes all of this in a single point of control, allowing the operator to instantly see that the problem is systemic.

Correlate events to identify root cause quickly

When multiple systems to fail nearly simultaneously (mobile, fiber, data), 24Cevent groups these events, reducing 10,000 alerts to 5 alerts that really matter. This ability to use 24Brains (AI for automatic classification) allows the team to focus on solving, not to discard noise.

To automatically scale according to criticality

At the moment it is detected that render farms are offline, 24Cevent can:

• Scale to specialists of infrastructure
• Notify project leaders on expected impact
• Start a run book response
• Prepare external communication

Automate basic answers

While the team investigates, 24Cevent can automatically:

• Activate connections fallback if there are (second ISP, VPN, backup)
• Notify customers about the incident
• Start a log of recovery time for subsequent analysis
• Trigger backups to local if the connectivity is degraded

Reduce detection time

In an actual incident, the difference between detecting a problem in minute 2 versus 30 minute may mean:

• 28 minutes less render farm without work
• Completed projects within deadline vs. delays
• Thousands of euros saved in loss of productivity

For teams that need to maximize this effectiveness, the integral management of incidents is the next step.

Frequently asked questions

How can an organization protect itself against failures of ISP?
With redundancy: two connections of different operators, satellite connection back-up, or local cache. For critical operations, the reliance on a single ISP is an unacceptable risk.

Why Movistar not encountered this before?
It is likely that he has been detected, but internally. The challenge was to climb, and quickly communicate to business customers on impact and recovery time estimated.

What is the economic cost of 2 hours of render farm interrupted?
Depends on the volume, but a farm with 100 teams working to $100/hour represents a $20,000 loss of computational power, in addition to delays in projects.

What is an SLA of telecommunications?
An agreement that provides guaranteed availability (e.g., 99.9% = up to 4 hours of downtime per year). Violations may result in credits to customers or workers ‘ compensation.

How does a computer YOU among a network problem versus an implementation problem?
Monitoring specific layers: if you ping the router fails, the network; if DNS fails, the ISP; if the application responds slowly, it could be anyone. An integrated management platform brings together all of these signs in a smart way.

Sources

• A drop of network causes thousands of notices by connection failures on Movistar, O2 and Digi – Debate
• Fall network of Movistar and Digi affects the production distributed, digital – Forum 3D
• Movistar and O2 recover the service and the network returns to normal operation – ADSL Zone
• 54 Internet Outage Statistics (2026) – Demandsage