On 3 April 2021 OVH told France Bâti Courtage that the automated backups of its VPS had burned with the machine. The copies sat in the same Strasbourg building, SBG2. OVH's own later tally is 14,046 servers that were running in that building.
The Lille commercial court, on 26 January 2023, read the contract line "physically isolated" as a different place from the primary data. It ordered €26,472, €9,100, €38,530, and €20,000, plus €7,000 in costs, €101,102 in all. The Douai court of appeal, on 24 April 2025, kept a contractual breach, rejected a force majeure defence, and set the payment at €1,800.48. The appeal read the same words as separate infrastructure, and held that they do not require another city.
The copies were in SBG2 under both readings. The check that survives both judgments is the building code on the backup, asked while the VM still answers.
What burned at OVH SBG2
The investigation is BEA-RI report MTE-BEARI-2022-005. On 10 March 2021 an alarm hit the guard post at 00:35. At 00:37 the guard reached energy room 2 on the ground floor of SBG2 and found thick black smoke. The building was evacuated at 00:39. The fire service was called at 00:42 and arrived at 00:59.
The Register, quoting OVH, puts the public time later. A fire started in a room in SBG2 at 00:47, and the building was destroyed by 04:09. All four Strasbourg halls were taken offline. The same piece, citing local papers, puts the crew at 115 firefighters. The status update told customers whose production was in Strasbourg to activate a disaster recovery plan.
OVH cut the backup power to SBG2 at 01:13 and to SBG3, SBG1, and SBG4 at 01:28. The secondary substation belonged to the customer, so Strasbourg Électricité Réseaux cut the feed from the upstream substation, effective at 01:50. Generators and batteries were still feeding SBG2 at 02:14. From 03:28 the site had lost its power. Firefighters called for the pump boat EUROPA at 01:49. It arrived at 02:57. They reported the whole of SBG2 involved at 02:00. The fire was under control at 06:45, out at 10:02, and the intervention ended at 18:13. About 4,000 litres of emulsifier went on the building. The report records zero deaths and zero injuries.
The start, in the report, is two energy rooms at about the same minute, rooms that held batteries and inverters. Detection was fitted. OVH had left automatic extinguishing out of all five Strasbourg buildings. SBG2 is six levels on a steel frame. The floors are raw wood with an intumescent treatment, and the walls are single-skin cladding, a shape chosen so the halls could dump heat to the outside. OVH's documents claimed one hour of fire stability for the structure and one hour of fire resistance for the floors. The investigators say the fire crossed those floors inside the hour the documents claimed. Early coverage had called the hall five storeys. SBG1 lost 4 rooms of 12. Heat crossed to SBG3.
Netcraft's count, via The Register, is 3.6 million websites on 464,000 domains offline. Octave Klaba, quoted in that piece, said the company would add 10,000 servers over the next three to four weeks. OVH's later account counts 14,046 servers that were running in SBG2 and were destroyed. On the morning of 10 March a stock of 2,000 servers was released for customers moving to the other European sites. Weekly production at Croix went from 1,500 to more than 3,000. That update also records 14,472 bare-metal servers delivered as replacements, and nearly 18,000 servers produced in a few weeks.
A later smoke start in an SBG1 battery room, which OVH recorded as without consequence, forced power off on SBG1 and SBG4 again on 19 March so firefighters could go in at 19:00. The restart resumed from 22 March. SBG2 stayed stopped. Recoverable SBG1 machines were cleaned and moved to SBG3 and SBG4.
What the OVH backup contract promised
France Bâti Courtage runs the franchise network La Maison des Travaux. It rented a VPS and an automated backup. The backup annex was accepted on 13 April 2018. The VPS terms were accepted on 1 February 2020. The general terms on the account were accepted on 2 March 2021. The commercial page said a daily backup of the VPS, additional disks left out, exported, then replicated three times, then shown in the customer area. The annex said the storage allocated to that option is physically isolated from the infrastructure where the customer's VPS is installed.
They expected to put the sites back from the copy dated 9 March 2021. On 3 April, almost a month after the fire, OVH told them the backup was destroyed too, because it was stored in the same place as the primary server. The claim filed in Lille was €6,477,283.20.
The Lille judgment of 26 January 2023 reads the sentence as storage in a physically different place from the place where the primary server's data sits. The court found a contractual breach on that reading. It set clause 7.7 aside as unwritten. That clause listed fires, floods, and power cuts outside the party's control as force majeure, which the court said emptied the essential job of making the copies and keeping them, including in a fire. It also set the liability-cap clauses aside. It left the fire-safety claim short of gross fault.
| Head | Amount |
|---|---|
| Loss of an intangible asset, 10% of the lost immobilisation | €26,472 |
| Rebuild of hosting, data, and sites | €9,100 |
| One month of average monthly gross margin, headed as the 2021 financial loss | €38,530 |
| Harm to image | €20,000 |
| Article 700 costs | €7,000 |
The sites were fully down for a month, on the court's finding, and the margin figure is the expert's average month, from a report by Alcor. The four damages heads sum to €94,102. With the costs, the order is €101,102. Bâti Courtage rebuilt the sites from older copies it still had.
What the Douai appeal changed
The Douai court of appeal, chamber 2, section 2, ruled on 24 April 2025 in RG 23/00858. It rejected OVH's request to treat this fire as force majeure. It refused to strike the force majeure clause, and it refused to strike the liability cap. It dismissed the claim that OVH was at fault for leaving the backup out of a geographically isolated place.
The general terms leave "physically isolated" undefined. The court read it in the ordinary sense, as something separated from what sits next to it, distinct infrastructures standing apart. Treating the phrase as another datacentre would write a term into the contract after the fact. Screenshots of later remote-backup offers, and discussions from March 2021, were too late to fix what the April 2018 annex meant. A 3-2-1 layout was a rule this contract leaves out.
The appeal confirmed the finding short of gross fault on fire safety. It still found a contractual breach on the lost data. The last backup stayed unreachable. The judgment calculates a full-time month of staff time at €38 an hour as €39,900, ties two Visiperf invoices totalling €8,100 to the rebuild, and puts that combined head at €47,900. That figure sits above the cap in article 7.2. OVH had already issued a purchase voucher of €941.22, six months of the subscribed services, and the customer left the amount uncontested. The order is €1,800.48. Each side bears the costs it ran up, in the first case and on appeal, and both article 700 requests were rejected. The three daily replicas were in SBG2 on the facts both courts used.
Which failure domain a VPS backup shares
A copy survives the row it sits past, and it dies on the row it shares with the VM.
| Domain | Dies with that failure | Still there |
|---|---|---|
| Disk | A snapshot on that disk | A copy on another disk |
| Node | A vzdump archive on that node | Proxmox Backup Server on another node |
| Building | The provider backup in the same hall | A copy in another building |
| Company | Another region on the same contract | Restic at another provider |
| Account | The host's copies under that login | A git repo of the rebuild, under another login |
Bâti Courtage's three replicas died on the building row. They were real copies, exported, and they were still one hall. A snapshot would have died one or two rows earlier. Another OVH city would have cleared the building row and stayed on the company row, under the cap Douai applied.
How to check where a VPS backup is stored
Ask, in a ticket, which datacentre code stores the backups for this VM, and whether that code is the same building as the VM. Write the answer next to the VM name. On a NodeRings virtual machine the Backups tab is there when the hypervisor is Proxmox. VirtFusion and SolusVM 2 listings hide that tab, and the snapshots tab with it. A Daily plan runs at 02:00 UTC every day. A Weekly plan runs at 03:00 UTC every Sunday. Enabling the plan starts one backup immediately, then follows that clock. The docs' example retention is seven days for daily and four weeks for weekly. The job uses snapshot mode where the platform supports it, so the guest can keep running, and the archive still lands on the provider's backup storage. The page names the clock, and the building stays a question for the provider who holds the disks.
Time a restore on a second guest. Restic to a storage box, with a real restore test is that measurement. A fresh guest, whose tree started empty, restored snapshot 9d110ed9. Restic's summary said 2.000 GiB. The wall clock around the process was 15.297 seconds, and the sha256 manifest matched the restored files. Those bytes went to an SFTP server on that bench, the path in Hetzner's Storage Box SSH access doc. The restore landed on the guest that started empty. Time the same commands against a second provider.
restic snapshots
time restic restore latest --target /home/ubuntu/restorePut the third copy at another company, and pay for it on another card. Two providers in one fleet list is the shape. The restic repository belongs on the second company's storage, and the invoice for that storage belongs on a second card. One login at the host, with a backup add-on, stays on the account row.
How NodeRings works is the marketplace behind that list. Virtualized and Enzonix are different operators, so a repository on the second one sits under another company, billed to that company's card.
Resolve the nameserver names, then resolve one of those names. A shared fate shows up as both names coming back to the VM's own address.
dig NS noderings.com +short
dig A zac.ns.cloudflare.com +shortRun the same two lines on the zone that points at the VPS. Keep the registrar login in a password manager of its own.
Keep the rebuild in a repository on another company's git host. A cloud-init user-data profile replaces the provider's user-data when the VM is created. The provider still applies vendor-data and network-data. Editing the profile later leaves VMs that already booted alone. The profile is the recipe for the next machine. The disk contents live in the restic snapshot. Commit the profile, the firewall rules, and a zone export.
cloud-init.yaml
firewall-rules.txt
zone.exportWas OVH liable for the SBG2 backups?
Douai ordered €1,800.48. It found a contractual breach, rejected force majeure for this fire, kept the cap, and dismissed the geographic-isolation claim. Lille's €101,102 is the first-instance order, including €7,000 in costs, and the appeal replaced it. OVH had already handed over a €941.22 voucher for six months of service. Lille found the fire precautions short of gross fault, and Douai confirmed that finding.
Does a snapshot count as a backup?
A snapshot shares the disk, and on a typical Proxmox node it shares the node. It is the rollback for a bad deploy you can undo in minutes. The SBG2 fire took the hall, so a snapshot in that hall went with the VM. The row that survives a building is a copy in another building. On the NodeRings Backups tab that means a provider who will name a different datacentre code, or a restic repository kept at another company.
Does another region of the same provider count?
It survives the building. It shares the company, the contract, and usually the login. Bâti Courtage had three replicas and one building. A second OVH city would have survived SBG2. It would still have been one company's cap, the cap Douai applied at €1,800.48 after putting the recoverable staff and contractor costs at €47,900.
When did SBG1 come back after the OVH fire?
OVH's Strasbourg update says the 19 March smoke in an SBG1 battery room stopped power on SBG1 and SBG4, and the restart resumed from 22 March. Recoverable SBG1 servers moved to SBG3 and SBG4 after cleaning. By that update, SBG3 and SBG4 bare metal, VPS, and public cloud had been handed back. 30,775 VPS were restored. The last 5,900 VPS were still due on SBG3 before the end of April, so those customers could keep the same addresses. SBG2 stayed stopped. The replicas stored in it were the copies OVH had already reported destroyed.