Accidental Database Drop / Failed Migration Script

Root Cause & Remediation

Missing environment guard in a migration script, incorrect target database in a CLI command, or a DROP TABLE / DROP DATABASE executed without a WHERE clause. Often occurs during deployment windows or infrastructure maintenance. Insufficient pre-migration backup validation compounds the recovery time.

Remediation steps

1. 1STOP all write traffic to the database immediately to prevent overwriting WAL/binlog recovery windows.
2. 2Initiate point-in-time recovery (PITR) from the most recent clean backup or WAL stream.
3. 3Estimate data loss window (RPO) and recovery time (RTE) and communicate to the business within 30 minutes.
4. 4If PITR is unavailable, attempt log mining to reconstruct lost transactions.
5. 5Post-incident: enforce migration dry-runs against a production clone and implement database-level DROP protection.

DORA Risk Matrix

Likelihood

Low

Blast radius

Scoped to services backed by the affected database, but can be total if a shared cluster is affected.

CIF impact

Immediate unavailability of all data in the dropped object. Recovery time (RTE) to restore from backup often exceeds 2 hours, triggering the CIF downtime threshold.

Analyst notes

Human error events are not exempt from DORA reporting. The CIF downtime threshold (>2h) is routinely breached during database restoration. Regulators also scrutinise whether adequate change management and rollback procedures were in place, making post-incident documentation especially important.