Curator took down client websites through human error: profit −49%

Russian infosec integrator Curator (legal entity "HLL") has suffered an outage of its clients' web resources. The cause is said to be human error. The company's 2025 financial statements show revenue up 17% to 2.22 billion rubles, while net profit fell 49% to 298.7 million rubles.

For a company that sells clients reliability, an incident like this hurts more than an ordinary IT failure. The quality test here is simple: protection must not itself become a cause of downtime.

What is known about the incident

The available excerpt of the TAdviser report says little: the outage affected Curator's clients' web resources, and the root cause was named as human error. The available data does not say how many clients were affected, how long the outage lasted, which operation went wrong, or whether any compensation was paid. We won't speculate about the technical mechanics. Until the company publishes its own analysis, any theory is guesswork.

The wording itself is telling, though. "Human error" usually means the process had no safeguard against a wrong action: no second pair of eyes to review the change, no staged rollout, no fast rollback.

Finances: revenue grows, profit collapses

According to the financial statements TAdviser learned about on 29 May 2026, the picture for 2025 is as follows:

• revenue: 2.22 billion rubles versus 1.89 billion rubles in 2024 (+17%, about +330 million rubles);
• net profit: 298.7 million rubles versus 583.6 million rubles (−49%, a drop of about 285 million rubles);
• profit from sales: 270.3 million rubles versus 580.4 million rubles (−53%, a drop of about 310 million rubles);
• gross profit: down 33%;
• estimated net margin: about 13.5% versus roughly 30.9% a year earlier.

When revenue grows 17% while gross profit falls by a third, cost of sales has clearly risen much faster than sales. The available data does not show what that cost includes (purchases of licenses and hardware for resale, engineers' pay, subcontracting). Profit from sales fell more than gross profit, which means selling and administrative expenses did not shrink either.

There is no basis for linking the 2025 financial results to the October outage. They fall in different periods, and the report shows no causal link between them. Taken together, though, the two facts describe a company that is growing fast in turnover while losing margin.

What clients of security services should check

Any contractor with access to your perimeter, DNS, WAF or load balancers is a potential point of failure. The practical minimum:

• Ask for change-management terms in the contract and SLA: who approves work on your infrastructure, and how, and whether there are maintenance windows.
• Find out whether the contractor uses staged rollouts and mandatory rollback for changes that touch production services.
• Prepare a bypass route in advance: a way to quickly take your site out from behind an external protection service, or to switch DNS without the contractor's involvement.
• Put in writing the contractor's liability and compensation for downtime caused by its fault, not only for unavailability of the service itself.
• Demand a postmortem after any incident: cause, timeline, and measures to prevent a repeat.

The main question for Curator now is not whether there was an error, but what the company will change in its processes so that a single mistake cannot take down several clients at once. A public postmortem would do the most to restore market trust.