Pixar fixed its broken backup instead of blaming the person who erased Toy Story 2

During production of Toy Story 2 in 1998, a Unix delete command run from the wrong directory propagated across Pixar's network and erased roughly 90% of the film's files — character models, sets, animation, two years of work — in minutes. When the recovery team reached for the studio's own backup system, built specifically to prevent exactly this scenario, they found it had been silently failing for about a month; the safety net meant to catch this failure had itself failed unnoticed.

The instinctive organizational response to a disaster this expensive is to find out who caused it — whoever typed the command becomes the person a studio under enormous financial and schedule pressure needs to hold accountable, both to satisfy leadership above and to feel like the problem has been addressed. Pixar had that same pressure and the same easy target available.

The film was ultimately recoverable only because supervising technical director Galyn Susman, working partly from home after having a baby, had been keeping her own informal, unauthorized copy of the production files on her home computer — colleagues drove to retrieve the machine and used it to rebuild the lost work.

Ruled out blame-finding so people felt safe to reveal the unauthorized backup that saved the film, then fixed the broken system instead of punishing the trigger.

Not seeking blame removed the incentive to hide information, so Galyn Susman's unauthorized backup was revealed and used for recovery.

Focusing on system fixes addressed the actual failure—the silently broken backup—rather than just removing one individual.

A blameless culture encourages people to volunteer workarounds and near-misses, which can expose broken systems before they cause disasters.

When a costly failure happens, resist the urge to find a scapegoat; instead, treat it as a systemic problem and fix the root cause, which encourages people to surface near-misses.

Toy Story 2 was fully recovered and delivered on its original schedule; the studio rebuilt its backup infrastructure with automated testing, distributed storage, and access restrictions on destructive commands rather than around any single person's conduct.