Close Menu
Security

Microsoft 365 outage: was it a cyberattack? What we know

Mantas SasnauskasBy Updated:No Comments8 Mins Read2,009 Views
Microsoft's servers dropped out, and Outlook went dark: illustration with two figures, more than 129,000 Outlook outage reports and 5 Microsoft 365 services

Microsoft 365 went down for users around the world on Thursday 12 November 2026, taking Outlook, Teams, SharePoint, Copilot and Defender XDR with it. Microsoft says the cause was a large number of its own servers becoming unexpectedly unavailable, not a surge in traffic, and nothing it has published points to a cyberattack. By 3:30 p.m. ET (20:30 UTC) it was restarting servers and restoring service.

Outage trackers also lit up for Amazon Web Services, Google and Gmail, which is why the day felt like half the internet had failed. Their own status pages did not agree. This is what is confirmed, what is not, and why an outage like this is still a security problem.

Is Microsoft down right now?

Not fully. When this article was last updated, at 21:55 UTC on 12 November, Microsoft had not declared the incident over. Its 4 p.m. ET status update said a different way of checking server health had returned some of the failed servers to service and was being applied more widely, and that automated restarts were being prepared for servers that stop responding. Administrators can follow it in the Microsoft 365 admin center under EX1550543 and MO1550821.

Was the Microsoft outage a cyberattack?

Nothing Microsoft has said points to one. Its first diagnosis was that part of its infrastructure was under elevated load in several regions. It then narrowed that down: the load did not come from more traffic, it came from “a number of servers being unexpectedly unavailable”, as ABC News reported, which pushed the work onto the machines that were left.

That detail matters. A denial-of-service attack shows up as a flood of traffic, and Microsoft is describing the opposite, lost capacity under normal demand. What Microsoft has not yet explained is why the servers dropped out. Until it publishes a post-incident review, the honest answer is that there is no evidence of an attack and no full root cause either.

What went down, and when?

Microsoft’s advisory lists Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR, according to BleepingComputer. The timeline shows when users noticed the problem and what Microsoft said at each step.

How the Microsoft 365 outage unfolded
Thursday 12 November 2026. Times are US Eastern (ET), with UTC alongside.
  1. Morning Microsoft
    A separate Teams incident hits users in North and South America. Microsoft says it is resolved and has not said whether the two are linked.
  2. 12:39 p.m. ET 17:39 UTC User reports
    Outlook problem reports start to climb on Downdetector, Variety reports.
  3. 12:54 p.m. ET 17:54 UTC Microsoft
    Microsoft says it is investigating failed access to Exchange Online mailboxes in the Americas. It later says users in any region may be affected.
  4. 1:09 p.m. ET 18:09 UTC User reports
    Downdetector has logged more than 129,000 Outlook reports. CP24 counted nearly 140,000 by 1:30 p.m.
  5. 1:35 p.m. ET 18:35 UTC Microsoft
    Microsoft blames elevated load on part of its infrastructure in several regions. About 15 minutes later it starts spreading connections across the rest of its network.
  6. 2:12 p.m. ET 19:12 UTC Microsoft
    Microsoft pauses all deployments, moves more traffic off the affected systems and starts restarting servers.
  7. 2:31 p.m. ET 19:31 UTC Microsoft
    Microsoft rules out a traffic surge. The load comes from servers that became unexpectedly unavailable, which strains the ones still running.
    Why it matters: a denial-of-service attack looks like a flood of traffic. This is the opposite.
  8. 2:50 p.m. ET 19:50 UTC Microsoft
    The servers are failing automated health checks, Microsoft says. It tests a configuration change and restarts all of them.
  9. 3:15 p.m. ET 20:15 UTC User reports
    More than 63,000 Outlook reports remain on Downdetector.
  10. 3:19 p.m. ET 20:19 UTC Microsoft
    No recent change lines up with the start of the outage, Microsoft says. It suspects the component that processes server health.
  11. 4:00 p.m. ET 21:00 UTC Microsoft
    A different way of checking server health brings some servers back. Microsoft starts applying it more widely.
  12. Status Now
    Microsoft has not declared the incident over. Checked at 21:55 UTC on 12 November.
Microsoft’s statements are timed by its Microsoft 365 Status posts on X. Report counts are Downdetector figures as published by the outlets linked in this article. Last checked 21:55 UTC, 12 November 2026.

Why does Downdetector show AWS, Google and Gmail too?

Because Downdetector counts what users report, not what providers measure. When email and meetings stop working, people report whatever they were using at the time, and the charts for unrelated services rise together.

Free tool

How does your own site score?

Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

Downdetector's United States page on 12 November 2026 showing simultaneous spikes in outage reports for Microsoft Outlook, Microsoft 365, Teams, Copilot, OneDrive and Azure, with smaller spikes for Gmail, AWS, Google, Zoom, Starlink and OpenAI
Downdetector’s US page during the outage on 12 November 2026. Every chart is built from user reports. Screenshot: Ransomnews.

The providers’ own dashboards told a different story. PCWorld checked during the outage and found no issues on Cloudflare Radar or Google’s cloud status page, and only a local problem in Tokyo on the AWS Health Dashboard. The scale was different too: CP24 saw about 1,350 reports for AWS and 1,000 for Gmail, against well over 100,000 for Outlook.

Why is an outage a security problem?

For three reasons, none of which need an attacker to have caused it.

  • Defender XDR was on the list. For a few hours, security teams could not rely on the console many of them use to see alerts and run investigations. Anything that happened in that window deserves a second look once the portal is stable.
  • Outages make good phishing lures. Expect emails and texts offering to “restore your mailbox” or “re-verify your Microsoft 365 account”. Cheap, fluent lures are easier to write than ever, as we covered in how large language models are reshaping phishing.
  • Workarounds outlive the outage. Staff move work to personal email and chat apps, and administrators relax sign-in rules to get people back in. Both leave gaps that stay open after service returns.

What should admins and users do?

  • Follow the official record. Use the Microsoft 365 admin center entries EX1550543 and MO1550821, not social media screenshots.
  • Do not loosen MFA or conditional access to work around sign-in errors. If you changed a policy today, change it back.
  • Review the gap. Once Defender XDR is healthy, check alerts and sign-in logs for the hours it was unavailable.
  • Warn staff about recovery scams. Microsoft will not email a link to restore a mailbox. A stolen session is enough to get past MFA, which is why session-cookie theft is the attack to watch after an event like this.
  • Pull work back from personal accounts and unofficial channels, and delete what was copied there.

Frequently asked questions

Was the Microsoft outage on 12 November 2026 a cyberattack?

There is no evidence that it was. Microsoft says the outage came from a large number of its servers becoming unexpectedly unavailable, not from a surge in traffic. It has not yet said why those servers failed.

Which Microsoft services were down?

Microsoft’s advisory lists Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR. Users also reported problems with Outlook, OneDrive, Azure and the Microsoft Store on Downdetector.

Were AWS and Google down as well?

Their status pages did not show it. Downdetector recorded about 1,350 reports for AWS and 1,000 for Gmail, but Google’s cloud status page reported no issues and the AWS Health Dashboard showed only a local problem in Tokyo.

How many people were affected by the Outlook outage?

Microsoft has not given a number. Downdetector logged more than 129,000 Outlook problem reports by 1:09 p.m. ET and nearly 140,000 by 1:30 p.m., and those are user reports, not a count of affected accounts.

How do I check whether Microsoft 365 is working again?

Administrators can check the Microsoft 365 admin center under incident EX1550543 and advisory MO1550821. Everyone else can use Microsoft’s service health status page. Do not follow links in emails that offer to restore your account.

Sources and further reading

The Ransomnews Monthly

One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

Share.

Mantas Sasnauskas is the editor-in-chief of Ransomnews and leads its ransomware reporting and investigations. He created the Cybernews research team and led it as Head of Security Research. His investigations include infiltrating REvil's affiliate recruitment in 2021, the 2020 discovery of backdoored routers sold by Walmart, Amazon and eBay, the 2022 Thomson Reuters exposure of 6.9 million logs and, with Bob Dyachenko, the 26-billion-record "Mother of all Breaches" of 2024. He sets the verification standard behind Ransomnews and its Ransomtracker, confirmed-attacks and Stealercheck datasets: claims are reported as claims, and an attack is confirmed only from victims, regulators and primary documents.

Related Posts

Comments are closed.