The key facts

  • The outage began on Thursday afternoon European time and lasted more than 12 hours, affecting 74 countries
  • Downdetector recorded nearly 140,000 complaints for Outlook alone; in the US — over 97,000 for Outlook, 38,000 for Microsoft 365 and 4,500 for Teams
  • Microsoft rules out a cyberattack and cites mass server failures as the cause; recovery is proceeding slowly

What happened

On the evening of November 12, users around the world began experiencing problems accessing Outlook email, the Teams video conferencing service, the Copilot assistant and other Microsoft products. According to Downdetector, about 140,000 users from 74 countries and territories reported Outlook issues; in the US, counters reached 97,000 for Outlook, 38,000 for Microsoft 365 and 4,500 for Teams. Reuters described the incident as one of the largest in the company's history: it lasted more than 12 hours and disrupted the operations of government and commercial organizations worldwide.

How Microsoft's explanations changed

The company first attributed the outage to 'increased load' on its infrastructure, but later clarified that the rise in load was not caused by a surge of users. Instead, a large number of servers became 'unexpectedly unavailable,' and their tasks fell to the remaining machines. Attention then shifted to automated health checks, which Microsoft uses to decide whether a server is ready to accept traffic: the company said it was testing a configuration change addressing the problem that caused healthy servers to fail the checks and be taken out of service. Mahmud Elkhodr, a senior lecturer at CQUniversity, suggested in an article for The Conversation that a failure of the checking system itself could have disabled healthy servers and overloaded the rest, emphasizing that this was merely an inference from Microsoft's public updates.

Recovery is struggling

The first attempts to fix the situation did not produce the expected result: servers brought back overnight failed again under load, and the company itself acknowledged that the changes 'did not work as expected.' By Friday morning, November 13, Microsoft reported only 'minor success' after installing patches and rebooting infrastructure, and later 'positive results' from traffic optimization. Nevertheless, the company noted that service capacity had not yet returned to normal levels and that the situation remained unstable as traffic was cautiously restored. The list of affected services grew: alongside Outlook, Teams and Copilot, SharePoint Online, the Defender XDR security tool, as well as the Planner and To Do apps were added.

Who was affected

The consequences went far beyond inaccessible email. In Australia, the outage affected the operations of the Federal Police and counterintelligence; the government of Singapore also reported impact. In Japan, according to the Cabinet, the infrastructure of the government information system was hit. A number of medical practices in the UK asked patients to contact them by phone rather than email for urgent matters. OpenAI and Anthropic reported problems in parts of their AI services integrated with Microsoft 365, and electric vehicle maker Workhorse moved its earnings call to Monday. According to Paul Spain of New Zealand's Gorilla Technology, many companies effectively 'lost a working day.'

Cyberattack and data: what is known

Microsoft stated it had no information about 'malicious activity,' and executive vice president Charles Lamanna noted that the outage did not resemble a cyberattack; no group claimed responsibility. Elkhodr added that a typical DDoS attack relies on overwhelming a system with external traffic, which is inconsistent with Microsoft's statement that there was no traffic increase. Nevertheless, rumors of a hack spread on X: GlobalData analyst Smitarani Tripathi linked this to the company's lack of a confirmed cause and timeline for resolution. According to available information, this is an access problem, not data theft: nothing Microsoft has said points to a leak or loss of customer data. Indirect risks remain: Defender XDR's operation was disrupted, which could have hindered threat monitoring, and scammers often exploit major outages to send fake 'support service' emails.

Context and what's next

This is not an isolated outage for the company: in January, Microsoft 365 services were already down for several hours, and in August a faulty code update caused multi-day disruptions to Outlook and Exchange Online. The incident coincided with a debate in Europe about the dependence of governments and businesses on a few American cloud providers. Microsoft promised to continue posting updates on its service status page and to release a detailed incident report identifying the root cause and measures to strengthen its infrastructure. Until a full analysis is presented, the key questions — why so many servers failed simultaneously and how to prevent a recurrence — remain unanswered.