A massive global service disruption across Microsoft 365 has entered its second day, leaving millions of workers, businesses, and government agencies unable to access critical workplace tools. Despite widespread speculation on social media that the tech giant had been hacked, official statements confirm the incident is an internal technical failure rather than a malicious breach.
Microsoft has explicitly stated that its investigation has found no evidence of malicious activity. Executive Vice President Charles Lamanna confirmed on social media that there is no indication the disruption was triggered by a cyberattack.
Also, Australian Home Affairs and Cyber Security Minister Tony Burke stated following a briefing with Microsoft and national cybersecurity coordinators that the incident is not a cyber event. Officials compared the situation to an internal software or update error rather than an external intrusion.
Cybersecurity analysts note that common denial-of-service attacks work by flooding systems with external traffic. Microsoft confirmed overall user traffic did not spike; instead, an internal process handling secure connections became overwhelmed, causing a large number of servers to fail automated health checks and drop offline.
As of today, there is no evidence that user emails, files, or personal data have been exposed or stolen according to Microsoft. Official report says the outage is an availability and connectivity failure rather than a security breach.
The disruption began around 18:00 GMT (1:00 PM ET) on Thursday, November 12, and quickly spread across the Americas, Europe, and the Asia-Pacific region. Outage tracking platform like Downdetector recorded roughly 140,000 user reports across 74 countries for Outlook alone. Other impacted services include Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot, Planner, To Do, and the security platform Defender XDR.
Likewise, across the United Kingdom, the outage has disrupted NHS email systems, GP surgeries, pharmacies, schools, police non-emergency lines, and parliamentary accounts. Government agencies in Japan, Singapore, Australia, and the Philippines' Supreme Court also reported operational delays and switched to backup communication methods.
Major artificial intelligence firms including OpenAI and Anthropic also reported degraded performance on tools connected to Microsoft's cloud infrastructure. Several international airlines and corporations also reported operational delays.
Microsoft says it's tracking the Exchange Online disruption under incident ID EX1550543 and the broader Microsoft 365 issue under MO1550821. Overnight efforts to restart servers initially yielded only "marginal success" as returning traffic overwhelmed recovered systems. However, after rolling back a recent network configuration change and deploying a targeted patch, Microsoft reported on Friday morning that Teams chats and meetings had largely returned and overall server stability was showing "early signs of stabilisation." Full capacity has not yet been restored.
While Microsoft has not reported any hacking issue, cybersecurity researchers at Sophos and banking institutions warn that cybercriminals are exploiting the outage. Users should ignore unsolicited emails, texts, or phone calls claiming to offer "Microsoft outage fixes" or requesting password resets, and should only check official updates on the Microsoft Service Health Status portal.
Share Your Thoughts