🔍 Read the full analysis: AI’s Outages And Breaches: Investigating The Causes Of A Rough Week on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
As of 09:40 UTC on Nov. 15, officials and companies had attributed the Microsoft 365 outage and FAA flight ground stop to technical and maintenance issues, with no evidence of an attack reported in either case. Five separate security incidents involved exploited vulnerabilities, stolen vendor credentials or compromised supply chains. Final reports on the two outages were still pending.
Microsoft 365 service disruption and a nationwide FAA ground stop were attributed to network and maintenance problems, not a cyberattack, according to statements available Sunday, Nov. 15. In a review of seven incidents this week, the source report identified five other, separate attacks involving software flaws, stolen vendor credentials and compromised products; final accounts of the two outages were still pending.
Microsoft said its outage, which disrupted access to Exchange Online mailboxes and related services from Nov. 12 to 13, followed traffic shifts during routine network maintenance and upgrades. Those shifts exposed a latent bug that prevented systems from completing new connection requests, according to the company’s revised preliminary explanation. Microsoft’s status records put the outage’s end at 16:10 UTC on Friday; the company had earlier revised its stated start time.
The FAA ground stop began at 3:54 p.m. Eastern Time on Friday and lasted about four hours and 23 minutes, based on the agency’s advisories. Transportation Secretary Sean Duffy said a contractor was replacing telecommunications equipment during a copper-to-fiber upgrade at a remote FAA site. He said a router either malfunctioned or was affected by contractor error and flooded other routers in the air traffic control system. The specific fault has not been determined.
The five attacks described in the source report were separate incidents: Microsoft and the Cybersecurity and Infrastructure Security Agency listed an exploited Outlook flaw; attackers accessed unpatched Check Point gateways; Uber driver data was taken using a vendor’s stolen credentials; Osaka users’ email addresses were obtained through a vendor’s vendor; and three Trezor wallets purchased from one reseller contained implants. The report does not establish a connection between these attacks and either outage.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Two Outages, Different Security Incidents
The week’s events show why an outage and a breach should not be treated as interchangeable evidence. Service failures can follow routine changes, while attacks may exploit known software flaws or weaknesses in supplier access. Conflating them can misdirect investigations and lead organizations to overlook the operational risks of maintenance or the exposure created by third parties.
The incidents also matter because both outages affected services relied on by many people and organizations: Microsoft’s disruption prevented users from reaching mailboxes, while the FAA stoppage halted flights nationwide for several hours. The available explanations are preliminary, however. No evidence reported so far is not proof that an attack has been definitively ruled out; the agencies and companies still have work to do before their accounts are final.
Popular right now
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
Hisense 40-Inch QD4SR Series Hi-QLED FHD Roku Smart TV
TCL 85-Inch QM64L QD-Mini LED 4K Smart Fire TV
As an affiliate, we earn on qualifying purchases.
How the Explanations Evolved
Microsoft’s public account changed as its investigation developed. On Thursday, it said it had not identified a recent change correlated with the start of the impact. Later, it said it was reverting a network configuration change. On Friday, it said there was no indication of malicious activity and described the problem as technical, unrelated to cyber activity or AI agents. Its revised preliminary explanation, available in the records checked Sunday, linked the bug to traffic shifts during maintenance and upgrades.
The FAA’s public account also became more specific over time. Duffy initially blamed old, overloaded telecommunications equipment, then described the contractor’s copper-to-fiber work and the router failure or error. FAA Administrator Bryan Bedford said the agency saw “zero evidence” of anything nefarious and zero evidence of anything AI-related, according to CNN. The FAA’s written statement still said technicians were investigating when checked Sunday. These accounts concern the two outages; the other five incidents were reported as attacks with distinct entry points.
“We see zero evidence of anything nefarious, and zero evidence of anything AI-related.”
— FAA Administrator Bryan Bedford, according to CNN
Final Causes Are Still Pending
Neither outage had a final published incident report as of 09:40 UTC on Nov. 15. Microsoft said it planned to issue a preliminary post-incident report within two business days and a final report within five business days. Its explanation remains preliminary, and the company’s public status wording and start time changed during the incident.
The FAA had not published a detailed written account of the router failure, and Duffy said investigators had not identified whether the fault came from contractor error or faulty equipment. Bedford reported no evidence of malicious activity, but the source material also quotes Mullin saying officials would not rule out an attack while they continued looking. The reviewed material does not give details about the scope or resolution of all five attacks, nor does it establish any shared cause linking them.
Reports and Investigations to Come
Microsoft’s promised preliminary and final post-incident reports are the next milestones for understanding the outage’s timeline, technical failure and corrective steps. The FAA and its contractor, L3Harris, are supporting an investigation into the conditions that led to the ground stop. A fuller FAA account should clarify what failed during the equipment replacement and whether any changes are needed to maintenance procedures or system safeguards.
Until those reports are available, the explanations should be treated as the best public accounts to date rather than final findings. Organizations following the incidents can distinguish confirmed service disruptions from stated causes, track updates from the agencies and companies involved, and review both change-management practices and access granted to suppliers. The current record supports separate explanations for the outages and attacks, but later findings could change that assessment.
Key Questions
Was the Microsoft 365 outage caused by a cyberattack?
Microsoft said there was no indication of malicious activity and attributed the outage to a latent bug exposed by traffic shifts during network maintenance and upgrades. Its final post-incident report was still pending as of Nov. 15.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said a router at a remote FAA site flooded other routers during work to move telecommunications lines from copper to fiber. Investigators had not determined whether contractor error or faulty equipment caused the problem.
Were the five reported attacks connected to the outages?
The source report describes the attacks as separate incidents involving vulnerabilities, vendor credentials and compromised products. It provides no evidence that they caused or were connected to either outage.
When will more definitive findings be available?
Microsoft said it expected to provide a preliminary post-incident report within two business days and a final report within five business days. The FAA had not announced a date for a detailed written account.
Source: ThorstenMeyerAI.com
