root@ransomvault:~$ tail -f threat_intel.log

Threat Intelligence

Major Microsoft 365 Outage Disrupts Outlook, Teams and AI Connectors Worldwide

RansomVault Team3 min read

Microsoft 365, Outlook, and Teams went down for thousands of users on Thursday, November 12, 2026, in a major outage that also hit the Microsoft connectors used by OpenAI’s and Anthropic’s AI services. Microsoft first said the problem affected users in the Americas, then confirmed that users worldwide could be affected. At the time of writing, the outage has not been fully resolved.

Scale of the outage
At 2:07 p.m. ET, Downdetector logged more than 97,000 reports of Outlook problems, more than 38,000 for Microsoft 365, and about 4,500 for Teams. Complaints rose sharply that afternoon across Outlook, Microsoft 365, Teams, Copilot, Azure, OneDrive, and the Microsoft Store. Reuters noted that the actual number of affected users may vary.

In a Microsoft 365 admin center notice (MO1550821), Microsoft warned that users might have trouble accessing several services, including:

  • Exchange Online
  • Microsoft Teams
  • SharePoint Online
  • Microsoft 365 Copilot
  • Microsoft Defender XDR

The outage is also tracked under incident EX1550543.

Root cause: servers going offline, not a traffic spike
Microsoft first blamed heavy workloads across several regions, then found that increased traffic was not the cause. The company said the elevated load came from a number of servers going unexpectedly unavailable, which strained the remaining infrastructure.

In later updates on X, Microsoft said servers were failing automated health checks and dropping out of service. It found no recent change linked to the start of the problem. Its investigation suggests the failed health checks may come from a specific component that processes server health. Microsoft is testing a configuration change to fix the issue and has taken steps to stop more servers from being affected.

Microsoft’s response
Microsoft says it is “aggressively pursuing all pathways to reduce impact.” Its actions include:

  • Pausing all deployments
  • Redistributing connection traffic across its worldwide infrastructure and moving traffic off affected systems
  • Restarting all affected servers and monitoring their health as they come back into service

Timeline (November 12, 2026, ET)

TimeEvent
MorningMicrosoft investigates problems connecting to Exchange Online mailboxes in the Americas
9:45 – 10:53 a.m.Separate Teams outage (TM1550488) affects users in North and South America (since resolved)
1:26 p.m.Start of the main Microsoft 365 outage, according to Microsoft
2:07 p.m.Downdetector peaks at 97,000+ Outlook reports
Afternoon/eveningMicrosoft rules out a traffic surge, identifies unavailable servers, pauses deployments and begins restarts

Separate earlier Teams incident
Microsoft also reported an unrelated Teams outage (TM1550488) earlier that day, affecting users in North and South America from 9:45 to 10:53 a.m. ET. Users saw delays or failures when sending messages, creating or updating conversations, and loading chat messages. Microsoft traced it to resource contention in its infrastructure and confirmed it has been resolved.

Impact on AI services
The outage spread to third-party AI tools that depend on Microsoft 365. OpenAI reported problems with its Microsoft connectors, warning that new connections might fail and tools might not work properly. Anthropic also reported a problem with its Microsoft 365 connector caused by an upstream provider. Copilot and competing AI assistants couldn’t reach users’ mailboxes and data because the underlying Microsoft services were down.

Is this a cyberattack?
Nothing Microsoft has disclosed so far points to malicious activity. The company describes an infrastructure problem with server health checks. Organizations should rely on official Microsoft updates rather than guessing about the cause.

Recommendations for IT teams

  • Follow official channels: Check the Microsoft 365 admin center for incidents EX1550543 and MO1550821, or status.cloud.microsoft if the admin center isn’t available.
  • Expect delays: Emails and messages may arrive late until services fully recover. Tell users so they don’t resend messages repeatedly.
  • Use backup communication channels for urgent matters while Outlook and Teams are unstable.
  • Watch for outage-themed phishing: Threat actors often use major outages to send fake “Microsoft support,” password-reset, or service-restoration emails. Remind users to be careful.
  • Review business continuity plans: This incident shows how many organizations and AI tools depend on a single cloud provider.

We will update this post once Microsoft confirms full service restoration and shares a root cause analysis.

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo