🔍 Read the full analysis: AI Services Hit By Outages And Breaches: What Happened? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A week of technology disruptions included a Microsoft 365 outage and a nationwide FAA ground stop, both attributed by officials to technical or maintenance issues, with no evidence of an attack reported so far. Separately, five confirmed attacks affected software, vendors and hardware; final reports on the two major outages remain pending.
A Microsoft 365 outage and a nationwide FAA ground stop disrupted services this week, while five separate cyber incidents involved exploited software, vendor access or compromised hardware, according to official statements and the reporting summarized by ThorstenMeyerAI.com. As of 09:40 UTC Sunday, officials had reported no evidence that either major outage was caused by an attack, but final accounts of both disruptions were still outstanding.
Microsoft said problems from November 12 to 13 prevented many users from accessing Exchange Online mailboxes and affected services that rely on them. Its explanation changed as investigators examined the incident. The company first said it had not identified a recent change linked to the disruption, then said it was reverting a network configuration change. Its latest preliminary explanation points to traffic shifts during routine maintenance and upgrades that exposed a latent bug preventing new connection requests.
The incident record’s start time was also revised, from 10:05 UTC to 16:20 UTC Thursday; the recorded end time remained 16:10 UTC Friday. Microsoft said it would issue a preliminary post-incident report within two business days and a final report within five. Its status notice described the outage as technical and said it was not related to cyber activity or AI agents.
The FAA issued a ground stop for all airports on Friday, November 13. Based on the times in its advisories, it lasted about four hours and 23 minutes. Transportation Secretary Sean Duffy said a contractor was carrying out routine work to switch communications lines from copper to fiber at a remote FAA site. He said a router being replaced either malfunctioned or was involved in contractor error, flooding other routers. He also said officials had not determined which explanation applied. FAA Administrator Bryan Bedford said officials saw zero evidence of anything nefarious; the agency’s written statement said technicians were investigating.
The five attacks described in the source report were separate from those outages: Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency listed an exploited Outlook flaw; attackers accessed unpatched Check Point gateways; Uber driver data was taken using credentials stolen from a vendor; Osaka users’ email addresses were exposed through a vendor’s vendor; and three Trezor wallets purchased from one reseller were reported to contain implants. These cases involve different targets and methods, and do not establish a common campaign.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Separating Service Failures From Attacks
The incidents matter because outages and cyberattacks can look similar to customers—a service may become unreachable or data may be exposed—while requiring different responses. Treating every disruption as an attack risks spreading an unsupported explanation; treating technical failures as routine without checking can miss real security problems.
The reported causes also point to risks across ordinary operations. Network maintenance and equipment replacement can disrupt essential systems, while attacks in this week’s account exploited known software weaknesses or reached organizations through vendors and hardware. For businesses and public agencies, the practical lesson is to manage changes carefully, track supplier access and communicate what is known without presenting an early theory as settled fact.
Those conclusions remain provisional. No evidence reported so far is not the same as an investigation ruling out an attack, and the final Microsoft and FAA accounts could add detail or revise the preliminary explanations.
Products Worth Considering
Vari Ergo Electric Standing Desk, 54×26, Light Wood/White
Apple iPad Air 13-inch (M4), 128GB, Wi-Fi 7, Blue
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
As an affiliate, we earn on qualifying purchases.
How the Explanations Changed
The source report compiled statements available on Sunday morning and tracked how the two outage explanations developed. In Microsoft’s case, its initial status update said no recent change had been identified as correlating with the start of impact. Later updates referred to reverting a network configuration change, then identified a technical issue associated with an earlier network capacity upgrade. The latest version attributed the problem to maintenance-related traffic shifts exposing a latent bug.
The FAA’s public account was also incomplete. Duffy first blamed old, overloaded telecommunications equipment, then described the contractor’s copper-to-fiber work and a router that began flooding others. The FAA’s written notice had not changed by 09:37 UTC Sunday, according to the report, and still said technicians were investigating. L3Harris said it was supporting that investigation. The distinction between reported remarks and a final agency finding remains important.
The five attacks are a separate part of the week’s record, not evidence that the two major outages were attacks. The report attributes descriptions of the incidents to Microsoft, CISA, named organizations and officials, and media accounts where indicated. It presents them as five different security events, not as a single coordinated operation.
““We haven’t determined what the fault was.””
— Transportation Secretary Sean Duffy, as quoted by MS NOW
Final Causes Still Under Review
Neither major outage has a final published post-incident account in the material available at the Sunday check. Microsoft’s latest explanation is preliminary, and the company had promised further reports. The FAA had not published a detailed written account or identified the precise fault in the router change.
Officials said they had found no evidence of malicious activity in the Microsoft outage or anything nefarious in the FAA incident. Those statements describe the evidence reported at the time; they do not establish that every possible cause has been ruled out. The report says early explanations shifted in both cases, and the pending investigations could add detail or change the account.
For the five attacks, the source material provides brief descriptions but not a complete account of every affected person, the full scope of data exposure, the timing of each discovery or the status of remediation. It does not establish links among those incidents or connect them to either service outage.
Reports and Investigations Ahead
Microsoft said it expected to publish a preliminary post-incident report within two business days and a final report within five business days. Those documents are expected to provide more detail on the bug, the network changes and the outage timeline.
The FAA and L3Harris were still investigating the equipment and conditions behind the ground stop. The FAA’s written statement remained unchanged at the Sunday review, so the precise technical fault and any corrective measures had not yet been confirmed in the source material. Further agency findings should clarify whether the router itself failed, the way the work was carried out, or another factor caused the disruption.
Updates on the five attacks may establish the extent of exposed data and what affected organizations have done to address access, vulnerabilities or compromised devices. Until those accounts and the two outage reports are available, the supported conclusion is limited: the reported outages have preliminary technical explanations, while the attacks were distinct security incidents with separate reported entry points.
Key Questions
Were the Microsoft and FAA outages cyberattacks?
As of the Sunday status check, officials and Microsoft reported no evidence of an attack behind either outage. The final investigations had not been published, so the explanations remained preliminary.
What caused the Microsoft 365 outage?
Microsoft’s latest preliminary account said traffic shifts during routine network maintenance and upgrades exposed a latent bug that stopped systems from completing new connection requests. The company planned to publish post-incident reports.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said a router was involved in a contractor’s copper-to-fiber line work at a remote FAA site. He said officials had not determined whether the fault was contractor error or faulty equipment.
Were the five reported attacks connected to the outages?
The source report describes the five attacks as separate incidents involving software vulnerabilities, vendor credentials, a vendor’s vendor and implanted hardware. It provides no evidence linking them to the Microsoft or FAA disruptions.
Source: ThorstenMeyerAI.com
