🔍 Read the full analysis: What Actually Happened During AI’s Week Of Outages And Breaches? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Microsoft 365 outage and a nationwide FAA ground stop disrupted services this week, but officials and companies have so far attributed both to technical problems, not attacks. Five other incidents were reported as confirmed attacks involving a software flaw, unpatched network devices, stolen vendor credentials and compromised products. Investigations and formal reports are still pending, so the causes of the two outages are not final.
A Microsoft 365 outage and a nationwide FAA ground stop disrupted services this week, while five separate incidents were reported as attacks—but current explanations do not link the outages to cyberattacks or artificial intelligence. Microsoft and U.S. officials have attributed the service disruptions to network and equipment problems; formal incident accounts are still pending, and investigators have not closed off every possibility.
Microsoft said its Exchange Online disruption, which began Thursday, November 12, and ended Friday, November 13, followed network maintenance and upgrades. In a status update revised by Sunday morning, the company said traffic shifts exposed a latent bug that prevented systems from completing new connection requests. Microsoft’s earlier updates evolved: it first said it had not identified a recent change tied to the impact, then said it was reverting a network configuration change. It later said there was no indication of malicious activity and described the problem as unrelated to cyber activity or AI agents. The company’s status record gives the incident window as 16:20 UTC Thursday to 16:10 UTC Friday.
The FAA ground stop began Friday afternoon and lasted about four hours and 23 minutes, according to times in the agency’s advisories. Transportation Secretary Sean Duffy said a contractor was carrying out routine work to replace copper telecommunications lines with fiber at a remote FAA site. He said a router being replaced either malfunctioned or was involved in an error that flooded other routers in the air traffic control system. The FAA’s written statement, still unchanged Sunday morning, said technicians were investigating. FAA Administrator Bryan Bedford said officials saw no evidence of anything nefarious or AI-related.
The five other incidents were reported as attacks, but they were not presented as connected to either outage. Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency list an Outlook vulnerability as exploited. Attackers also broke into unpatched Check Point gateways. Separate reports described Uber driver data obtained using a vendor’s stolen credentials, Osaka users’ email addresses exposed through a vendor’s vendor, and three Trezor wallets purchased from one reseller that contained implants. These cases involved different systems and routes of access; the material available does not establish a common actor or campaign.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Separate Outages From Confirmed Attacks
Putting the incidents side by side matters because the outages and attacks call for different explanations and responses. The Microsoft and FAA accounts so far point to maintenance, configuration and equipment failures. The other five cases involve reported exploitation, stolen credentials or compromised supply chains. Treating all seven as one coordinated cyber event would go beyond the available evidence.
The incidents also show how routine operations can create service risks, even without malicious activity. A network change or equipment replacement can have effects beyond the system being worked on. At the same time, the reported attacks underline that organizations can be exposed through known software flaws and third-party access, including vendors further down a supply chain. For customers, workers and agencies, the distinction affects what is known about data exposure, service recovery and the steps needed to reduce future risk.
The review is not proof that the outages were harmless or that every attack detail is settled. It is a snapshot of what responsible organizations and officials had said by 09:40 UTC Sunday. Pending reports could add facts or revise the initial explanations.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (2024), 32 GB, Metallic Black
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID (Midnight)
As an affiliate, we earn on qualifying purchases.
How the Explanations Changed
The first accounts of both major outages were incomplete. Microsoft initially said it had not found a recent change correlated with the start of its service impact. It later identified a network configuration change, then revised its preliminary explanation to describe traffic shifts during maintenance and upgrades exposing a latent bug. The company also changed the recorded start time in its status history. That sequence makes its promised post-incident report important for clarifying the timeline and technical cause.
Accounts of the FAA incident also became more specific over time. Duffy first blamed old, overloaded telecommunications equipment, then described the contractor’s copper-to-fiber work and a router problem. He said officials had not determined whether the cause was contractor error or faulty equipment. The FAA’s written account remained brief as of Sunday, and contractor L3Harris said it was supporting the agency’s investigation.
Public concern about a possible cyberattack grew as the incidents occurred close together. On Sunday, France 24 framed the question in a headline about grounded flights, a Microsoft outage and cybersecurity fears. The statements cited in the source material, however, do not establish a connection among the outages and the separate attacks.
“We’re still looking, so we’re not going to rule that out.”
— Homeland Security Secretary Markwayne Mullin, on Friday
Investigations Have Not Closed
Neither major outage has a final published account. Microsoft said it would provide a preliminary post-incident report within two business days and a final report within five business days. Its current explanation remains preliminary, and its status history changed as the investigation developed.
The FAA’s cause is also unresolved. Duffy described a router problem during work to replace copper lines with fiber but said officials had not established whether it resulted from an error or equipment fault. The agency’s written notice said technicians were investigating, and L3Harris was supporting that work. Officials said they had seen no evidence of a cyberattack, but Mullin explicitly said the possibility had not been ruled out.
The source material lists five separate incidents as confirmed attacks, but does not provide full timelines, affected-user totals, or final investigative findings for each. It also does not establish whether the incidents were connected to one another. Claims about the scope, responsible actors and consequences should not be treated as settled beyond what the named organizations and reports have stated.
Reports Will Test Early Accounts
The next major milestones are the Microsoft post-incident reports and a fuller written account from the FAA. Microsoft’s stated schedule calls for a preliminary report within two business days and a final report within five. The FAA’s investigation, with L3Harris supporting, is expected to clarify what happened at the remote site and whether the router or the work process was at fault.
Until those findings are published, the most accurate account is that the outages have been attributed to technical problems, while officials have reported no evidence tying them to cyber activity or AI. That assessment may change if investigators release new evidence. Separately, organizations affected by the five reported attacks may provide further information about the exploited flaw, vendor access, exposed data and compromised wallets.
Key Questions
Were the Microsoft outage and FAA ground stop cyberattacks?
As of 09:40 UTC on November 15, Microsoft attributed its outage to a bug exposed by network maintenance and upgrades. FAA officials described a router problem during telecommunications work and said they had seen no evidence of an attack. Neither investigation had produced a final report.
How long did the FAA ground stop last?
It lasted about four hours and 23 minutes, based on the event times in FAA advisories.
Were the five reported attacks connected to the outages?
The available source material does not establish a connection. It describes five separate attack incidents involving a software flaw, unpatched gateways, stolen vendor credentials, a vendor’s vendor and implanted hardware in three wallets.
What is still unknown about the two outages?
Microsoft’s formal post-incident reports have not yet been published. The FAA has not determined whether the router issue resulted from contractor error or faulty equipment, and its investigation remains open.
Source: ThorstenMeyerAI.com
