🔍 Read the full analysis: A Week Of AI Outages And Breaches: Cyberattack Or Something Else? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Two major disruptions this week—the Microsoft 365 outage and a nationwide FAA ground stop—have been attributed so far to technical and maintenance issues, not attacks. Five other incidents involved confirmed attacks, but final reports on the two outages are still pending.
Microsoft and U.S. aviation officials have attributed two major technology disruptions this week to technical failures during network maintenance, while five separate incidents involved confirmed attacks. The explanations remain preliminary: Microsoft and the Federal Aviation Administration have not yet published their promised or expected detailed accounts, leaving open whether later findings will change the current picture.
Microsoft 365 users lost access to Exchange Online mailboxes and related services from November 12 to 13. Microsoft’s account evolved over the outage: it first said it had not identified a related change, then reported reverting a network configuration change. By Friday, the company said there was no indication of malicious activity and described the outage as a technical issue unrelated to cyberattacks or AI agents.
In a status update subsequently revised, Microsoft said traffic shifts during routine network maintenance and upgrades exposed a latent bug that prevented some new connection requests. The company’s records put the incident’s start at 16:20 UTC on Thursday and its end at 16:10 UTC on Friday. Microsoft said it would issue a preliminary post-incident report within two business days and a final report within five.
The FAA ground stop on November 13 lasted about four hours and 23 minutes, according to the agency’s advisories. Transportation Secretary Sean Duffy said a contractor was replacing telecommunications equipment as a remote site moved from copper lines to fiber. He said a router, because of contractor error or a faulty component, flooded other routers in the air traffic control system. FAA Administrator Bryan Bedford said officials had seen no evidence of a malicious or AI-related cause. The FAA’s written account still described the matter as under investigation.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Two Outages, Five Separate Attacks
The incidents matter because their timing and proximity can make unrelated failures look like a single coordinated event. The available accounts instead point to two different categories: operational problems during network maintenance for the major outages, and attacks involving vulnerabilities, stolen credentials, third-party suppliers or compromised products in five other cases.
That distinction affects how organizations respond. The outages underline the risks of routine infrastructure changes and the need for tested recovery plans. The attacks highlight exposure through unpatched systems and vendor relationships, including suppliers several steps removed from the affected organization. The week’s incidents do not establish a common cause or coordinated campaign.
The distinction is provisional, not a finding that attacks were impossible. As of Sunday morning, the two outage investigations were unfinished. Businesses and public agencies therefore have reason to prepare for both operational failure and malicious activity, while avoiding conclusions that the evidence does not yet support.
Products Worth Considering
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Apple Watch Series 10 GPS 46mm with Silver Aluminum Case and Blue Cloud Sport Loop
Anker SOLIX C1000 Gen 2 Portable Power Station with 100W Solar Panel
As an affiliate, we earn on qualifying purchases.
How the Week’s Causes Emerged
The sequence of Microsoft’s public updates shows why early explanations should be treated carefully. On Thursday, the company said it had not identified a recent change linked to the outage. Later it said it was reversing a network configuration change associated with the impact. On Friday, it ruled out signs of malicious activity, then connected the issue to an earlier network capacity upgrade and a more recent network change. Its revised status later described maintenance-related traffic shifts exposing a latent bug.
The FAA account also became more specific over time. Duffy initially blamed aging, overloaded telecommunications equipment, then described the router replacement during copper-to-fiber work. He said investigators had not determined whether the failure came from contractor error or faulty equipment. The five attacks were separate events, not evidence that the outages were attacks: the source account says they involved an exploited Outlook flaw, unpatched Check Point gateways, stolen vendor credentials affecting Uber driver data, a vendor’s vendor exposing Osaka users’ email addresses, and implants found in three Trezor wallets purchased from one reseller.
The review, published by ThorstenMeyerAI.com on November 15, says its incident details were checked against official pages and statements at 09:40 UTC Sunday. Its conclusions reflect the information available at that time, not completed investigations.
“Traffic shifts during standard network maintenance and upgrades exposed a latent bug in which our systems were unable to complete new connection requests.”
— Microsoft, in a revised service-status update
Final Outage Findings Are Pending
No evidence of an attack so far is not the same as a final ruling one out. The FAA’s written statement still said technicians were investigating, and Duffy said officials had not identified the precise fault. Contractor L3Harris said it was supporting the FAA investigation, according to the source account.
Microsoft had not yet issued its promised post-incident reports at the time of the review. Its account and incident start time had changed as investigators developed their explanation. It remains unclear whether the final report will add details or revise the preliminary root cause. The available information also does not establish that the two outages were connected to one another or to the five attacks.
Reports Will Test Current Explanations
The next major milestone is Microsoft’s post-incident reporting: the company said it expected a preliminary report within two business days and a final report within five. Those reports should provide more detail about the network bug, the maintenance and upgrade work, and the sequence that led to the outage.
The FAA and its contractor are continuing to investigate the router failure. A written FAA account and the findings of that inquiry may clarify whether the cause was a defective component, an error during the work, or another factor. Until those findings are available, the official explanation remains preliminary and the question of malicious activity remains under investigation rather than conclusively resolved.
Key Questions
Were the Microsoft and FAA outages confirmed cyberattacks?
No. Microsoft attributed its outage to a technical problem linked to network maintenance and upgrades. FAA officials said they had seen no evidence of a malicious cause, but the agency’s investigation was still open.
What caused the Microsoft 365 outage?
Microsoft’s revised preliminary account says traffic shifts during routine maintenance and upgrades exposed a latent bug that stopped some new connections from completing. The company had not yet released its final post-incident report as of November 15, 2026.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said a router was being replaced during work to move telecommunications lines from copper to fiber at a remote FAA site. He said officials had not determined whether contractor error or faulty equipment caused the router to flood others in the system.
Were there confirmed attacks during the same week?
Yes. The source account identifies five separate attacks, involving an exploited Outlook flaw, unpatched Check Point gateways, stolen supplier credentials, a vendor’s vendor, and implants found in three Trezor wallets. It does not present those incidents as connected to the two outages.
Could later reports change the current account?
Yes. The Microsoft and FAA explanations were not final at the time of the review. Their pending reports could add detail or revise the current understanding; no connection among the outages and attacks has been established in the information cited so far.
Source: ThorstenMeyerAI.com
