🔍 Read the full analysis: AI Outages And Breaches: How Did The Week’s Problems Begin? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
As of 09:40 UTC on Nov. 15, officials and companies had attributed the Microsoft 365 outage and an FAA nationwide flight ground stop to technical and maintenance problems, with no evidence of an attack reported. Separately, five incidents were described as confirmed attacks involving a software flaw, unpatched systems, vendor credentials or tampered devices. Investigations and promised incident reports remain pending.
Microsoft’s Microsoft 365 outage and the FAA’s nationwide flight ground stop were attributed to network and maintenance problems, not a cyberattack, in explanations available Sunday, Nov. 15. A review of seven incidents reported during the week found five separate attacks involving software vulnerabilities, vendor access or tampered devices; the causes of the two outages are not yet settled pending further reports.
Microsoft’s service-health explanation changed as the outage unfolded. The company initially said it had not identified a recent change tied to the impact, then reported it was reverting a network configuration change. On Friday, Microsoft said the incident was a technical issue unrelated to cyber activity or AI agents. Its revised preliminary explanation, recorded in service-health copies by Sunday morning, said traffic shifts during network maintenance and upgrades exposed a latent bug that prevented systems from completing new connection requests.
The outage affected access to Exchange Online mailboxes and related services from Thursday, Nov. 12, into Friday, Nov. 13. Microsoft’s revised record moved the start time to 16:20 UTC on Thursday and kept the end time at 16:10 UTC Friday. The company said it would issue a preliminary post-incident report within two business days and a final report within five business days.
The FAA ground stop began at 3:54 p.m. Eastern on Friday and lasted about four hours and 23 minutes, based on FAA advisory times. Transportation Secretary Sean Duffy said a contractor was replacing telecommunications equipment as a remote site moved from copper lines to fiber. He said a router being replaced either malfunctioned or was involved in contractor error, flooding other routers in the air traffic control system. The specific fault has not been determined.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Why Outages and Attacks Differed
The incidents matter for different reasons. The Microsoft and FAA disruptions affected services relied on by large numbers of users and travelers, but the explanations available Sunday point to maintenance, network changes and equipment behavior, rather than an identified intrusion. That distinction matters for customers and organizations deciding whether to focus on service recovery, security response or both.
The five other incidents show separate ways attackers or unauthorized parties can gain access: an exploited Outlook flaw, unpatched Check Point gateways, credentials stolen from an Uber vendor, exposure of Osaka users’ email addresses through a vendor’s vendor, and three Trezor wallets bought from one reseller that were reported to contain implants. These cases do not establish a connection to either outage. Taken together, they underline why technical failures and security incidents need separate evidence-based explanations, even when they occur in the same week.
For organizations, the reporting also puts routine work and third-party dependencies in focus. Maintenance can trigger faults even without malicious activity, while vendors and their subcontractors can create routes to data or systems. The available accounts support those as practical areas of attention, but do not establish that any single measure would have prevented the reported events.
Products Worth Considering
Anker SOLIX C1000 Gen 2 Portable Power Station with 100W Solar Panel
Bose QuietComfort Wireless Noise-Cancelling Headphones, Cypress Green
Bose SoundLink Max Portable Bluetooth Speaker, IP67 Waterproof and Dustproof, Up to 20 Hours of Battery Life, Black
As an affiliate, we earn on qualifying purchases.
How the Explanations Changed
The Microsoft incident was first reported as an outage affecting mailbox access. Its public status updates developed over several hours: at 20:19 UTC Thursday, the company said it had not identified a recent change correlated with the impact; later, it said it had begun reverting a network configuration change. On Friday it said there was no indication of malicious activity, then described a technical issue unrelated to cyber activity or AI agents. By Sunday, the preliminary account had been edited to identify traffic shifts during standard maintenance and upgrades as the trigger that exposed a latent bug.
The FAA explanation also became more specific over time. On Friday evening, Duffy pointed to old, overloaded telecommunications equipment. On Saturday, he described the copper-to-fiber work and a router that began flooding others in the air traffic control system. FAA Administrator Bryan Bedford said officials saw no evidence of anything nefarious or AI-related. The FAA’s written statement, however, still said technicians were investigating.
The week’s other five incidents were reported as attacks or compromises, rather than service outages attributed to routine technical work. The source account says Microsoft and CISA listed an Outlook flaw as exploited, attackers accessed unpatched Check Point gateways, and the other cases involved vendor credentials, a vendor’s vendor, or implants in devices sold through one reseller. Those events should not be treated as evidence that the Microsoft or FAA outages were attacks.
“We see zero evidence of anything nefarious, and zero evidence of anything AI-related.”
— FAA Administrator Bryan Bedford, as quoted by CNN
What Investigators Still Need to Establish
Neither outage has a final public root-cause report. Microsoft’s explanation is preliminary, and its promised reports could add detail or revise the account. The source review says Microsoft edited its status record before Sunday; its record copies showed a last update at 05:09 UTC on Nov. 15. The company’s own post-incident analysis is still to come.
For the FAA incident, officials have described the maintenance work and the router’s effect on other equipment, but have not determined whether the fault was human error, defective equipment or another cause. The agency’s written statement remained unchanged at 09:37 UTC Sunday and said technicians were investigating. L3Harris said it was supporting that inquiry.
Officials’ statements that they had found no evidence of an attack do not amount to a final ruling that an attack was impossible. Mullin explicitly said the government was still looking and would not rule it out. The source material also does not provide detailed independent documentation for each of the five reported attacks, such as the full scope of affected records, the number of people affected or the exact dates of discovery.
Pending Reports and FAA Findings
Microsoft said its preliminary post-incident report was due within two business days and its final report within five business days. Those reports should provide a fuller account of the network changes, the latent bug, the outage timeline and any corrective steps. The company’s revised service-health account remains the latest explanation described in the Sunday review.
The FAA and L3Harris are continuing to investigate the router failure. The FAA has not yet published a detailed written account, and Duffy said officials had not established the specific fault. Further findings could clarify how the router affected the air traffic control network and whether the contractor’s work or equipment contributed.
Until those accounts are released, the best-supported distinction is that the two headline outages were publicly attributed to technical causes, while five other incidents were identified as attacks. That picture may change if the investigations produce new evidence; the available information does not establish a link between the outages and the separate compromises.
Key Questions
Were the Microsoft 365 outage and FAA ground stop cyberattacks?
No attack had been identified in the accounts available Sunday. Microsoft attributed its outage to a network issue, while FAA Administrator Bryan Bedford said officials saw no evidence of anything nefarious. Both investigations or post-incident reviews remained incomplete.
What did Microsoft say caused its outage?
Microsoft’s latest preliminary explanation said traffic shifts during network maintenance and upgrades exposed a latent bug, preventing new connection requests from completing. The company said a fuller post-incident report was forthcoming.
What caused the nationwide FAA ground stop?
Transportation Secretary Sean Duffy said a router began flooding other routers during a contractor’s work to replace telecommunications lines as a site moved from copper to fiber. Officials had not determined whether contractor error or faulty equipment caused the problem.
Were the five reported attacks connected to the outages?
The available reporting does not show a connection. The five incidents involved an exploited Outlook flaw, unpatched Check Point gateways, vendor-related access to data, or tampered devices. They were described as separate events from the Microsoft and FAA outages.
What information is expected next?
Microsoft said it planned to release a preliminary report within two business days and a final report within five business days. The FAA and L3Harris were still investigating the router incident, with no detailed written findings yet available in the account checked Sunday.
Source: ThorstenMeyerAI.com
