Microsoft Outage Spells Trouble for Global Businesses

Phil Muncaster investigates what we know so far, and the potential fallout for UK organisations

Waking up to an empty inbox might sound like the perfect start to a Friday, until you realise what’s actually happened. So it was for countless workers across the globe today after one of the most significant IT service outages of recent years. Although Outlook emails are starting to trickle in as of Friday afternoon (GMT), the financial and productivity impact will be felt by many businesses for some time to come.

As they assess the fallout, there may be valuable lessons to learn about concentration risk and business continuity.

What happened?

The problems appear to have started around 4pm on November 12, when Microsoft reported: “Users may be unable to access their mailbox using Outlook on the web, Outlook desktop (MAPI), Exchange ActiveSync (EAS), or REST-based connections, and email delivery may be delayed.” The outage soon snowballed to cover virtually all of Microsoft 365 (consumer and business) as well as Copilot, Defender, Intune and other services. Azure was unaffected.

“There is no indication this is the result of malicious or cyber activity” Microsoft

At the time of writing, users were still in the dark about the cause of the snafu. Microsoft initially shared that the issue stemmed from “elevated load”. It then added in a post on X: “We determined the elevated load isn’t driven by an increase in traffic, but by a number of servers being unexpectedly unavailable; straining the remaining infrastructure.” The firm later clarified that “there is no indication this is the result of malicious or cyber activity.”

Counting the cost

The impact of the outage has been felt most keenly in Australia, which suffered an entire day of lost productivity. Reports estimate that it could cost domestic businesses billions, with SMBs hit particularly hard due to the thin margins many operate on. In the UK, the loss of key productivity tools has been felt across multiple sectors, including courts, local government, GPs, pharmacies, schools, and police forces, according to reports.

The knock-on impact could stretch into next week as organisations try to make up for delays, backlogs and missed deadlines. It is often the immediate supplier that takes the reputational hit from customers in these circumstances rather than the underlying technology provider.

Managing the fallout

For IT and business leaders the outage has been another reminder of the risks of consolidating tech suppliers and becoming too operationally dependent on a single provider.

“This shows why insurers pay close attention to concentration risk” Ed Ventham

“It’s far too early to say what this will mean for claims, and businesses should be wary of anyone who says otherwise. What events like this do show is why insurers pay close attention to concentration risk,” explains Assured head of broking, Ed Ventham.

“When a single provider failure can affect thousands of organisations at once, it has widespread consequences for the entire industry, far beyond the scope of one organisation’s policy. For businesses, the immediate response is to understand their dependencies, keep a record of any disruption and costs, and talk to their broker about how their cover is structured before they need it.”

The incident should therefore be another nudge to revisit business continuity plans and ensure they’re fit for purpose.

Prepare for follow-on phishing attempts

Security teams should also be prepared for an influx of impersonation attacks attempting to capitalise on the outage, adds Assured CISO, Nick Harris.

“Criminals are very quick to exploit events like this” Nick Harris

“The outage itself may not be malicious, but criminals are very quick to exploit events like this. It has also affected some anti-phishing controls, so while people are spending more time in Teams, they should be extremely vigilant about messages from outside their organisation,” he says. “Attackers are also taking advantage through vishing, with evidence of phone calls claiming to be from Microsoft and asking for login details to restore access at work.”

Risk may be greatest once systems come back online and employees feel under pressure to clear inboxes quickly.

“That’s exactly when phishing works best,” Harris adds. “Organisations should warn staff now and remind them to slow down: no legitimate support team will call asking for your password, and anything asking you to log in, reset credentials or make a payment should be verified first. Make sure there’s an easy way to report anything suspicious.”

In an increasingly cloud-dependent economy, resilience is now the priority for regulators and governments. But much of the discussion focuses on withstanding and recovering from a serious cyber-attack. This outage is a reminder that business interruption can hit suddenly and unexpectedly. And it’s not always the fault of malicious actors.