🔍 Read the full analysis: What Sparked This Week’s AI Outages And Breaches? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
As of 09:40 UTC on Nov. 15, officials and companies had attributed two major disruptions—a Microsoft 365 outage and a nationwide FAA ground stop—to technical or maintenance problems, with no evidence of an attack publicly identified. Five other incidents involved attacks or compromised supply chains, including an exploited Outlook flaw and stolen vendor credentials. Final reports on the outages are still pending.
A Microsoft 365 outage and a nationwide FAA ground stop disrupted services this week, while five separate security incidents involved attacks or compromised supply chains, according to company and government statements reviewed as of 09:40 UTC Sunday, Nov. 15. Microsoft and US officials said they had found no evidence that the two outages were caused by cyberattacks or artificial intelligence, but both investigations remain open and written reports are pending.
Microsoft 365 users, including people trying to reach Exchange Online mailboxes, experienced disruption from Thursday, Nov. 12, into Friday. Microsoft’s explanation changed as its investigation progressed. It initially said it had not identified a recent change correlated with the impact, then reported it was reverting a network configuration change. On Friday, the company said the incident was a technical issue unrelated to cyber activity or AI agents. In a later status update, Microsoft attributed the problem preliminarily to traffic shifts during standard network maintenance and upgrades exposing a latent bug that prevented some new connection requests from completing.
The FAA ground stop began Friday, Nov. 13, and lasted about four hours and 23 minutes, based on the FAA’s published event times. Transportation Secretary Sean Duffy said a contractor was carrying out routine work to move telecommunications lines from copper to fiber at a remote FAA site. He said a router being replaced either malfunctioned or was affected by contractor error, flooding other routers in the air traffic control system. FAA Administrator Bryan Bedford said officials had found no evidence of anything nefarious or AI-related. The FAA’s written statement, as of Sunday morning, said technicians were investigating.
The other five incidents were described as distinct security events, not causes of the two outages. Microsoft and the Cybersecurity and Infrastructure Security Agency listed an Outlook flaw as exploited; attackers also breached unpatched Check Point gateways. Separate incidents involved Uber driver data accessed using a vendor’s stolen credentials, Osaka users’ email addresses obtained through a vendor’s vendor, and three Trezor wallets purchased from one reseller that were found to contain implants. The source account does not provide further details on the scope or timing of each of those five events.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Two Outages, Five Security Incidents
The incidents involved different reported causes. Company and government statements attributed the Microsoft and FAA disruptions to maintenance or network issues, while the other reported incidents involved known vulnerabilities, stolen credentials and vendor relationships. The available information does not establish a connection between the outages and the security incidents.
The incidents involved infrastructure work and security compromises affecting third-party relationships. The source account recommends treating infrastructure changes as potentially disruptive, assessing vendors and their subcontractors, and communicating what is known and what remains under investigation. These are recommendations drawn from the reported cases, not findings about the exposure of all organizations.
Popular right now
Ninja Foodi Smart 6-in-1 Indoor Grill and Air Fryer, 4 qt, FG551
De’Longhi La Specialista Touch Semi-Automatic Espresso Machine with Grinder
Dyson Ball Animal 2 Upright Corded Vacuum Cleaner, Fuchsia
As an affiliate, we earn on qualifying purchases.
How the Explanations Changed
Microsoft’s public account developed over several status updates. On Thursday it said it had not identified a recent change connected to the start of the impact. Later, it said it was reverting a network configuration change that correlated with the disruption. On Friday, Microsoft said the issue was technical and not related to cyber activity or AI. A subsequent edit to the status record added the preliminary explanation involving traffic shifts during maintenance and upgrades that exposed a latent bug. The revised status also moved the stated start time from 10:05 UTC to 16:20 UTC on Thursday; the stated end time remained 16:10 UTC Friday.
The FAA account also became more specific over time. Duffy initially blamed old, overloaded telecommunications equipment. On Saturday, he described the copper-to-fiber work and router failure or contractor error as possible causes, while saying the precise fault had not been determined. The FAA’s public written statement had not yet offered a detailed cause. These shifts show why early explanations should be treated as preliminary, especially while investigations continue.
““traffic shifts during standard network maintenance and upgrades exposed a latent bug in which our systems were unable to complete new connection requests””
— Microsoft, in its updated service status
Final Causes Still Under Review
Neither major outage has a final public post-incident account in the source material. Microsoft said it planned to issue a preliminary report within two business days and a final report within five business days. The FAA had not published a detailed written account by Sunday morning, and Duffy said officials had not determined whether the router problem came from contractor error or faulty equipment.
Officials’ statements that they had found no evidence of an attack describe the evidence available at that point; they do not establish that every possibility has been ruled out. Mullin explicitly said officials were still looking. It is also unclear from the source material how many users or flights were affected beyond the reported service disruption and nationwide ground stop, and it gives no detailed impact figures for the five security incidents. The source account says those five were confirmed attacks or compromises, but does not supply the underlying statements or full case details for each.
Reports and Investigations to Come
The next major updates are the promised Microsoft incident reports and a fuller written account from the FAA. Those reports may clarify the technical sequence, the exact failure points and whether investigators change or refine their preliminary explanations. The FAA and its contractor, L3Harris, were still working to understand the conditions behind the ground stop; L3Harris said it was supporting the FAA’s investigation.
For the security incidents, the source material does not identify a common investigation, a shared actor or a coordinated campaign. Further reporting would need to establish the scale of affected data and systems, whether access was contained, and what affected companies and agencies have told users. Until those details and the outage reports are published, the available account is that the two major disruptions were attributed to technical problems, while five other incidents involved separate security compromises.
Key Questions
Were the Microsoft 365 outage and FAA ground stop cyberattacks?
As of Nov. 15, Microsoft described its outage as a technical problem, and FAA Administrator Bryan Bedford said officials had found no evidence of a nefarious act. The investigations were still open, so these statements are not the same as final reports ruling out every possibility.
What did Microsoft say caused its outage?
Microsoft’s preliminary explanation was that traffic shifts during routine network maintenance and upgrades exposed a latent bug that kept systems from completing some new connection requests. The company said a post-incident report was forthcoming.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said the disruption followed work to move telecommunications lines from copper to fiber at a remote FAA site. He said a router either failed or was affected by contractor error, but officials had not determined the precise fault.
Were the five security incidents connected to the outages?
The source material describes the five incidents separately and does not report a connection to either outage. They involved an exploited Outlook flaw, unpatched Check Point gateways, stolen vendor credentials, a vendor’s vendor, and implanted Trezor wallets.
When will investigators provide more information?
Microsoft said it planned a preliminary report within two business days and a final report within five business days. The FAA had not published a detailed written account by Sunday morning, and its investigation with L3Harris was ongoing.
Source: ThorstenMeyerAI.com
