Microsoft Is Down. Attackers Aren't.

Status, correct at time of writing (09:30 GMT, Friday 13 November 2026): Microsoft reports partial recovery across regions, but the fix has not held consistently and no time has been given for full restoration. We will update this post as the situation changes.

Since Thursday evening, a global Microsoft 365 outage has cut organisations off from Outlook, Teams, SharePoint and Copilot. Microsoft says it was not a cyber attack. That is true, and it is also beside the point: attackers do not need to cause an outage to profit from one.

For security teams, the risk is not only the hours of lost email. It is what changes on your external attack surface while everyone is scrambling, and what gets left behind once service returns. This post covers what happened, why outages are an opportunity for attackers, and what to check from the outside before they do.

What Happened: The Outage In Numbers

Started: Thursday 12 November, early evening UK time (shortly before 1pm US Eastern)
Duration: More than 15 hours by Friday morning, still not fully resolved
Incident ID: EX1550543 (Exchange Online)
Scope: Global. Microsoft confirmed it could affect users "in any region"
Services hit: Exchange Online (Outlook on web, desktop and mobile), Teams, SharePoint Online, Copilot, Defender for Office 365, Defender XDR, Planner, To Do, Intune
Peak reports: Nearly 130,000 Outlook reports and more than 45,000 Microsoft 365 reports on Downdetector
Cause: A process on the affected servers that establishes secure connections became overwhelmed, so servers stopped processing requests
Malicious activity: None, according to Microsoft

Why It Matters For Security

A security control was degraded. Microsoft warned that Defender for Office 365 Safe Links may be unable to verify URLs, which could affect users clicking links in Outlook and Teams. Link checking was weakened at the same time as users were most confused.

Recovery has been unstable. Servers that Microsoft returned to service became unresponsive again once they received traffic. That means a longer window of disruption, and more time for workarounds to spread.

The impact went well beyond inboxes. In the UK, the government said it was working closely with Microsoft to assess the impact on government services. In Australia, where the outage hit during the working day, courts lost live feeds and schools asked parents to phone in absences.

Not The First Time This Year

This is at least the seventh notable Microsoft service incident of 2026:

22 to 23 January: Microsoft 365 outage. Nearly 10 hours, Outlook and multiple services.
24 April: Azure East US multi-service incident. Around 13.5 hours.
29 May: Azure and Copilot degradation. Azure and consumer services.
23 July: West US network failure. Azure, Teams, SharePoint, OneDrive.
Late August: Outlook mailbox access issues. Thousands of users worldwide.
9 November: Outlook on the web mailbox access. EMEA, around 4.5 hours.
12 to 13 November: Exchange Online and Microsoft 365. Global, 15+ hours and counting.

The lesson is not that Microsoft is unreliable. Every large provider has outages. The lesson is that outages are now a predictable, recurring event, and most organisations plan for them as a business continuity problem only. They are also a security event, because of what people do when the tools they rely on disappear.

Why An Outage Is An Attacker's Opportunity

An outage is not a breach. But it creates the exact conditions attackers look for:

Expectation. Users are waiting for "service restored, please sign in again" messages. A fake one looks normal.
Broken channels. When staff cannot email their IT team, an unexpected call from "Microsoft" or "IT support" sounds helpful rather than suspicious.
Weakened controls. With Safe Links degraded, malicious links are less likely to be caught.
Workarounds. People and IT teams improvise to keep working, and improvised changes rarely go through security review.

This is already playing out. Banks including ING have warned customers to expect fraudsters offering to fix their Microsoft problems, and Australia's Customer Owned Banking Association warned that scammers often switch to phone-based "vishing" while email is down.

Most advice so far focuses on the human side: do not trust the call, do not click the link. That advice is right. But it misses where the risk is created, which is on the internet, outside your network, often before a single email or call reaches your staff.

Four Ways Your Attack Surface Grows During An Outage

This is how an outage looks from the outside, the view attackers have and the view DarkInvader monitors.

[Editor note: add DarkInvader first-party data here before publishing, for example the number of Microsoft or Outlook-themed lookalike domains seen since 12 November, or the share of monitored organisations with DNS or MX changes in the last 48 hours.]

1. Lookalike Domains And Fake Login Pages

Phishing campaigns need infrastructure: a domain, a TLS certificate and a page that looks like a Microsoft sign-in or a "mailbox recovery" portal. Expect lures built around words like outlook, 365, restore and recovery, and lures that impersonate your own brand or IT team ("yourcompany-itsupport").

From the outside: newly registered lookalike domains and new certificates are often visible before the first phishing email is sent. That is your chance to block or take them down early.

How DarkInvader helps: lookalike domain detection, logo and impersonation monitoring, and takedown handling.

2. Emergency Shadow IT

When Outlook and Teams stop working, people do not stop working. They switch to personal Gmail, WhatsApp groups, free video calls, public file-sharing links and new SaaS trials signed up with work email addresses. Company data ends up outside your tenant, your logging and your controls, and most of it stays there after the outage ends.

From the outside: new SaaS footprints, public share links and accounts tied to your domain that IT never approved.

How DarkInvader helps: asset and shadow IT discovery across domains, cloud services and SaaS.

3. "Temporary" Infrastructure Changes

IT teams under pressure make quick fixes: backup MX records pointing to another mail service, SMTP relays, firewall rules opened for a fallback route, or old on-premises or hybrid Exchange servers brought back online. On-premises Exchange has a long history of being heavily targeted, so a forgotten server reconnected in a hurry is a serious exposure.

From the outside: DNS and MX changes, newly exposed services and new open ports.

How DarkInvader helps: DNS and MX change monitoring, the "What's Changed" report, vulnerability scanning and exploited vulnerability intelligence.

4. Credentials That Surface Later

If anyone entered their password into a fake recovery page, or let a fake support caller onto their device, the damage may not show for days or weeks. Stolen credentials and infostealer logs end up for sale on dark web markets and Telegram channels.

From the outside: your domain's credentials appearing in breach data and stealer logs.

How DarkInvader helps: leaked credential alerts, stealer-log monitoring, dark web and Telegram monitoring.

Your Post-Outage Checklist

Do Today

Warn staff. Microsoft will not phone them, ask for their password or ask for remote access. Verify any "support" contact using a number you already hold.
Name one official channel for IT updates until service is fully restored.
Check for new lookalike domains of your brand, and Microsoft-themed domains targeting your staff, registered since 12 November.
Log every workaround as it happens: who set up what, where, and why.

Do Next Week

Review DNS changes since 12 November, especially MX and SPF records and new subdomains. Roll back anything temporary.
Close emergency exposure. Review firewall rules, remote access and any servers brought back online during the outage.
Retire shadow IT. Find personal accounts, public share links and new SaaS trials, and bring the data back.
Watch for leaked credentials on your domain, and reset passwords for anyone who responded to a suspicious prompt or call.
Compare your attack surface today with how it looked on Wednesday 11 November. Anything new needs an owner or needs removing.
Run a tabletop exercise: "Exchange is down for 15 hours. What do we do, and what do we open up?"

Frequently Asked Questions

Was The Microsoft Outage A Cyber Attack?

No. Microsoft says there is no indication of malicious activity. The cause was a process on its servers that establishes secure connections becoming overwhelmed, which stopped the servers processing requests.

Is My Data At Risk Because Of The Outage?

The outage itself is not a data breach. The risk comes from what happens around it: phishing and phone scams, staff moving data to unapproved tools, and temporary changes that expose systems to the internet.

What Scams Should I Watch For?

Unsolicited calls from "Microsoft" or "IT support", emails or texts asking you to re-verify your mailbox, fake service status pages, and offers of remote help to fix Outlook.

How Long Will Outage Scams Last?

Well beyond the outage. Criminals often keep posing as technical support in the aftermath, so treat unsolicited support contact with suspicion for at least the next week.

How Does External Attack Surface Management Help?

External Attack Surface Management (EASM) continuously discovers and monitors everything your organisation exposes to the internet, from domains and DNS records to cloud services and leaked credentials. After an outage, it shows exactly what changed and what new exposure an attacker could find.

See What Hackers See

Outages end. The lookalike domains, shadow IT, temporary DNS changes and leaked credentials they leave behind do not end on their own.

Do you know your own attack surface? DarkInvader continuously maps your external attack surface and monitors the dark web, so you can see what changed while everyone was looking the other way.

Find out what's already exposed. Start your free trial.