Last updated 6am ET, Friday, November 13
Canada has been caught squarely in the global Microsoft 365 outage that began on Thursday afternoon Eastern time, with hospitals, transit, governments and universities all losing email and, in some cases, Teams. Microsoft 365, the subscription suite that includes Outlook, Teams and the Copilot AI assistant, is used by more than 430 million people, and problems were reported in at least 74 countries.
More than 20,000 Canadian reports of problems with Microsoft platforms were logged on outage tracker Downdetector, and combined Outlook reports from Canada and the US hit nearly 150,000 at 1:30pm ET. They had eased to about 35,000 by late evening, but Canada saw a fresh spike of close to 6,700 reports after 9:30pm ET.
By early Friday there were signs of recovery, though not a fix. Around 5am ET, Microsoft said it was seeing early stabilization and capacity improvements and that recovery was progressing in phases, and some users reported getting their email back. It still had not given a time for full restoration. To stop messages being lost in the backlog, Microsoft said it was extending its email timeout window to 48 hours, which means mail sent during the outage should be held and delivered late rather than bounced.
Microsoft says there is no indication of a cyberattack. It has blamed a cascade in which some servers went offline unexpectedly and the remaining ones were overwhelmed by the extra load. Charles Lamanna, an executive vice-president at the company, said late Thursday that Microsoft regretted the disruption to customers. IT teams can follow incidents EX1550543 and MO1550821 on the Microsoft 365 service status page.
Hospitals. Unity Health Toronto, which runs St. Michael's Hospital among others, declared a code grey, the alert hospitals use for a loss or failure of infrastructure, after staff couldn't reliably send or receive email. The network stressed that patient and resident care wasn't affected and that its hospitals stayed open, but it told patients with urgent appointment questions to phone instead, and asked staff to use other channels for important information. The University Health Network said its email was temporarily unavailable, and staff at Sunnybrook reported the same problem. In Montreal, the Centre hospitalier de l'Université de Montréal said appointment requests and some operations were delayed, and the Jewish General Hospital was also affected.
Transport. Via Rail warned that passengers might not receive email confirmations or trip updates, and pointed them to its online train tracker and SMS alerts. The trains kept running: unlike the 2024 CrowdStrike failure, which grounded flights around the world, this outage hit email and collaboration tools rather than operational systems.
Governments and courts. Some federal departments reported trouble getting into email and meetings, though it was unclear whether any public services were affected. The City of Toronto warned that some services might be unavailable or delayed, and courts in Alberta were among those across North America that posted notices about delayed communications.
Universities and business. Post-secondary institutions in Toronto and elsewhere reported disruption to staff and student email. For many offices, the outage hit on Thursday afternoon and was still unresolved overnight, leaving Friday morning's inboxes in doubt.
Read next: IBC flags AI and shared tech as new cyber risks as Canada's market stabilizes
The disruption is temporary. Some of what staff did to work around it may not be.
When email stops, people with deadlines find another way: a personal Gmail account, a text thread, WhatsApp, a free file-sharing link. Security specialists call this shadow IT, and experts in several countries have warned throughout the outage that it can turn an availability problem into a privacy one. A clinic administrator who forwards patient details to a personal address, or a claims handler who sends a client file over a messaging app, may breach company policy and privacy obligations without meaning to.
In Canada, that matters. Under federal private-sector privacy law, organizations must report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner and notify the people affected. Quebec has its own regime for confidentiality incidents, and provinces such as Ontario have separate rules for personal health information. Whether a given workaround crosses those lines will depend on what was shared, with whom and how, which is exactly why employers need to find out.
Fraud is the other worry. Banks in several countries have warned customers that scammers may pose as Microsoft or IT support offering to fix the problem, or send fake password-reset and "restore your account" messages as email comes back. Staff should verify any such request through a separate, known channel before clicking a link, handing over credentials or approving a payment, and treat unexpected calls from anyone claiming to be Microsoft with suspicion. Suspected fraud can be reported to the Canadian Anti-Fraud Centre.
Some users reported being locked out of unrelated business systems as well, because their multifactor authentication codes are sent by email. And Microsoft listed its own Defender XDR security product among the affected services, which means some security teams had less visibility than usual while staff improvised.
Read next: AI cyber liability risk is outpacing the coverage you think you have
For Canadian brokers, the outage arrives less than a month after the Insurance Bureau of Canada flagged shared technology as an emerging cyber risk. It turns a familiar piece of advice into a live test: know which cloud, software and AI providers each client depends on, and whether their policy responds to an outage at one of them.
I think we've been almost waiting for something like this to happen,” Jennifer Clancy an advisor for cyber risk told Insurance Business.
“What events like this do show is why insurers pay close attention to concentration risk,” said Ed Ventham, co-founder and director of UK cyber broker Assured. “When a single provider failure can affect thousands of organizations at once, it has widespread consequences for the entire industry, far beyond the scope of one organization’s policy.”
The first question for insurance brokers is whether anything triggers. Many cyber policies only pay for business interruption caused by a security failure, and Microsoft says this wasn't one. Cover for non-malicious system failure, or contingent business interruption that extends to an outage at a cloud or software provider, is where any claim would sit, and wordings differ on whether a software-as-a-service provider counts as a covered dependency. "I think most people impacted by this are unlikely to meet that threshold,” Joe Hershewe, the claims practice leader at Bellrock Advisory told Insurance Business.
Ventham said it was “far too early to say what this will mean for claims, and businesses should be wary of anyone who says otherwise.”
The second is time. Contingent business interruption cover usually carries a waiting period, often eight hours or more, and sublimits well below the main limit. This outage has run far longer than that, but for most Canadian offices it began on Thursday afternoon, so the working hours actually lost may be fewer than the headline duration suggests.
The third is the employee exposure. A privacy breach through a personal account, or a payment sent to a fraudster posing as IT support, could fall under privacy liability, regulatory cover, social engineering or funds transfer fraud cover, which is often sublimited, or a crime policy, depending on how a client's program is built.
For federally regulated insurers themselves, there is a supervisory angle. OSFI's Guideline B-10 on third-party risk management has applied since May 2024, and its Guideline E-21 on operational risk and resilience expects institutions to be able to prepare for, absorb and recover from severe disruptions. An outage at a provider as widely used as Microsoft is the kind of event those guidelines were written for, and insurers can expect questions about how their own critical operations held up.
Read next: When someone else's outage becomes your claim
Encourage clients to keep a simple log of when systems failed, what workarounds staff used and when service returned. It will matter for any business interruption claim and for any privacy regulator asking questions later. Ask them to check whether client, patient or financial data moved to personal accounts or unapproved apps during the outage, and to notify their insurer early if it did. And remind them that any request over the next week or so to change payment details or share login credentials deserves a call-back on a known number.
At renewal, the outage gives brokers a ready-made case study for reviewing contingent business interruption wording, waiting periods and sublimits, social engineering limits, and whether a client's multifactor authentication and continuity plans depend on the same provider that just failed.
Read next: BOXX Insurance adds affirmative AI and deepfake coverage to Cyberboxx Business policy
