Britain's offices will open on Friday 13 November to a tech headache that apparently ctrl-alt-del can’t fix. A Microsoft 365 failure that started at about 6.26pm GMT on Thursday was still not fully fixed as the working day began, after Microsoft conceded overnight that its repairs were "not taking as expected".
“We are encountering issues with the machines being stuck in a bad state, preventing our changes from syncing as expected,” the tech giant said a short time ago. “We’ll continue to monitor the effectiveness of changes applied so we can determine what refinements are necessary”.
Outlook, Teams, SharePoint, Copilot and the Defender XDR security console are all on Microsoft's list of affected services. Outage tracker Downdetector logged a peak of more than 138,000 Outlook problem reports worldwide shortly after 1pm US Eastern time yesterday.
Microsoft says there is no indication of a cyber attack, but police forces and security organisations like Australia’s CSIRO have been hit. It has traced the fault to a process on its servers that sets up secure connections, which became overloaded and stopped them handling requests, and it has begun rolling back a network configuration change that coincided with the start of the trouble. IT teams can track progress under incidents EX1550543 and MO1550821 on the Microsoft 365 service status page.
By the early hours of Friday UK time, Microsoft was reporting only partial progress. Its latest update said it had seen some recovery in regions where it had adjusted traffic protocols, redistributed traffic and blocked certain types of traffic, but that those steps weren't producing a sustained recovery, and it was looking at what else it could do to stabilise its infrastructure. It has not given a time for full restoration.
The servers will come back. The messier clean-up may be human. In Australia, where the failure hit at the start of Friday's working day, ING told customers to expect fraudsters offering to fix their Microsoft problems and warned them not to let anyone onto their devices without checking through a publicly listed number. The Customer Owned Banking Association added that criminals tend to switch to the phone when email goes dark, and may keep posing as IT support long after services return.
Read next: Banks warn of outage scams as Microsoft narrows in on fault
There is no reason to think UK businesses are any less exposed. When staff can't email their IT helpdesk, a call from "Microsoft" sounds helpful rather than suspicious. When suppliers start sending messages from personal addresses because their own email is down, a note saying bank details have changed looks perfectly normal.
There have also been multiple warnings of staff turning to using unprotected devices and mail systems, leaving clients wide open to risk.
UK Finance's Annual Fraud Report 2026 put authorised push payment (APP) fraud losses at £576.4m in 2025, up 19% on the year, across 248,070 cases. Around 17% of those cases started over telecoms networks, and banks reimbursed £354.3m, roughly 61% of losses.
That reimbursement figure can lull business clients into a false sense of security. The mandatory APP reimbursement regime, which took effect on 7 October 2024 for Faster Payments and CHAPS transfers, protects consumers, micro-enterprises and charities, and is capped at £85,000 per claim. A mid-sized firm that pays a fake supplier invoice is generally on its own, unless its insurance picks up the loss.
Read next: Phone scams cause 28% of APP fraud losses. A client's crime policy needs the right wording
Social engineering and funds transfer fraud cover is often sublimited well below a cyber policy's headline limit, sometimes sold as an optional extension, and sometimes sits in a crime policy rather than the cyber wording at all. Some wordings only respond if a system was actually compromised, which may not help a client whose employee was talked into paying a redirected invoice. A client who let a fake technician take remote control of a laptop could be in a different position, because that may count as a network security event. How either scenario plays out depends on the wording.
The outage itself may struggle to get through the door. Joe Hershewe, claims practice leader at Bellrock Advisory in Sydney, told Insurance Business that most cyber policies need an actual or suspected breach to engage, and that most firms caught up in this event are "unlikely to meet that threshold", as IB reported in its analysis of why the Microsoft outage misses the trigger in most cyber policies.
Where a policy does extend to system failure at a third party, waiting periods decide a lot. Time excesses of eight to 24 hours are common and dependent business interruption sublimits are often a fraction of the main limit, as UK brokers pointed out when a Google Cloud power failure took UK banks, retailers and public services offline at the same time in October. The timing of this failure helps many UK firms: it began after most offices had closed on Thursday, so the hours lost were largely overnight. Businesses that trade around the clock, run online sales or serve clients in other time zones may have racked up more.
Contingent business interruption made up about 15% of the value of Allianz Commercial's cyber claims above €1m in the first half of 2025, up from 6% in 2024, as IB has reported in its coverage of cloud concentration risk in the Microsoft 365 outage.
UK exposure to this kind of failure is wide. A July 2026 report from the Cyber Monitoring Centre and Parametrix found that more than 60% of UK companies depend on cloud services for critical functions, and that 80% of UK organisations using the cloud rely on AWS, Microsoft Azure or Google Cloud. Underwriters are well aware of it, and the London market is already debating whether broad dependency cover needs tighter limits, for example by restricting dependent business interruption to a client's most critical vendors.
The detail of this outage matters too. It hit Microsoft 365, a software service, rather than Azure's underlying cloud capacity. Parametric cloud-outage products, such as the endorsement AIG launched with Parametrix for eligible US cyber clients in August, pay on triggers tied to specific services and regions, so whether an event like this one counts depends on what the product monitors.
Read next: £3.4M BI case highlights gaps in cover for upstream cyber disruption
Plenty of clients have no cyber policy to argue over. The government's Cyber Security Breaches Survey found that 47% of UK businesses hold some form of cyber insurance, which leaves roughly half relying on a package policy whose business interruption section usually needs physical damage and often carries a cyber exclusion.
The outage also creates another urgent risk. Staff who can't reach Outlook or Teams will improvise, forwarding client files to personal Gmail accounts, sharing documents over WhatsApp or pasting work into free AI chatbots because Copilot is down. Each of those moves takes data outside the controls the business told its insurer about at renewal.
That can turn into a separate incident in its own right. Under UK GDPR, a personal data breach that is likely to put people's rights and freedoms at risk has to be reported to the Information Commissioner's Office within 72 hours of the organisation becoming aware of it. And because some of Microsoft's own security tooling was on the affected list, some firms may have had less visibility than usual of what left the building while staff were working around the problem.
There is a basic resilience lesson here too. Some businesses found they could not log in to unrelated systems because their multi-factor authentication codes arrive by email. A continuity plan that moves staff from Outlook to Teams is little help when both run on the same infrastructure.
Read next: 'Got cyber policy, tick' already drives disputes, and AI could widen the gap
The immediate advice is simple. Clients should treat any unsolicited call from "Microsoft", an IT provider or a bank's "tech team" with suspicion for at least the next week or so, and ring back on a number they already hold before giving anyone access to a device. Any request to change payment or contact details should be confirmed by phone, using a known number, before money moves.
Clients should also keep a record of downtime, lost staff hours, missed orders and failed transactions in case a business interruption claim becomes possible, and find out whether any client or employee data moved to personal accounts or unapproved apps during the outage. If it did, the insurer should hear about it early rather than at renewal.
The renewal conversation writes itself. Brokers can check the social engineering and funds transfer fraud sublimits in each client's programme, whether that cover needs a system compromise to respond, how long the waiting period is on contingent business interruption, and whether a software-as-a-service provider like Microsoft counts as a dependent business or falls under an infrastructure exclusion.
Read next: UK businesses staying quiet on cyber incidents risk legal exposure – survey
Suspected fraud in England, Wales and Northern Ireland can be reported to Report Fraud, which replaced Action Fraud in December 2025, or on 0300 123 2040. In Scotland, contact Police Scotland on 101.
This story may be updated as Microsoft releases more details on the cause and duration of the outage.
