Last updated 6:30am ET, Friday, November 13
A Microsoft 365 outage that began early Thursday afternoon Eastern time was still unresolved in the early hours of Friday, knocking out email and internal messaging at public agencies, healthcare providers and businesses across North America and much of the world.
Users started reporting problems shortly after noon ET on Thursday, and Microsoft opened its incident at about 1:26pm ET. By 1:30pm ET, combined reports of Outlook problems from the US and Canada on outage tracker Downdetector had climbed to nearly 150,000, and they were still running above 35,000 at 9:30pm ET. By early Friday, Microsoft said it was seeing positive results from a patch to part of its infrastructure but gave no timeline for full recovery, and warned that users might still be unable to connect to Outlook on the web or desktop.
Microsoft says the outage was not caused by a cyberattack. It has blamed a cascade in which some servers went offline unexpectedly and the remaining ones were overwhelmed by the extra load. Business customers can follow incidents EX1550543 and MO1550821 on the Microsoft 365 service status page.
Government and justice. Some of the most visible disruption was in the public sector. In Colorado, the Arapahoe County Sheriff's Office said jail staff weren't receiving the email notifications they need to process online bond payments, so anyone posting bond had to do it in person at the detention facility. Michigan's Department of Technology, Management and Budget warned that some state operations were affected and email replies could be delayed. In New Mexico, state and local government offices, hospitals, colleges and two utilities were reported to be affected, while the cities of Pasadena, Fremont, Burbank and Santa Barbara in California all warned residents that email was down. Courts from Los Angeles to Texas and Alberta posted notices that communications could be delayed, and the Los Angeles County Medical Examiner's Office was among the agencies that lost email.
Overseas, Japan's government said its shared IT platform had been disrupted, and the Philippines Supreme Court and Singapore's courts warned of email delays. Australia’s security body ASIO was affected as were the Federal Police. “I think we've been almost waiting for something like this to happen,” Jennifer Clancy an advisor for cyber risk told Insurance Business. “I think cyber insurance has been talking about these events that have just been on the horizon for a very long time.”
Hospitals. Healthcare providers lost email rather than clinical systems, but the strain still showed. Hospitals across Canada reported disruption, and Toronto's St. Michael's Hospital declared a "code grey", the alert hospitals use when critical infrastructure fails. In the UK, the NHS said some services were affected but told patients to attend appointments as normal, and in Australia, Queensland Health said there had been no known clinical impact.
Airlines. Unlike the 2024 CrowdStrike failure, which grounded flights worldwide, this outage did not stop planes. The impact was on customer service. India's largest carrier, IndiGo, said its email support had been disrupted and pointed travelers to other channels, while Air India said its flight operations were unaffected but rerouted its email so customer queries kept coming through. No major airline, bank or payment system failures had been linked to the outage as of Thursday evening.
Business. At least one publicly traded company postponed an investor event, telling shareholders the rescheduling was due to business disruption from the outage.
For risk managers, the outage itself may turn out to be the smaller problem. Security experts have been warning that the way employees respond to a day without email can create exposures that outlast it.
The first is shadow IT. When the approved tools stop working, people under deadline pressure reach for whatever does: personal Gmail accounts, consumer messaging apps, home laptops, free file-sharing sites.
Swinburne University of Technology associate professor Ali Yavari, speaking in Australia, singled this out as the bigger concern. An employee who forwards a patient record, client file or payroll spreadsheet to a personal account to hit a deadline may breach company policy, privacy law or a contractual confidentiality duty without realizing it. For US healthcare providers, a protected health information disclosure could also raise questions under HIPAA.
The second is social engineering. Banks have already warned customers that fraudsters may pose as Microsoft or IT support offering to fix the problem, or send fake password-reset and "restore your account" messages once email comes back. Employees anxious to get back to work are exactly the audience those messages are written for. Staff should verify any outage-related request through a separate, known channel before clicking, sharing credentials or approving a payment,, and should treat any unexpected call from someone claiming to be from Microsoft with suspicion.
The third is less obvious: authentication that depends on the system it protects. In Australia, some users found they couldn't get into unrelated business apps because their multifactor codes arrived by email. Security teams also lost visibility, because Microsoft listed its Defender XDR security product among the affected services.
Read next: Microsoft's Friday 13th outage continues with fraud and employee risk warnings
For US brokers, the outage raises three coverage questions.
The first is whether anything triggers at all. Many cyber policies only respond to business interruption caused by a security failure, and Microsoft has been clear this wasn't an attack. Policies that extend to non-malicious system failure, or that add contingent business interruption for outages at a cloud or software provider, are the ones in play, and wordings vary on whether a software-as-a-service provider counts as a covered dependency. IB has looked at how a third-party outage can become your client's claim and why the answer usually comes down to policy language. “Normally you need what's called an actual or suspected breach to get into the policy. I think most people impacted by this are unlikely to meet that threshold,” said Joe Hershewe, claims practice leader at Bellrock Advisory in Sydney told Insurance Business.
Ed Ventham, co-founder and director of UK cyber broker Assured, said it was “far too early to say what this will mean for claims, and businesses should be wary of anyone who says otherwise.”
The second is time. Contingent business interruption cover typically carries a waiting period, often eight hours or more, plus sublimits well below the main limit. This outage has comfortably run past eight hours, but for many US businesses it started on Thursday afternoon, so the working hours actually lost may be fewer than the headline duration suggests. Clients with round-the-clock operations, online sales or customers in other time zones may be closer to the line.
The third is the follow-on exposure from employees. A data disclosure through a personal account, or a payment sent to a fraudster posing as IT support, could land on very different parts of a client's program: privacy liability, regulatory cover, social engineering or funds transfer fraud cover, which is often sublimited, or a crime policy. Healthcare clients will want to check how their policies respond to a HIPAA-related disclosure that happened outside any breach of their own systems.
Read next: Third-party cyber attacks put spotlight on contingent business interruption coverage
The practical advice is simple. Encourage clients to keep a log of when systems failed, what workarounds staff used and when service came back, which will matter for any business interruption claim and for any regulator asking questions later. Ask them to find out whether client, patient or financial data moved to personal accounts or unapproved apps during the outage, and to notify their insurer early if it did. And remind them that any request to change payment details or share credentials over the next week or so deserves a call-back on a known number.
“What events like this do show is why insurers pay close attention to concentration risk,” Ventham said. “When a single provider failure can affect thousands of organizations at once, it has widespread consequences for the entire industry, far beyond the scope of one organization’s policy.”
At renewal, the outage gives brokers a ready-made case study for reviewing contingent business interruption wording, waiting periods and sublimits, social engineering limits, and whether a client's multifactor authentication and continuity plans depend on the same provider that just failed.
Read next: Microsoft email, Teams goes out globally, puts cloud concentration risk back on brokers' radar
