🔍 Read the full analysis: The Week’s AI Outages: What Caused Them And What Didn’t on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
As of 09:40 UTC on Nov. 15, Microsoft attributed its Microsoft 365 outage to traffic shifts during network maintenance exposing a latent bug, and US officials linked an FAA ground stop to a router problem during copper-to-fiber work. Officials said they had found no evidence of an attack in either outage, but investigations and written reports were pending. Five other incidents involved attacks or compromised products, according to the source report.
Microsoft’s Microsoft 365 outage and a nationwide FAA ground stop this week were attributed to technical problems during network work, not to cyberattacks, according to preliminary explanations from Microsoft and US officials. Those explanations remain subject to investigation, while five other incidents reviewed in a report by ThorstenMeyerAI.com involved confirmed attacks or compromised products—making it important to distinguish outages from security incidents rather than treat them as one wave of “AI chaos.”
Microsoft said its outage, which affected access to Exchange Online mailboxes from Nov. 12 to 13, followed traffic shifts during routine network maintenance and upgrades. The shifts exposed a latent bug that prevented systems from completing new connection requests, according to the company’s revised preliminary explanation. Microsoft’s status updates evolved during the incident: it first said it had not identified a related recent change, then reported it was reverting a network configuration change. It later said there was no indication of malicious activity and that the issue was not related to cyber activity or AI agents.
The FAA ground stop began at 3:54 p.m. Eastern on Nov. 13 and lasted about four hours and 23 minutes, based on the agency’s advisory times. Transportation Secretary Sean Duffy said a contractor was carrying out routine work to replace copper telecommunications lines with fiber at a remote FAA site. A router being replaced either malfunctioned or was affected by contractor error, he said, flooding other routers in the air traffic control system. Duffy said the exact fault had not been determined. FAA Administrator Bryan Bedford said officials saw no evidence of a malicious or AI-related cause.
The five other cases described in the source report were different kinds of security incidents: an Outlook flaw listed by Microsoft and CISA as exploited; intrusions into unpatched Check Point gateways; Uber driver data accessed using a vendor’s stolen credentials; Osaka users’ email addresses obtained through a vendor’s vendor; and three Trezor wallets purchased from one reseller that were found to contain implants. These events should not be confused with the causes currently given for the Microsoft and FAA disruptions.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Why Outage Causes Matter
The week’s incidents show why service disruption and cyber compromise need separate explanations. A large outage can prompt understandable security concerns, but the public evidence cited so far points to maintenance and equipment issues in the two most prominent disruptions. At the same time, the other incidents underline real exposure through known software flaws and third-party access.
For organizations that depend on cloud services, networks and vendors, the practical lesson is not that routine maintenance is inherently unsafe or that every outage signals an attack. Rather, changes to critical systems can create failure risks, and supply chains can extend beyond a company’s direct contractors. Clear incident statements should distinguish what investigators have found from what they have not yet ruled out.
Products Worth Considering
DJI Osmo 360 Road Cycling First-Person Combo Action Camera
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Samsung Odyssey G7 G75F 40-Inch WUHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How This Week’s Explanations Changed
The chronology matters because the first public account of an outage can change as responders gather evidence. Microsoft’s initial status update on Thursday said it had not identified a recent change correlated with the start of impact. Later that evening, the company said it was reverting a network configuration change. By Friday it had described a technical problem associated with a network capacity upgrade, and its status record was subsequently edited to identify maintenance-related traffic shifts and a latent bug as the preliminary root cause.
For the FAA incident, Duffy’s initial Friday explanation referred to old, overloaded telecommunications equipment. On Saturday, he described the copper-to-fiber work and router flooding in more detail, while acknowledging that investigators had not established whether the fault was contractor error or faulty equipment. The FAA’s written public statement still said technicians were investigating when the source report checked it Sunday morning.
The report’s account is based on official status pages, agency statements and public comments, with some details attributed to media reports. Its findings were checked at 09:40 UTC on Nov. 15; they represent the information available at that point, not final incident determinations.
““We see zero evidence of anything nefarious, and zero evidence of anything AI-related””
— FAA Administrator Bryan Bedford, according to CNN
Investigations Still Have Open Questions
Neither major incident has a final public root-cause report. Microsoft said it expected to issue a preliminary post-incident report within two business days and a final report within five business days. The company’s revised account is preliminary, and its status record’s timing changed: the start time was moved from 10:05 UTC to 16:20 UTC on Nov. 12, while the listed end time remained 16:10 UTC on Nov. 13.
The FAA’s precise failure mechanism also remains unsettled. Duffy described a router flooding other routers but said officials had not identified the fault. The agency’s written statement still said technicians were investigating, and L3Harris said it was supporting the FAA’s inquiry, according to the source report. Officials’ statements of no evidence of an attack describe what they had found at the time; they are not final proof that every possibility has been ruled out.
The report does not provide comparable technical detail or final findings for all five security incidents. The full scope of affected data, the investigations’ status and any further remediation were not established in the material provided.
Reports Will Test Early Findings
The next major milestones are the Microsoft post-incident reports and a written FAA account of the ground stop. Those documents may clarify the technical failure, the sequence of events, the extent of service impact and any steps taken to reduce the chance of recurrence. The FAA and L3Harris investigation may also establish whether the router issue resulted from equipment failure, contractor error or another cause.
Until those findings are published, the explanations should be treated as preliminary. Readers and organizations tracking the incidents can distinguish the known facts from speculation by following official status updates and agency statements, while watching for disclosures about the separate attacks and affected users.
Key Questions
Were the Microsoft and FAA outages caused by cyberattacks?
No evidence of an attack was reported for either disruption in the material checked on Nov. 15. Microsoft attributed its outage to a latent bug exposed during network maintenance; FAA and administration officials described a router problem during telecommunications work. Investigations were not complete.
What did Microsoft say caused the Microsoft 365 outage?
Microsoft’s revised preliminary explanation said traffic shifts during network maintenance and upgrades exposed a latent bug that stopped systems from completing new connection requests. A post-incident report was still pending.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said a router was being replaced during routine copper-to-fiber work at a remote FAA site and began flooding other routers. He said officials had not determined whether the fault involved contractor error or faulty equipment.
Were all seven incidents outages?
No. The source report describes two major service disruptions and five separate security incidents, including exploited software flaws, vendor credential compromise and wallets containing implants.
What evidence is still expected?
Microsoft said it planned to publish a preliminary report within two business days and a final report within five business days. A fuller written account from the FAA investigation was also still pending as of the report’s Nov. 15 check.
Source: ThorstenMeyerAI.com
