Microsoft 365 Outage Phishing: What to Watch For After the 12–13 November Disruption
CyberRank Research
The Microsoft 365 outage that began on 12 November 2026 was, according to Microsoft, not caused by malicious activity, but it has opened a window for outage-themed phishing: fake "mailbox restored" emails, fake IT support calls and messages that impersonate your vendors. Banks and security firms warned about these scams while the outage was still running, because employees clearing a day's backlog are primed to trust anything that looks like Microsoft or a familiar supplier. CyberRank helps you see which of your vendors have weak email authentication or leaked credentials, the two weaknesses that make phishing in a vendor's name easier.
TL;DR
- From about 16:00 UTC on 12 November, Exchange Online, Outlook, Teams, SharePoint, Copilot and Defender XDR were disrupted worldwide; recovery was still partial on 13 November.
- Microsoft said it found no indication of malicious activity. The outage is not a breach, but it is a phishing opportunity.
- Expect lures that ask you to "re-activate" a mailbox, re-verify an account, call IT support, or send payment to "new bank details" while a vendor's email is down.
- Never sign in through a link about the outage; check status.cloud.microsoft or your admin center directly.
- CyberRank shows each vendor's email security (DKIM/DMARC) and leaked-credential findings, so you know whose messages deserve extra checks.
What happened on 12–13 November
On Thursday 12 November 2026, users in many regions lost access to Outlook mailboxes and to Microsoft 365 services that depend on Exchange Online. Microsoft tracked the incident in its admin center as EX1550543 (Exchange Online) and MO1550821 (the wider suite).
Last updated: Sat 14 Nov 2026, 09:00 WIB. Microsoft's investigation is ongoing; this article is updated as it publishes new information.
| Time (UTC) | What happened |
|---|---|
| 12 Nov, ~16:17 | What happenedExchange Online incident EX1550543 opens: users cannot reach mailboxes through several connection methods |
| 12 Nov, ~18:26 | What happenedSuite-wide incident MO1550821 opens: users may be unable to connect to multiple Microsoft 365 services |
| 12 Nov, evening | What happenedMicrosoft says servers are failing automated health checks and becoming unavailable, which pushes load onto the remaining servers |
| 13 Nov, 04:11 and 05:46 | What happenedMicrosoft says it has "no indication" of malicious activity, then that it is "not aware of any" |
| 13 Nov, morning | What happenedPartial recovery after a routing and authentication fix; some restarted servers fail again when traffic returns; email timeout extended to 48 hours |
Which services were affected?
According to Microsoft's service status page and its updates on X, the affected list grew during the incident and included Teams, SharePoint Online, Microsoft 365 Copilot, Intune, Purview, Defender XDR and Defender for Office 365. Outage reports came from dozens of countries; Indonesian impact had not been widely reported at the time of writing.
How CyberRank helps: an outage at a shared provider is a third-party risk event for you and for most of your vendors at the same time.
Was it a cyberattack?
Microsoft has said it found no indication that the outage was caused by malicious activity, and has described it as an infrastructure failure: servers failing health checks and an overloaded secure-connection process.
Its wording changed slightly overnight, as The Register reported, from "no indication" to "not aware of any", and the root cause had not been published at the time of writing. Treat the outage as an availability incident, not a breach, unless Microsoft says otherwise.
That distinction matters for what you do next. You do not need to assume your tenant was compromised because of the outage. You do need to assume attackers will use it, because a widely reported outage gives them a believable story. How CyberRank helps: it does not diagnose Microsoft's outage; it helps you judge which messages arriving in your vendors' names are easier to fake.
Why outages are a phishing opportunity
Phishing works best when the message matches what the reader already expects. A global outage creates four conditions at once:
- Expected messages. Everyone is waiting for "your service is restored" and "please sign in again". A fake one blends in.
- Backlog pressure. People returning to hundreds of delayed emails click faster and check less.
- Weaker defences. As Computer Weekly reported, security teams lost some visibility while Defender XDR and email-based alerting were degraded.
- Broken normal channels. When email is down, staff accept calls, texts and chat messages from "IT support" or "the vendor" that they would normally question.
Does this apply to your suppliers too?
Yes. Security firms also warn of voice and video impersonation of executives during disruptions, and your suppliers face the same pressures. How CyberRank helps: the same caution belongs in your vendor process, which is where CyberRank's outside-in view of each vendor's attack surface fits.
Outage-themed lures to expect
Expect six kinds of outage-themed lures: fake restoration notices, account re-verification, fake IT support, supplier payment changes, fake status pages or apps, and executive impersonation.
How CyberRank helps: two of these lures depend on your vendors' security, which CyberRank measures from the outside; the rest need user awareness and your own email controls.
| Lure | What it says | Red flag | Safe response | How CyberRank helps |
|---|---|---|---|---|
| "Mailbox restored" | What it saysYour mailbox was restored; sign in to re-activate it or recover lost mail | Red flagLink to a sign-in page from an email | Safe responseClose it; open Outlook or the admin center directly | How CyberRank helpsNot an inbox tool; see "Where CyberRank does not help" |
| "Re-verify your account" | What it saysSecurity check after the outage; confirm password or MFA | Red flagAny request for your password or MFA code | Safe responseReport to your security team | How CyberRank helpsLeaked-credential findings show whether staff passwords are already exposed |
| Fake IT support | What it saysA call or text offering to fix Outlook; may ask for remote access | Red flagUnsolicited contact, urgency, remote-access tools | Safe responseHang up; call your help desk on a known number | How CyberRank helpsNot covered |
| "Vendor's email is down" | What it saysA supplier says to use a new address or new bank details until its email is back | Red flagChange of payment details by any channel | Safe responseConfirm by phone with a known contact before paying | How CyberRank helpsShows whether the vendor's domain enforces DMARC, which makes spoofing harder |
| Fake status page or app | What it says"Outlook fix" download or a look-alike status site | Red flagUnknown domain, download request | Safe responseUse status.cloud.microsoft only | How CyberRank helpsNot covered |
| Executive impersonation | What it saysUrgent request by voice note, Teams or WhatsApp from a "director" | Red flagSecrecy, urgency, new channel | Safe responseCall back on a known number | How CyberRank helpsNot covered |
The third-party angle: phishing that arrives in your vendors' names
Your vendors were affected by the same outage. Many of them run email on Microsoft 365, so for a day or more they could not send or receive messages normally.
That gives attackers a simple story: "our email is down, please use this address" or "we have moved banks, pay this account instead". This is business email compromise in outage clothing, and it lands on finance and procurement teams rather than on security. Three vendor weaknesses make it easier:
- No DMARC enforcement: if a vendor's domain publishes DMARC at p=none or not at all, an attacker can send mail that appears to come from that domain (RFC 7489).
- Leaked credentials: if a vendor employee's Microsoft 365 password is already in a leaked-credential dump, a "re-verify" phish is not even needed; the account can be taken over and send real email from the vendor's own mailbox.
- Concentration: when many of your vendors depend on the same provider, one outage disrupts all of them at once and multiplies the "our email is down" stories. Gartner has urged CISOs to reassess this concentration risk after repeated Microsoft 365 incidents in 2026 (including 22 January, 16 March and 31 August).
How does this relate to supply chain attacks?
These are the same patterns behind other supply chain attacks: the attacker uses the trust you already have in a supplier. What outside-in monitoring can and cannot pick up about a supplier is covered in our quick answer on detecting a supply chain attack from the outside.
How CyberRank helps: every assessment includes the vendor's email security (DKIM/DMARC), leaked credentials and data breach history.
What to do this week
Warn staff, freeze supplier payment-detail changes without a call-back, check your critical vendors' email security and leaked credentials, review sign-ins, set up an out-of-band channel and keep the extra checks running.
- Warn staff now. Send a short notice by a channel that is working: Microsoft will not ask you to sign in through a link about the outage, and IT will not call to "fix Outlook" unannounced.
- Freeze payment-detail changes. Until next week, require a phone call to a known contact before changing any supplier's bank details, whatever channel the request came from.
- Check your critical vendors' email security. Look up DMARC for the domains of vendors that invoice you or hold your data. Vendors at p=none deserve a call-back rule, and the finding also weighs on their security rating.
- Check for leaked credentials. Review exposed passwords for your own domain and your critical vendors' domains, and force resets where they match active accounts.
- Review sign-ins in your own tenant. Look for unusual sign-ins and new inbox rules created during and after the outage, when monitoring was weaker.
- Set up an out-of-band channel. Make sure Microsoft service health alerts go to an address that is not hosted in Exchange Online, and keep a phone or SMS fallback for incidents.
- Keep watching. Outage-themed phishing usually continues for days after recovery, so keep the extra checks until the next post-incident report is out. This is the case for continuous monitoring of vendors rather than a one-off check.
Which steps can CyberRank do?
Steps 1, 2, 5 and 6 are your own process. Steps 3, 4 and 7 can be done with CyberRank: you can start with the free security rating tool for one domain. If a phish leads to personal data being exposed, check your notification duty under UU PDP, which sets a 3×24-hour window.
How CyberRank helps: it checks email security and leaked credentials across your whole vendor list and re-assesses monitored vendors every night, raising an event when a new breach appears.
Where CyberRank does not help
CyberRank is an outside-in rating platform. It does not filter email, scan your inbox, block phishing links, detect look-alike domains or take down fake sites. It does not monitor Microsoft's uptime or tell you when the outage is over; use Microsoft's status page and your admin center for that.
It cannot see inside a vendor's Microsoft 365 tenant, so it cannot confirm whether a vendor's mailbox was taken over, and it does not replace user awareness training, your own email security controls or a call-back procedure for payment changes.
Conclusion
The 12–13 November Microsoft 365 outage was, on Microsoft's account, an infrastructure failure rather than an attack. The phishing that follows it will be deliberate. Expect "mailbox restored" emails, fake support calls and supplier messages asking you to use new addresses or bank details.
Warn staff, freeze payment-detail changes without a call-back, and check which of your vendors are easiest to impersonate. CyberRank shows each vendor's email security and leaked-credential exposure, so you know where the extra checks matter most.
References
- Microsoft, Microsoft 365 service status, and incidents EX1550543 and MO1550821 in the Microsoft 365 admin center (12–13 November 2026)
- The Register, Microsoft's massive M365 outage stretches past 12 hours as its fixes keep failing (13 November 2026)
- Computer Weekly, Global Microsoft outage leaves users open to phishing attacks (13 November 2026)
- Bitdefender, Microsoft 365 outage disrupts Outlook, Teams and Copilot worldwide (13 November 2026)
- Gartner, First Take: Reassess Concentration Risk After Multiple Microsoft M365 Outages (2 September 2026)
- IETF, RFC 7489 (DMARC)
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating