Banks in Thailand unable to operate via email. Courts in Australia and the Philippines experiencing delays in their proceedings. Entire ministries in Singapore and Japan digitally shut down. New Zealand embassies worldwide affected. It doesn't take a sophisticated cyberattack to paralyze half the planet: all it takes is for the provider that almost everyone relies on to send an email or join a meeting to fail. That's exactly what happened with the global Microsoft 365 outage, and it's probably the clearest cybersecurity lesson we'll see this year.
What exactly happened to Microsoft 365?
The incident began on the afternoon of November 12, 2026 (around 5:30-6:00 PM GMT, according to live monitoring of TechRadarand affected, among others, Exchange Online, Outlook, Microsoft Teams, SharePoint Online, Copilot, OneDrive, Microsoft Defender for Office 365, Planner, and Power BI. Downdetector registered more than 130,000 user reports at the peak of the outages alone, and media outlets such as Primicias counted reported incidents in at least 74 countries and territories.
The sources consulted do not agree on the exact duration—ranging from slightly over 10 to nearly 18 hours, depending on the medium and the time of measurement—so we prefer not to provide a single figure that we cannot verify. What is consistent across all sources is the magnitude: the United States was the hardest-hit region, while Europe, including Spain, was spared in part because the outbreak coincided with European nighttime.
It wasn't a hack, and that's (almost) worse
Here's the piece of information that's generating the most headlines, and it's worth clarifying: Microsoft has explicitly ruled out a cyberattack. According to their own communications, reported by TechRadar, the problem was due to a “high load” caused by a large number of servers that unexpectedly became unavailable, leading the company to revert a recent change to its network configuration.
And that's precisely the unsettling part: no attacker was needed. A purely operational failure, with no malicious intent whatsoever, was enough to leave government departments, banks, and police forces around the world without email. It's the perfect example of what's known in cybersecurity as concentration risk: when a huge part of the world depends on a single provider for its critical communications, a simple technical error has the same practical effect as a large-scale attack. We delve deeper into how these types of incidents are managed, regardless of their origin, in our article on monitoring and incident response.
Who has been affected: from banks to courts
According to Primicias“ coverage, the list of organizations and institutions that have reported direct impact includes, among others: the NHS postal services in the United Kingdom, the Singapore Ministries of Home Affairs and Health, the Japanese government (as confirmed by its deputy spokesperson), several major Thai banks (Siam Commercial, Kasikorn, Thanachart, and Krung Thai), the Australian Federal Police, and the New Zealand Ministry of Foreign Affairs, which warned of disruptions to ”all its embassies, consulates, and representative offices" worldwide. Several courts in Australia, Singapore, and the Philippines also reported delays in their proceedings.
This is not an isolated case: the number of cybersecurity incidents and critical service outages has been rising for years, as our article on the topic shows. historical increase in cyber incidents in Spain reported by INCIBE.
The cybersecurity lesson from this fall
Dependence on a single cloud provider
When a single platform centralizes an organization's email, meetings, file storage, and even corporate artificial intelligence, any failure of that provider automatically becomes the company's biggest operational risk, above even many external threats.
Contingency and business continuity plans
INCIBE reminds Cyber resilience begins with classifying which assets and services are critical and having a contingency plan supported by management, not just the IT department. Organizations that had an alternative communication channel yesterday (another email, another messaging tool, manual protocols) barely felt the impact; those that didn't were left completely in the dark.
Crisis management: the skill that more and more companies need
This is the least discussed part: detecting the problem, communicating it internally, activating the contingency plan, and coordinating the return to normal operations is a discipline in itself within cybersecurity, known as crisis management and cyber resilience. It is, in fact, one of the specific areas of Master's Degree in Cybersecurity Management, Ethical Hacking and Offensive Security from EIP, Precisely because more and more companies need professionals capable of anticipating and managing these types of scenarios, whether they stem from an attack or, as yesterday, from a simple technical failure. If you're interested in this more strategic aspect, you can also read about The role of the CISO in digital transformation and about How to build a resilient organizational culture.
Do you want to specialize in crisis management and cyber resilience? Learn about the master's program →
What can companies do to avoid depending on luck?
| Without a cyber resilience plan | With a cyber resilience plan |
|---|---|
| A supplier failure brings all operations to a standstill. | There are alternative communication channels and tools that can be activated in minutes. |
| Nobody knows who decides or what to do during the crisis. | There are predefined crisis management roles and protocols |
| The return to normality depends entirely on the supplier | The company autonomously resumes critical activity while the external problem is being resolved. |
| The incident is being experienced as a surprise. | The incident is being handled as a rehearsed scenario. |
Frequent questions
Was the Microsoft 365 outage a cyberattack?
No. Microsoft has expressly ruled that out and attributes the failure to an internal overload of its own servers, not to malicious action.
How long did the fall last?
Sources don't agree exactly: between just over 10 and nearly 18 hours, depending on the source and the time of measurement. We will update this figure when Microsoft confirms the full resolution and publishes its official report.
Which services have been affected?
Primarily Outlook/Exchange Online, Microsoft Teams, SharePoint Online, Copilot, OneDrive and Microsoft Defender for Office 365, among other services in the suite.
Could something like this happen again?
Microsoft has not ruled out the possibility of similar incidents occurring again in the future: no cloud provider, however large, is immune to operational failures. Therefore, prevention depends not only on the provider but also on each organization's contingency plan.
What can companies do to protect themselves from these types of incidents?
Classify which services are critical, design alternative communication channels, document a business continuity plan and, above all, have professionals trained in crisis management and cyber resilience capable of activating it when needed.
Take the next step in your professional career
Yesterday's incident wasn't a cyberattack, but it very well could have been, and the outcome would have been the same. Companies increasingly need professionals capable of anticipating these types of crises, not just reacting when it's too late. The Master's in Cybersecurity Management, Ethical Hacking, and Offensive Security at EIP trains you in crisis management, cyber resilience, and incident response, with real-world practice and an active job placement service with over 50 companies in the sector.
