Microsoft outage hits users worldwide: What went wrong, why is cyberattack ruled out? - explainer

On Thursday, Microsoft suffered one of its most significant global outages, leaving thousands of clients unable to connect to services like Outlook, Microsoft 365, and Teams. The company has not yet provided a definitive resolution, but experts have dismissed the possibility of a cyberattack. According to Microsoft's statements, an internal error is being investigated, causing accounts to disconnect from North American servers, which then led to a chain reaction as those accounts were moved to other servers worldwide.

The surge in traffic to these servers caused delays and further outages, prompting some companies to send employees home early due to the persistent connection issues.

In simple terms, some of Microsoft's servers failed their health check, leading to the disruption of connections and the redistribution of users to servers in different parts of the world. Experts believe that identifying the specific server that experienced the health check failure will be crucial in resolving the massive outage.

While it won't be possible to confirm the exact incident until Microsoft releases a public status report and concludes its internal investigation, three facts rule out a cyberattack. First, Microsoft's assessment focuses on an internal investigation into issues within its own servers rather than an attack from outside. Second, there was no spike in users, indicating that Microsoft did not experience a Distributed Denial-of-Service (DDoS) attack, with most reports showing normal user levels.

Third, no hacker group has claimed responsibility for the attack, even though services were down for several hours and thousands of people reported disruptions worldwide. According to Downdetector, the Microsoft incident affected servers in Israel, with disruptions detected in Tel Aviv, Jerusalem, and Haifa. The incident has also impacted Outlook, Microsoft 365 services, and Copilot, Microsoft's AI assistant.

The outage has been active for over 12 hours globally, with users in the Asia-Pacific region starting to report disruptions on Friday.

This incident is reminiscent of a similar outage in January, which lasted nearly nine hours and affected around 3,000 users. In that case, the public assessment suggested that the disruptions were triggered when a data center in Cheyenne, Wyoming, was taken down for maintenance, causing a cascading effect similar to the recent one.

In October 2025, a massive disruption of Amazon Web Services (AWS) knocked out thousands of websites and popular apps like Snapchat and Reddit, disrupting businesses globally. That incident was also attributed to an internal error rather than a cyberattack. Software engineer and Fellow at the Institution of Engineering and Technology, Junade Ali, explained that the issue seemed to involve one of AWS's networking systems used to control a database product.

The recent Microsoft outage is the largest internet disruption since last year's CrowdStrike malfunction, which crippled technology systems in hospitals, banks, and airports, highlighting the vulnerability of the world's interconnected technologies.