Microsoft outage hits users worldwide: What went wrong, why is cyberattack ruled out? - explainer

On Thursday, Microsoft faced a significant global outage, impacting thousands of clients worldwide who were unable to connect to services such as Outlook, Microsoft 365, and Teams. While the company has not provided a final resolution, most experts have ruled out the possibility of a cyberattack causing the incident. According to Microsoft, the issue stemmed from a possible internal error that led to accounts being disconnected from North American servers, causing a chain reaction and subsequent outages as users were redirected to servers in other parts of the world.

Initial estimates suggest that the increase in traffic to these servers led to delays and further disruptions, forcing some companies to send employees home early due to the persistent connection issues.

The technical assessment indicates that some servers failed a health check, which triggered the connection disruption and the redistribution of users to servers in different global locations. Experts believe that, since the issue was not a cyberattack, Microsoft will likely need to identify the specific server that failed and caused the widespread outage.

While a definitive cause cannot be determined until Microsoft releases a public status report and completes its internal investigation, three factors suggest that a cyberattack is unlikely. First, Microsoft's assessment indicates that the solutions being implemented are part of an internal investigation into issues originating from its own servers, rather than an external cyberattack.

Second, there was no significant spike in user levels that would indicate a Distributed Denial-of-Service (DDoS) attack, as most reports show normal user traffic levels. Third, no hacker group has claimed responsibility for the attack, even though the services were down for several hours and thousands of people reported disruptions worldwide.

Downdetector reports that the outage affected servers in Israel, with disruptions detected in Tel Aviv, Jerusalem, and Haifa. The incident also impacted Outlook, Microsoft 365 services, and Copilot, Microsoft's AI assistant. The issue has been ongoing for over 12 hours globally, with the latest reports on Friday indicating that users in the Asia-Pacific region also began experiencing disruptions in the services.

In January, Microsoft experienced a similar outage, lasting almost nine hours and affecting about 3,000 users, which was similarly attributed to an internal error rather than a cyberattack. The previous incident occurred when one of their data centers in Cheyenne, Wyoming, was taken down for maintenance, leading to a cascading effect similar to the recent outage.

Cyber expert Junade Ali from the Institution of Engineering and Technology noted that such issues are usually resolved centrally unless additional problems are identified. He stated that the matter should be mitigated over the coming hours unless further complications arise. This incident marks the largest internet disruption since last year's CrowdStrike malfunction, which crippled technology systems in hospitals, banks, and airports, underscoring the vulnerability of interconnected technologies worldwide.