Microsoft exec reveals details of a global outage, says cause was not a cyberattack or AI

Harrison Christian, Megan Palin, Bianca Soldani and Jackson Robb

Charles Lamanna, who is Microsoft’s executive vice president of Copilot, agents and platform, has given an update about the outage, saying the problem was not caused by AI tools or the result of a cyber attack.

Be the first to know when news breaks. Download our new app

“I want to share what we know so far,” he wrote in a post to X on Saturday morning.

“This was not a cyberattack or an issue caused by AI tooling.

“Our investigation points to technical challenges and failure modes (cascading failures + thundering herds at our network perimeter) that made recovery more difficult than normal.”

Thundering herds is when there is a large number of connection requests or traffic at the same time.

Mr Lamanna said a full “post-mortem” report would be published shortly, including a step-by-step timeline into how the repairs were executed.

“We take our responsibility to our customers seriously and will do everything we can to learn from this and prevent it going forward,” he said.

A spokesperson from Microsoft said that they were “deeply sorry” for the disruption caused to customers and partners in a statement that was published online.

“We know the trust they place in our services and take that responsibility extremely seriously. We are seeing broad recovery and stability across our services,” it said.

“The incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change.

“We have addressed the underlying issue and continue to restore service to remaining customers and regions.”

Microsoft Australia President Jane Livesey was contacted for comment, with a company spokesperson providing the same response.

Microsoft will continue to monitor its networks for “an extended period of time” as the outage continues to impact businesses and organisations worldwide.

The tech giant said its networks had seen “sustained recovery” after the outage and were working to restore messages that may have been lost during the disruption.

“We continue to observe sustained service recovery across the previously affected environments,” the Microsoft 365 Status team wrote to X on Saturday morning.

“Due to the severity of impact this incident caused, we’re monitoring for an extended period to ensure no additional mitigative actions are required.

“In parallel, we’re monitoring the backlog of email messages accrued during this event to ensure all process successfully before considering the issue resolved.”

Australian impact

Australian Federal Police Commissioner Krissy Barrett told media that the AFP had been impacted by the outage, with the Director General of the Australian Security Intelligence Organisation (ASIO) reporting similar disruptions to their networks.

Minister for Home Affairs Tony Burke backed Microsoft when talking about the outage and said the federal government had worked with them previously to promote “high levels of security”.

“I’d say the relationship that we have with Microsoft is an important one,” he said during a press conference on Friday.

“There is good security work that is done with Microsoft as a business.

“I’ve spoken this morning shortly before the media conference to get the latest briefing from both Lieutenant General Michelle McGuinness, the Cyber Security Coordinator, and following that, Jane Livesey from Microsoft in Australia.”

“They believe that they’re dealing in some ways similar to what we saw with respect to CrowdStrike, where there is an update that has gone awry.”

“In terms of the impact so far, the impact that they are dealing with is very much on email systems.”

A spokesperson from NSW Health said that services, including emergency departments, remained open with no impact to patients during the outage.

‘Billions of dollars’

A number of users in Australia have reported being able to send and receive emails via Outlook after an entire business day plagued by disruptions and delays.

Businesses across the country including the Australian Security Intelligence Organisation (ASIO) and Australian Federal Police (AFP) reported knock-on effects from the outage.

As services start to resume, experts warn the cost of catching up will continue to bite.

RSM Australia Risk Advisory partner Ashwin Pal said small businesses would have been dealt a harsher blow by the outage.

“You take a CBA as an example, they’ll be able to absorb an impact like this a lot easier than the five-person accounting shop down the road,” Mr Pal told the ABC.

“They were already actually working on very thin margins. All of a sudden they’re actually out for three, four, five days or whatever it takes for them to recover. That could be the final straw.”

Mr Pal said professional services, like accountants and lawyers, may have lost hundreds of thousands of dollars per hour.

“It’s not just the initial downtime, it’s more actually about then the catch-up effort because that costs money,” he said.

Broadly, Mr Pal said, the tech failure could have cost the economy billions of dollars.

“And don’t forget, it’s actually going to get worse,” he said.

“This is what happened with CrowdStrike. So when the outage happened, because of where we are in the world in terms of time zones, we felt the impact first.

“As the US and Europe come online, and they can’t operate, it’s going to get worse. So you’re going to have a multiplier effect.”

Worldwide chaos due to Microsoft failure

While trading came to an end in Australia on Friday, organisations across Europe and the UK scrambled to work around the disruptions.

In the UK, the National Health Service (NHS) was “seriously impacted” by the outage, and ambulance services were also affected.

“Those who work in 111 and 999 services are unable to refer patient details in the normal way which is creating a massive backlog and has the potential for chaos,” a spokesperson from the trade union that covers the NHS and ambulance services told the BBC on Friday, local time.

Several police stations in the UK urged citizens to report crimes over the phone rather than via email, with many impacted schools also telling parents to ring if they need to get in contact.

Former leading software engineer Gergely Orosz told the BBC: “This could well be the most disruptive email-related business outage of all time.

“That mitigation is taking 12-plus hours for a global outage for a service with 100 million plus users – this is very rare.”

Office workers knock off early

In Sydney’s CBD on Friday, one outdoor bar said they were inundated with office workers frustrated by the Microsoft outage.

An employee at Ryan’s Bar in Australia Square, told news.com.au Friday was “probably the busiest lunch of the year.”

They said they don’t usually see that volume of patrons outside of the Melbourne Cup and credited the influx to the massive tech disruptions.

An Instagram video shared by Bondi Lines and captioned, “Outlook going down on a Friday is every Sydney corporate’s dream,” shows the bar inundated with men and women in office attire.

The scenes had people rejoicing in the comments, with one person describing the outage as: “Like a snow day but for grown ups!”

“Great to see, good for the restaurants, bars and cafes too,” another person wrote, while a third asked: “Is this what it takes to revive Friday work drinks?”

Another person noted that it looked a lot like Sydney’s CBD prior to the covid lockdowns.

“Looks like a Friday night in Sydney. pre Covid,” they said, while another joked: “Finally people are talking to each other.”

Unfortunately for the bar, the bumper trading didn’t last late into the evening as a storm chased away many of the people enjoying the outdoor venue.

24 hours that brought world to standstill

Millions of people are estimated to have been affected by the sudden server failure on Friday morning, AEDT, across 74 countries.

About 430 million people worldwide use Microsoft’s Office365 services.

Government services were impacted, including local councils. Australia Post forced to temporarily suspend its phone payment service.

Frustrated users quickly took to social media with their complaints, while others celebrated the reprieve from work.

“Ugh I liked my outfit today and I was only in the office for 3 hours because of the Microsoft outage,” one wrote.

“The Microsoft outage is such a blessing,” said another.

Others warned the outage did not bode well for the tech giant, arguing that “every Microsoft user this morning looking at other options” and “I can’t really understand companies still using Exchange/Outlook”.

As the impact of the outage spread on Friday, Dimitrios Salampasis, a tech expert from Swinburne Business School, said the economic cost wasn’t yet known.

“We have seen this pattern before with CrowdStrike in 2024 and the Optus outage in 2023,” Prof Salampasis told news.com.au.

“Although the technical causes differ, these incidents reveal a common vulnerability, that our digital economy is increasingly dependent on complex, interconnected systems where a failure in one component can have widespread consequences.”

Prof Salampasis said a particularly interesting feature of the Microsoft outage was the “apparent role of automated health checks”.

“We saw something conceptually similar with Optus, where automated protective mechanisms contributed to a major disruption.

“ … Ultimately this is a systemic digital risk: a failure in one part of the technology ecosystem can have consequences far beyond the organisation where it originated.”

‘Disgruntled employee’ could be to blame

Dr Nalin Arachchilage, a cybersecurity expert from RMIT University, warned that bad actors could use the anxiety and urgency of an outage to target users.

“Scammers love outages, because what they could do is they could impersonate service providers when people are anxious and looking for fixes; this is where they would step in,” Dr Arachchilage told news.com.au.

“Go to the provider’s official site in that case and go to the status page and do not click any unexpected message.”

He said the outage appeared to be a technical glitch — Microsoft has attributed it to failed server health checks — but the environment of recent tech lay-offs left the door open for insider threats, even if unconfirmed.

“They are pointing to the health check component, so that reads as a failure to upgrade a piece of equipment,” he said.

“Well, it could be an insider threat; a disgruntled employee who left the organisation and shared sensitive information.

“We don’t know because they haven’t talked about that in detail.”

Microsoft said on Friday it was “investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas”.

“While we’re working to mitigate impact, we’ve confirmed the issue may affect Microsoft 365 service connectivity for users in any region.”

In a later update, the company said its investigation indicated servers went offline due to “failed health checks (that) may originate from a specific component that’s responsible for processing server health”.

“We’ve taken steps to prevent additional servers from being impacted while we work to return the affected servers to service.”