UPDATE: Outlook started coming back online after more than 21 hours having little to no connectivity.
If you can even connect to Outlook, trying to send an email is an unknown if it’s working, the address books are not working and we can’t even access our calendar. That was Thursday, November 12. Outage reports started climbing around 11:39 a.m. Central, over the Houston lunch hour, according to one Houston IT firm’s timeline (minimal sources on that start time). By just after noon Central, nearly 130,000 people had reported Outlook problems on Downdetector. Microsoft spent the afternoon restarting servers and testing an alternative health check method to bring them back, and late in the afternoon it still hadn’t given a restoral time.
This massive disruption is crippling business, government entities and showing the importance for backup methods of comms with time sensitive email.
Fax machines and personal Gmail: the workarounds that create new risk
Watch what people do when the primary goes down and you’ll find out what your real continuity plan is. Thursday afternoon, people are missing the fax to send documents or using personal email accounts to keep things moving. I get it. They’ve got a permit to issue, a claim to file, a vendor to pay. The staff aren’t the problem; nobody gave them an approved second path, so they made one. But that’s potentially violating the rule of not mixing work data being sent by personal email accounts, and from the security side it’s worse than it sounds. A personal account has none of your logging, none of your retention, none of your data loss protections and maybe not even MFA. The resident’s PII that went out of somebody’s Gmail today is outside your control now, and nobody will remember it was sent when the auditor or the records request shows up.
The crooks know this playbook too. Business email compromise cost victims $3.05 billion in 2025 in the FBI’s IC3 numbers. An outage is perfect cover for “our email is down, use my personal address” or “Microsoft needs you to re-verify your account,” and both sound believable this week. If a payment change or a login request shows up from an address you don’t recognize, call a number you already had on file.
Microsoft 365 outages in 2026: one provider, three big failures
I’m not telling anybody to rip out Microsoft 365. But organizations that only use Microsoft, or any single provider, are at risk of future business interruptions, and 2026 has proven it more than once. In January a Microsoft 365 outage in North America ran about ten hours, with external email largely blocked. On August 31, Outlook users couldn’t open, search or send email for a good part of the afternoon. Thursday makes three. By late afternoon Microsoft said it hadn’t found a recent change that lined up with the start, only that servers were going unexpectedly unavailable and dumping their load on the ones still standing.
Why a single cloud provider is a target for hackers
Microsoft hasn’t tied Thursday’s outage to an attack. But a platform carrying mail, calendar and contacts for that many governments and businesses is a major target for future outages by hackers, and every adversary watched what half a day without Exchange did to the people who depend on it. The federal government has already said cloud providers are in the crosshairs. In 2024 the DHS Cyber Safety Review Board found that a China-linked group called Storm-0558 got into Exchange Online mailboxes at 22 organizations and more than 500 people because of a cascade of security failures at Microsoft. The same report called cloud computing a high-value target for nation-state actors and said a compromised provider can be used to reach its customers’ data and networks.
Backup comms plan for an email outage
Any COML will tell you a plan with one path is a single point of failure with a name on it. Most of this costs nothing but an afternoon:
- Stand up an approved alternate email on a different provider before you need it, so nobody reaches for their personal Gmail.
- Keep the fax line working and tested. People went looking for it Thursday for a reason.
- Keep the contact list somewhere Outlook isn’t. Printed, and saved on phones as regular contacts, not only synced from Exchange.
- Use text or your mass notification system for staff. Don’t wait on email to tell people email is down.
- Change the main voicemail greeting and put a banner on the website with a phone number to call.
- Give your insurance agent, your bank and your key vendors a phone number and a backup address now. Claims, payment notices and fraud alerts keep running on their own clocks whether you can read them or not.
Winlink: email over ham radio when Outlook is down
Do you have a WinLink backup setup in your EOC if something major happens? Winlink is a network of amateur and authorized government stations that moves email with attachments over radio where the internet isn’t available, and it can run without the internet at all. It’s out-of-band comms in the plainest sense: your message never touches Exchange. Your local hams probably already run it. Travis County ARES staffs a radio room connected to the combined Austin-Travis County EOC and holds a weekly WinLink Wednesday, where operators check in with a one-line message through an RMS gateway like W3MRC-10 on 145.730 MHz. At the state level, TDEM lists RACES among its tools to provide backup communications, and Texas RACES volunteers train to fill the gap when county and city voice or data systems go down.
Know the rules before you count on it. FCC Part 97 bars hams from sending traffic on behalf of an employer, with an exception for emergency preparedness drills, limited to the scope of the drill. Drills that aren’t government-sponsored are capped at an hour a week; government-sponsored ones aren’t. So Winlink won’t get your AP clerk’s invoices out, and it shouldn’t. What it will move is a resource request, an ICS-213 or a sitrep out of your EOC when every other path is gone. Keep anything sensitive off the air, too. Part 97 also prohibits messages encoded for the purpose of obscuring their meaning.
Call your ARES emergency coordinator or your RACES contact this week, put Winlink in the comms annex as an alternate path, and run it in your next exercise.
What nobody can tell me yet, Microsoft included, is whether everything people sent us between noon and now is sitting in a queue or gone. We don’t know if this is a cyber attack or some sort of hardware failure at this point, but this is a good time to exercise your backup means of emailing.
