Microsoft’s widespread outage, which began on November 12 and extended well into the 13th, is already being regarded as one of the most significant Microsoft 365 disruptions in recent memory. Exchange Online and services across the entire Microsoft 365 stack went down around the globe. Technology leaders and users across every social platform have criticized Microsoft’s communication during the restoration as vague and inconclusive.

In defensive security, we like to say, “never let a good crisis go to waste.” Unfortunately, cyber criminals feel the same way. As services return, another risk emerges for businesses: attackers taking advantage of users in the fog of service disruption.

To be clear, there is no evidence that the outage was caused by a cyberattack, and Microsoft has disclosed no malicious activity. The security threat comes from attackers capitalizing on confusion. As users wait for their inboxes to repopulate, many will turn to other ways of communicating, ask for exceptions to access certain data, and generally work outside their normal routines, all while leaning on IT teams for status updates. These conditions are a perfect opportunity for social engineering against an already confused user base.

As Microsoft returns to green, we recommend maintaining healthy skepticism toward:

• Sudden account or password reset requests
• MFA prompts you didn’t initiate (never approve these)
• Requests to share verification codes
• Unexpected documents that “failed to arrive during the outage”
• Changes to payment or wire instructions because “email was down”
• Requests for credentials from IT, the helpdesk or “Microsoft support”
• Unexpected outreach from a colleague, vendor, client or senior leader

One more to watch for: legitimate mail delayed by the outage will keep arriving late and out of order. That backlog is great cover for a malicious message, so don’t assume something is legitimate just because it looks like it’s catching up.

Organizations on top of security awareness training will read the above and recognize typical tactics. What’s notable is the new context, which makes these tactics more believable. This is a moment where returning to the basics pays off:

• Pause before you click. Go directly to the service you normally use instead of following a link.
• Verify unusual requests through a second channel, using a phone number or contact method you already know.
• Stay alert for unexpected support calls or messages.

For IT and helpdesk teams, the same applies in reverse. Expect impersonation from both sides of the support queue and hold firm on identity verification before any password reset or MFA re-registration, even as tickets pile up. A backlogged helpdesk under pressure to restore access quickly is exactly where an attacker wants to be.

At ECI, our teams continue to monitor Microsoft service health as normal operations return. If something looks suspicious, or you just aren’t sure, reach out. When in doubt, verify before you trust.