Was the Microsoft outage and FAA ground stop a cyberattack? What officials have said

What is being shared

Two big outages hit on back-to-back days. On Thursday, November 12, some users couldn't get into or use Microsoft 365 services, including email. On Friday afternoon, the FAA stopped departures at every US airport. Many people asked whether both were a cyberattack, and one headline reads: "Secretary of Homeland Security says no indication FAA communications failure was related to a cyberattack."

Here is what each official source has actually said, and what it means at home.

What DHS, the FAA and Microsoft actually said

The FAA's statement, dated November 13, says it "issued a nationwide ground stop for all U.S. airports following communication issues impacting multiple Air Route Traffic Control Centers. FAA technicians are investigating the issue." It adds: "This information is preliminary and subject to change." A later FAA Command Center advisory gives the reason as "COMMUNICATIONS FAILURE."

That evening, Mullin and Duffy briefed reporters at the White House. In the Department of Homeland Security's release, Mullin says: "We have seen zero evidence that this is a cyberattack," and "all of your loved ones are safe." The White House posted his remarks under the title "Everybody is safe." The release says both secretaries called on Congress to fund a modernized air traffic control system.

Microsoft's status page says its consumer Microsoft 365 problem ran from 10:05 a.m. UTC on November 12 (5:05 a.m. Eastern) to 4:10 p.m. UTC on November 13 (11:10 a.m. Eastern), and that "the backlog of email messages has been processed." It doesn't give a cause.

What is confirmed, and what is not

Confirmed: DHS says it has seen no evidence of a cyberattack. The FAA's stated reason is a communications failure. Duffy said the instability began at 3:36 p.m. The FAA Command Center's order grounding all airports was signed at 3:54 p.m. Eastern (20:54 UTC), more than four hours after Microsoft's status page says its outage ended. Duffy said there were over 3,500 airplanes in the air when the ground stop was issued, and that the airspace reopened at 8:15 p.m. Eastern. The FAA Command Center's cancellation notice was signed at 8:19 p.m. Eastern (01:19 UTC on November 14). Some airports stayed under ground stops overnight; the FAA Command Center said they were "at airline's requests." Its morning plan, signed at 7:51 a.m. Eastern on November 14, says all air route traffic control centers "have returned to normal flight plan drop intervals."

Not yet known: a final cause. The FAA called its own statement preliminary and said its technicians are investigating. We found no statement on the FAA's or Microsoft's own websites on whether the two outages are connected. As of 9:45 a.m. Eastern on November 14, the FAA, DOT and DHS had posted nothing newer than their November 13 statements, CISA's news page listed no statement on either outage, and Microsoft's final update gives no cause. The White House's videos of the briefings show Mullin and Duffy; we found no White House statement or transcript from President Trump on the outage. Mullin said officials had seen "zero evidence" of an attack; that is not a final finding on the cause.

Why officials point to old equipment

Duffy said radar and communications became unstable at air traffic control centers across the country: "We didn't lose all telecom, we didn't lose all radar," but the FAA stopped flights out of caution. He said the system runs on analog telecom and that "our routers actually got overloaded with data," adding: "It's the old hardware that went down." He said new equipment already installed did not fail.

That funding request is theirs to make; we don't take a side. What matters here is that neither DHS nor the FAA has described any sign of an attack.

What it means for your home

If you were flying, Duffy's advice was to "check with your airline," because crews and planes take time to get back in place. Microsoft's status page says its services "have fully recovered."

Outages like these are a good reminder of steps that help whatever the cause. Ready.gov says to "keep a small amount of cash at home in a safe place" in small bills, because "ATMs and credit cards may not work during a disaster." If a real cyberattack ever hits you, Ready.gov says to "check your credit card and bank statements for unrecognizable charges" and, if you notice strange activity, change "all of your internet account passwords immediately." Our guide on what to do in a cyberattack walks through the before, during and after.

If email or online accounts go down, keep what you need where you can reach it offline. Ready.gov's kit list includes copies of important documents "saved electronically or in a waterproof, portable container" and "Paper and pencil." Its financial preparedness checklist lists household contacts to keep, such as your bank, insurance agents and health professionals.

• Flying soon: check your flight with your airline before you leave home
• Keep some cash in small bills at home
• Keep copies of important documents on an external drive or in the cloud, as Ready.gov suggests
• Write down key phone numbers (family, bank, insurer, doctor) on paper, so you can reach them without email

What not to do

Don't buy anything because of these outages: nothing official asks you to. Don't install "fix" software or give remote access to anyone who contacts you about the outages. Ready.gov warns: "A company will not call you and ask for control of your computer to fix it. This is a common scam."

Be wary of posts that say an attack has been confirmed. As of November 14, no official source we read says so. Check DHS, the FAA and Microsoft's own status page before you share. We also checked an earlier claim of a cyberattack on freezers at military bases. Reports the same day that the National Weather Service radar was down are covered in our radar check.