Is the Outlook Outage a Hack? What Your Staff Should Watch For

Microsoft says the Nov. 12-13 Outlook outage wasn't a hack. Here's what staff should watch for: fake sign-in emails, support calls, and refund offers.

2026-11-13 · Chris Coulson

Is the outage a hack? What your staff should watch for. Illustration of a laptop, a warning triangle on a generic envelope, a phone marked fake, and a padlock.

Microsoft 365 and Outlook went down around the world on November 12 and 13, 2026. Microsoft says it was not a cyberattack. Scammers are still using the outage to send fake "sign in again" emails and pose as Microsoft or IT support. Here's what owners and office staff in York, Lancaster and Harrisburg should watch for.

By Chris Coulson, Coulson Technologies · York, PA

Chris Coulson has 40+ years of IT experience, 22 years in business, and runs Coulson Technologies in York, PA.

If Outlook or Teams stopped working this week, you were not alone. And if a message now says "service is restored, sign in again," or a caller claims to be Microsoft support, pause before you click or talk.

What happened on November 12 and 13?

On Thursday, November 12, 2026, starting around 12:30 p.m. Eastern Time, people and businesses around the world began having trouble with Outlook and other Microsoft 365 tools. The problem stretched into Friday, November 13. As of midday Friday, November 13, Microsoft's public status page at status.cloud.microsoft still listed service degradation for Microsoft 365, saying users may be unable to connect to multiple Microsoft 365 services.

The disruption hit more than email. Microsoft's updates listed Outlook and Exchange Online (the systems that handle work email), Microsoft Teams, SharePoint, OneDrive, and Microsoft 365 Copilot among the affected services.

Microsoft has said a large number of its servers failed automated health checks and became unavailable. In a Service Health Status update at 6:11 a.m. Eastern Time on November 13, the company said: "At this time, we have no evidence of malicious activity associated with this incident." Late Thursday, Microsoft executive Charles Lamanna said there was "no indication this is the result of malicious or cyber activity." Microsoft said it would publish a full post-incident report after the problem is fully addressed.

So was the Outlook outage a hack?

Based on what Microsoft has said so far, no. An outage means the service stopped working. A hack would mean someone broke in. Microsoft has pointed to a technical failure, not an attack. That does not mean your office is in the clear. The danger now is the messages and calls that follow.

Why a big outage brings scams

When people cannot get into email, they start to wonder if something is wrong with their account. A message that offers a fix can suddenly look helpful.

Abhishek Karnik, head of threat research at McAfee, said on November 12: "An outage like this isn't a cyberattack, but it can still open the door for scammers." He added: "Scammers don't have to cause the problem. They just have to show up while people are confused and in a hurry."

The United Kingdom's National Cyber Security Centre posted on November 13: "In the wake of the global Microsoft outage, the NCSC is recommending that everyone exercises caution around unexpected calls and messages, especially those containing links."

Australia's National Cyber Security Coordinator warned people to "remain vigilant and be cautious of unsolicited contact," and said: "If you're unsure, hang up and call back."

Infosecurity Magazine noted that Microsoft is one of the brands scammers copy most often. In an October update cited in that article, Check Point said Microsoft accounted for 33% of all brand phishing attempts in the third quarter of 2026, up from 23% in the second quarter. Phishing is a fake email, text or call meant to trick you into giving up a password, a login code or other private information.

What should your staff watch for?

Watch for these, whether email is still down or just coming back.

A "sign in again" or "restore your account" link. McAfee warns that scammers send fake service-restoration messages that ask you to sign in again, then send you to a page that looks like a real Microsoft login. Do not click those links. Type your password only on a page you opened yourself, from your own bookmark or the app.

A login approval or code you did not ask for. If your phone asks you to approve a sign-in you did not start, or someone asks you to read back a one-time code, do not approve it and do not share the code. Tell your IT person.

A caller who says they are Microsoft or your IT support. Microsoft's own guidance is clear: Microsoft will never reach out first to offer unsolicited technical support, and a genuine Microsoft error message does not include a phone number to call. Hang up. Call back on a number you already have saved — not a number the caller gives you.

An offer of a refund, "outage compensation," or a fee to restore service. On November 13, The Economic Times warned that emails promising a refund or compensation for the outage, or asking for bank or card details to process one, should be treated as a scam. So should a caller who demands a fee or a payment to "restore" Outlook. If your business thinks it may be owed a service credit, ask your IT provider or check through the Microsoft 365 admin center you already use — not through an unexpected email.

A "security update" that arrives as email comes back. Infosecurity Magazine noted that when email returns and people clear a backlog, they can be quicker to trust a message that looks like it came from Microsoft. If a message asks you to click, sign in or install a fix, check first. After the outage, have your IT person review sign-ins, mailbox rules and forwarding rules from the hours the systems were down. A new forwarding rule — a setting that quietly sends copies of your mail somewhere else — is easy to miss when everyone is trying to catch up.

What should you do instead?

This is the same "pause and check" habit we cover in our guide to fake invoices, shared-folder notices and domain-renewal letters. The details change. The rule does not.

What if someone already clicked, typed a password or took the call?

Do not panic, and do not try to fix it by calling the same number back.

  1. Close the page. Hang up. Do not call back a number from the message.
  2. If you typed a password, change it from a device you already trust. If you use that password anywhere else, change it there too.
  3. Sign out of other sessions, so anyone who got in is pushed out.
  4. Turn on multi-factor authentication if it is not already on. That is an extra login step, such as a code on your phone, on top of your password.
  5. If you approved a sign-in you did not start, or shared a code, tell IT right away so they can lock the account and check for new mailbox rules or forwarding.
  6. If you installed software or let someone take over your screen, disconnect that computer and have your IT person check it before you use it again.
  7. If you shared card or bank details, call your bank using the number on the back of the card — not a number from the email or the caller.
  8. Tell your IT person what happened, and keep the original message. In the United States, suspected fraud can also be reported at ReportFraud.ftc.gov.

Coulson Technologies helps businesses in York, Lancaster, Harrisburg and South Central Pennsylvania with cybersecurity. If someone already clicked a sign-in link, took a support call, or you want help walking your staff through what to watch for, get in touch. It is a conversation about what happened, not a lecture.

If you don't know, don't click.

What else do owners ask about the Outlook outage?

Was the Outlook outage a hack?

Microsoft has said it has no evidence of malicious activity and no indication the November 12–13 outage was caused by a cyberattack. The scam risk is separate: criminals use the confusion around an outage, whether or not they caused it.

How do I check if Microsoft 365 is really down?

Use Microsoft's own status page at status.cloud.microsoft, or have your IT person check the Microsoft 365 admin center. Do not rely on a link in an unexpected email.

I got an email saying I need to sign in again to restore Outlook. Is it real?

Treat it as suspicious. McAfee warns that fake "sign in again" messages often lead to a page built to steal your password. Open Outlook the way you always do, and check status on Microsoft's own page.

Someone called claiming to be Microsoft or our IT support. What should I do?

Hang up. Microsoft says it will not reach out first to offer unsolicited technical support. Call your IT provider back on a number you already have saved.

What if someone already clicked the link or entered a password?

Change the password from a device you already trust, sign out of other sessions, turn on the extra login step if it is not already on, and tell your IT person. If you shared payment details, call your bank using a number you already have.

Which sources support this guide?

Outside facts in this guide come from these pages, checked November 13, 2026.