BENGALURU / SEATTLE — Microsoft confirmed on Saturday that global enterprise operations across Microsoft 365, Exchange Online, Outlook, and Teams have been fully restored following a multi-day infrastructure outage that began on November 12 and disrupted corporate communications across North America, Europe, and Asia—including customer-support mailboxes at major Indian airlines.
Even as delayed mail queues cleared, however, Microsoft Threat Intelligence and enterprise cybersecurity teams issued an urgent weekend alert: opportunistic threat groups have launched a coordinated credential-phishing wave impersonating official Microsoft recovery notices and citing the genuine Exchange Online incident code EX1550543.
Incident Timeline, Aviation Impact & Phishing Indicators
| Incident Dimension | Verified Technical & Security Findings |
|---|---|
| Outage Window | November 12 – November 14, 2026 (Full global restoration confirmed Saturday) |
| Affected Workloads | Exchange Online mail routing, Outlook desktop/web sync, Calendar invites & select Microsoft Teams integrations |
| Stated Root Cause | Internal server/network capacity & configuration issue (not caused by a cyberattack) |
| India Enterprise & Airline Impact | IndiGo, Akasa Air & Air India customer-care email queues briefly disrupted; flight operations & bookings unaffected |
Active Phishing Lure (EX1550543) |
Fake “Service Health / Outage Notification” emails claiming held messages expire in 24h via domains such as moments-notice.com, planetmaison.com & newbooker.com |
How Indian Airlines and IT Services Handled the Disruption
Across India’s aviation and IT corridors in Bengaluru, Hyderabad, Gurugram, and Pune, the multi-day Exchange Online bottleneck underscored corporate reliance on single-vendor cloud productivity suites. Domestic carriers IndiGo and Akasa Air issued proactive passenger advisories noting that customer-support email responses faced temporary backlogs due to the global Microsoft glitch, steering flyers toward mobile apps and AI chat portals while Air India rerouted support traffic. Airline reservation systems, airport departure control, and flight schedules continued without interruption.
How to Spot the Post-Outage Credential Harvesting Attack
According to security telemetry published on Saturday, attackers quickly weaponized IT helpdesk confusion by blasting spoofed messages formatted with subject lines such as “Outage – [6-character code]” and display names reading “Outage Notification” or “Microsoft Service Health”.
Unlike legitimate Microsoft administrative alerts—which never ask individual end-users to re-enter passwords to “release” delayed server queues—the fraudulent emails warn recipients that messages held during incident EX1550543 will be permanently purged within 24 hours unless they authenticate through external tracking links. Chief Information Security Officers (CISOs) recommend blocking known redirect domains at the secure email gateway layer and reminding staff to check status updates strictly inside the authenticated Microsoft 365 Admin Center.
Explore more cloud architecture, cybersecurity, and digital platform reports on our Technology Desk.
