When Email Goes Dark: Cybersecurity and Privacy Lessons from the Microsoft Outlook Outage
Introduction
Many people will have started their day as normal on the 12th November; however, Microsoft Outlook went down, causing issues with Teams and Copilot shortly after. This outage was reported by users in over 70 countries. This means that governments, police forces, schools and businesses lost a key communication platform. Whilst this outage was caused by a technical issue, it is reassuring to know that it was not a cyber attack. However, this is still a security incident due to availability being a core part of data security. Here is what happened and what we can learn from it.
What happened?
The outage began in the US on Thursday afternoon. Within an hour, it was reported globally. Downdetector reported that users were unable to access their services in 74 countries and territories. This outage caused issues for many users of Microsoft 365 (around 430 million users). This impacted Exchange Online-based services such as Teams and Copilot. Many organisations including the U.S. House of Representatives, Australian police and Japanese government reported issues. Microsoft stated that there was increased load on their servers. They also stated that they had made "limited progress" after over 12 hours.
By Friday morning the company had resolved the root cause of the issue. However, they were still experiencing issues with queues and were informing users that whilst queues were returning to normal, there were still sporadic issues. They apologised and increased the timeout period to 48 hours to ensure that emails would not bounce. They also stated that there was no estimate at this point for when everything would be back to normal. At the time of writing, I cannot find any confirmation that everything is completely back to normal.
Was it a cyberattack?
This was a fair question to ask almost immediately. Microsoft have repeatedly stated that there was no evidence of malicious activity. They later stated that the outage was a technical issue and had nothing to do with cyber activity or AI agents. Microsoft Executive Vice President Charles Lamanna stated that teams are investigating what happened and how to prevent this from happening again. The timing of the outage did cause speculation, as the FAA issued a rare nationwide ground stop the following day. However, Microsoft have stated that there was no indication that these were related. Officials have pointed to an issue with the communications at air traffic control centres.
It is important to note that any statements made by a vendor are an initial investigation and will be confirmed once a full investigation has been completed. Customers should ask for this investigation.
Availability is a security property
Confidentiality, integrity and availability are usually the first 3 words we learn in any security training. We often focus on the first two. However, this outage reminded us that availability is equally important. Incident response teams will no longer be able to communicate in their usual way. Hospitals and schools will lose a way to contact patients and parents. Automated alerts will no longer be sent. Even AI tools such as ChatGPT and Claude (which link to Microsoft 365) were reported to have issues.
Experts quoted by CBC said that this incident should cause concern. Many organisations rely on a few large technology vendors. This is efficient in normal circumstances but causes issues when things go wrong. The outage caused by one vendor's capacity issues caused issues globally within an afternoon.
The data privacy angle
Although often not mentioned, privacy can be a concern. Emails will be queued up and therefore will be stored in systems and logs that are not easily accessible. Increasing the timeout to 48 hrs will help guarantee delivery but means sensitive emails will be in transit for longer. You should check with your vendors what happens to emails while they are being queued. How are they stored? Who has access? How are they protected?
The bigger concern is human error. If the official tool fails, then staff will look for alternative methods. This could include sending work-related emails to personal accounts, sending communications to consumer-based messaging and sharing files through any links. This will result in personal, client or health data being outside your control. If people are unable to send emails during peak times, then shadow IT will increase. If there isn’t an official alternative channel, then staff will create one.
Attackers will know this. During the outage people are more likely to click on emails that offer updates, password resets or recovery tools. There are often fake alerts and support calls after incidents like this. Best practice is to always go directly to the official Microsoft 365 status page or admin centre.
Regulation and responsibility
Resilience is becoming an expectation. In the European Union GDPR requires organisations to ensure systems that process personal data are available and resilient. The Digital Personal Data Protection Act in India requires reasonable security measures. Neither of these regulations requires no downtime from your cloud providers but does expect you to have thought about what will happen. This should be included in your vendor contracts, SLAs and breach notification clauses. Customers should read these to know what to expect.
What organisations can do now
Make a list of what you’d be unable to do if you lost your emails tomorrow. Make sure you have an out-of-band communication method. This could be another messaging platform with a separate login. Make sure you have key contact lists accessible offline. Do some tabletop exercises assuming your main collaboration suite will be unavailable for a whole day. Make sure you have an alternative method to receive any alerts from your security tools that are sent via email. Make sure you have a spokesperson decided. If you don’t have anyone speaking to customers, then rumours will begin to circulate that there has been a breach.
Conclusion
Whilst this outlook outage seems to have been a technical issue, there are lessons to learn. Availability is as important as confidentiality. Relying on a few vendors will increase risk. Under pressure, staff will look for alternatives if there is nothing safer. Organisations with plans in place to deal with system failures will be protecting their operations and personal data. Microsoft will have their own investigation which should provide more detail. Make sure you read this carefully.
Sources
- NPR: A negative Outlook, Microsoft scrambles to fix email outage
- ABC News: Outlook outage updates, Microsoft apologizes and says there was no hack
- CBS News: Microsoft says it is seeing continued recovery progress
- CNN: Microsoft global outage live updates
- CBC News: No timeline for when Microsoft’s multi-day outage might be fully fixed
- AFP via EWN: Global outage hits Microsoft Outlook
- Outlook India: Microsoft 365 outage affects Outlook, Teams, ChatGPT and Claude
- WESH: Are the Microsoft Outlook outage and FAA ground stop connected?
Related Blogs
Introduction
For more than 10 years, WhatsApp has been designed around one seemingly trivial but impactful idea: your phone number is your digital identity. This concept offered simplicity in terms of contact discovery and onboard- ing but inevitably exposed users to fraud, spam and the everyday necessity of sharing personal phone numbers with complete strangers in group chats and conversations. On June 29th Meta finally revealed a major move: you’ll now be able to choose and reservate a WhatsApp username and communicate without sharing your phone number.
This shift to a username based identity marks the company catching up to platforms like Telegram and Signal, which have utilized this functionality for years.
However, while presented as a push towards greater privacy for the millions using its platform, this new change has already created some alarm around impersonation, cybersquatting, and identity theft. The issues became amplified when, according to reports, the Indian Ministry of Electronics and Information Technology advised WhatsApp to halt the implementation of the new features while it clarifies details, shifting a mundane app update into a high-stakes discussion on digital privacy, platform responsibility, and government regulation.
How does the mechanism work?
“WhatsApp’s username is an added pseudonym layer on its current phone number architecture, not a replacement,” Meta said in a statement on Thursday, as reported by TechCrunch. A WhatsApp username is a three to 35-character name containing lower case letters, numbers, periods and underscores that must contain at least one letter and “should not look like a website address.” The feature will allow you to “reserve a unique identifier that you can share as an alternative to your phone number in WhatsApp Settings - Accounts - Username.”
It said the usernames will work in parallel with a username key which can serve as a passphrase to initiate conversation “with a recipient before sending a message for the first time.”
“The change - which will have some additional, protective measures like reserving usernames for people of public interest or those that would cause impersonation, and rate limits on claiming names - can help maintain phone number protection, while offering people more choices,” Meta said. WhatsApp said usernames will replace phone numbers as the primary way to initiate new chats, but will not be publicly searchable: “Anyone you message would need your exact username, and would still need you to respond.”
The Genuine Privacy Case
The upside is real. Phone numbers double as keys to two-factor authentication, banking apps and SIM-swap fraud, so handing one to a new acquaintance, a group chat of strangers or a customer-support bot has always carried quiet risk. Numbers harvested from public groups already fuel spam and scam campaigns, and a username-first model narrows that exposure considerably.
For journalists, small business owners and anyone who fields messages from people they've never met, decoupling identity from a number that also unlocks their bank account is a meaningful, overdue shift – and one that WhatsApp's closest competitors adopted years ago without major incident.
The Scammer's Paradise Scenario
The trouble lies in what a username removes. A phone number was never just an identifier; it was also a rough verification signal and, for law enforcement, a traceable data point. Security reporters testing the reservation system found that lookalike handles mimicking prominent Indian politicians, film stars and the Reserve Bank of India remained available to claim. Crypto executive Changpeng Zhao's own failed bid to capture his desired handle highlighted the first-come, first-served danger of the rollout and led researchers to advise people to manually activate the optional username key that Meta leaves disabled by default.
The Mozilla Foundation was unvarnished about the tradeoff, noting that impersonation from fake accounts and scams are an “inevitable consequence” of a design that abandons the “implicit signal of authenticity” that comes from owning a phone number.
Indian entrepreneur Ankur Warikoo called the rollout a potential “disaster” if robust enforcement against fraud isn’t immediately applied because scammers could register handles a few characters removed from a popular brand or public figure to launch investment and payment schemes, a concern mirrored by cyber security researchers who observed that many users neglect to check verification badges before trusting an account.
India's Regulatory Scrutiny of WhatsApp's Username Feature
So far the strongest reaction comes from New Delhi. The Ministry of Electronics and Information Technology (MeitY) issued an official notice to Meta's compliance office that it should “temporarily suspend the feature” in the country pending further consultations and “provided an explanation in three days”. The cited concerns involve “digital arrest” fraud, a rapid boom category that involves crooks impersonating investigators like those with India's CBI, judges or customs agents to extort victims, in addition to standard concerns around phishing and bank or government impersonation.
A subtler concern, for India’s government anyway, is “traceability.”
At present, say officials, an Indian mobile number is a launching pad to determine whether a given suspect is a domestic or international actor, while a username and foreign SIM would leave authorities nowhere to begin. The Department of Telecommunications independently voiced concerns over how the change intersects with its SIM-binding regulations and over WhatsApp's lag time for such requests. The MeitY notice, the legal basis for which, incidentally, is in contention with some digital rights groups, specifically invokes Section 79 of the IT Act and various IT Rules from 2021 and provisions on identity theft and impersonation that target individual criminals rather than the tech tools. Not everyone, however, shares MeitY’s reading of the legal ground: the Internet Freedom Foundation says that Section 79 “deal with liability of intermediary” and “does not confer on the government power to license the features of a product,” while arguing the relevant criminal statutes were designed to criminalize impersonators, not tech platforms whose services are misused, echoing concerns that killed a similar government advisement about AI models last spring.
In the meantime, Meta says usernames are unavailable in the country for now and the multilayered safeguards it designed were always intended for exactly this level of risk.
Conclusion
WhatsApp's username feature is neither a total privacy upgrade nor a major security problem; instead, it reallocates risk, reducing phone number exposure while adding a risk of identity spoofing and misuse. Whether it pays off will hinge on the strength of Meta's crackdown on fraudulent usernames, the uptake of extra security features like the username key and whether the company can adequately satisfy regulatory concerns about traceability and user safety. Until all those questions are fully settled, users may want to use the feature tentatively, secure a desired username, enable any other protections and be watchful about new contacts.
References
- https://blog.whatsapp.com/its-time-to-reserve-your-whatsapp-username
- https://www.businesstoday.in/technology/news/story/whatsapp-usernames-why-indias-top-creators-fear-scams-impersonation-and-identity-theft-540359-2026-07-02
- https://www.outlookindia.com/national/outlook-explains-why-is-the-indian-government-worried-about-whatsapp-usernames
- https://techcrunch.com/2026/06/29/whatsapp-now-lets-you-reserve-usernames/
- https://bestmediainfo.com/mediainfo/mediainfo-digital/whatsapp-says-username-feature-not-live-yet-after-meity-asks-meta-to-pause-rollout-12124813
Executive Summary
An image of a purported new ₹500 plastic banknote is being widely shared on social media. Users claim that the Reserve Bank of India (RBI) has issued the new note and replaced Mahatma Gandhi’s portrait with the Ashoka Pillar.The CyberPeace Research Wing research found the claim to be misleading. The probe revealed that RBI has not issued any new ₹500 plastic banknote. Furthermore, no official announcement or decision has been made regarding the removal of Mahatma Gandhi’s portrait from Indian currency and its replacement with the Ashoka Pillar.
Claim
An Instagram user shared the viral image with the claim: “RBI has issued a ₹500 plastic note in which Mahatma Gandhi’s image has been removed and replaced with the Ashoka Pillar.” The claim has been widely circulated on social media, with many users sharing the image as genuine. The post link, archived version, and screenshot can be seen below.
Fact Check
To verify the claim, we conducted a keyword search on Google. However, we found no credible media reports suggesting that RBI had issued a new ₹500 plastic note featuring the Ashoka Pillar in place of Mahatma Gandhi. We then searched the official RBI website for any notification or announcement related to the claim. Our search yielded no official communication supporting the viral claim.
During the research, we also came across a report published by Business Standard. According to the report, the Reserve Bank of India is exploring the possibility of introducing polymer (plastic) currency notes in the future. The report states that RBI is studying and discussing the proposal in view of the growing global adoption of polymer notes and their greater durability. However, the report does not state that RBI has already issued a new ₹500 plastic note. Nor does it mention any decision to remove Mahatma Gandhi’s portrait from existing currency notes and replace it with the Ashoka Pillar.
- https://www.business-standard.com/finance/news/rbi-set-to-unveil-polymer-rupee-notes-amid-rising-currency-demand-126052801725_1.html
Conclusion
The research found that the viral claim is misleading. RBI has not issued any new ₹500 plastic banknote, and there has been no official announcement or decision to replace Mahatma Gandhi’s portrait on Indian currency with the Ashoka Pillar.
Executive Summary
A misleading advertisement circulating in social media providing attractive offers like iPhone15, AirPods and Smartwatches from the Indian e-commerce platform ‘Myntra’. This “Myntra - Festival Gifts” scam aims to attract the unsuspecting users into a series of redirects and fake interactions to compromise their personal information and devices. It is important to stay vigilant to protect ourselves from misleading attractive offers. Through this report, the Research Wing of CyberPeace explains about a series of processes that happens when the link gets clicked. Through this knowledge, we aim to provide awareness and empower the users to guard themselves and not fall into deceptive offers that aim to scam them.
False Claim
The widely shared WhatsApp message claims that Myntra is offering a wide range of high-valued prizes including the latest iPhone 15, AirPods, various smartwatches among all as a Festival Gift promotion. The campaign invites the users to click on the link provided and take a short quiz to be eligible for the prize.
The Deceptive Scheme
- The link in the social media post is tailored to work only on mobile devices, users are taken through a chain of redirects.
- Users are greeted with the Myntra's "Big Fashion Festival" branding accompanied by Myntra’s logo once they reach the landing page, which gives an impression of authenticity.
- Next, a simple quiz asks basic questions about the user's shopping experience with Myntra, their age, and gender.
- On the bottom of the quiz, there is a comment section that shows the comments from users who are supposedly provided with the prizes to look real,
- After the completion of the quiz, users are presented with a Spin-to-Win mechanism, to win the prize.
- After winning, a congratulatory message is displayed which says that the user has won an iPhone 15.
- The final step requires the user to share the campaign over WhatsApp in order to claim the prize.
Analyzing the Fraudulent Campaign
- The use of Myntra's branding and the promise of exclusive, high-value prizes are designed to attract users' interest.
- The fake comments and social proof elements aim to create a false sense of legitimacy and widespread participation, making the offer seem more credible.
- The series of redirects, quizzes, and Spin-to-Win mechanics are tactics to keep users engaged and increase the likelihood of them falling for the scam.
- The final step of sharing the post on WhatsApp is a way for the scammers to further spread the campaign and compromise more victims. Through sharing the link over WhatsApp, users become unaware accomplices that are simply assisting the scammers to reach an even bigger audience and hence their popularity.
- The primary objectives of such scams are to gather users' personal information and potentially gain access to their devices. By luring users with the promise of exclusive gifts and creating a false sense of legitimacy, the scammers aim to exploit user trust and compromise their data, leading to potential identity theft, financial fraud, or the installation of potentially unwanted softwares.
- We have also cross-checked and as of now there is no well established and credible source or any official notification that has confirmed such an offer advertised by Myntra.
- Domain Analysis: If we closely look at the viral message, it is clearly visible that the scammers mentioned myntra.com in the url. However, the actual url takes the user to a different domain as the campaign is hosted on a third party domain instead of the official Website of Myntra, this raised suspicion. This is the common way to deceive users into falling for a Phishing scam. Whois information reveals that the domain has been registered not long ago i.e on 8th April 2024, just a few days back. Cybercriminals used Cloudflare technology to mask the actual IP address of the fraudulent website.
- Domain Name: MYTNRA.CYOU
- Registry Domain ID: D445770144-CNIC
- Registrar WHOIS Server: whois.hkdns.hk
- Registrar URL: http://www.hkdns.hk
- Updated Date: 2024-04-08T03:27:58.0Z
- Creation Date: 2024-04-08T02:58:14.0Z
- Registry Expiry Date: 2025-04-08T23:59:59.0Z
- Registrar: West263 International Limited
- Registrant State/Province: Delhi
- Registrant Country: IN
- Name Server: NORMAN.NS.CLOUDFLARE.COM
- Name Server: PAM.NS.CLOUDFLARE.COM
CyberPeace Advisory and Best Practices
- Do not open those messages received from social platforms in which you think that such messages are suspicious or unsolicited. In the beginning, your own discretion can become your best weapon.
- Falling prey to such scams could compromise your entire system, potentially granting unauthorized access to your microphone, camera, text messages, contacts, pictures, videos, banking applications, and more. Keep your cyber world safe against any attacks.
- Never, in any case, reveal such sensitive data as your login credentials and banking details to entities you haven't validated as reliable ones.
- Before sharing any content or clicking on links within messages, always verify the legitimacy of the source. Protect not only yourself but also those in your digital circle.
- For the sake of the truthfulness of offers and messages, find the official sources and companies directly. Verify the authenticity of alluring offers before taking any action.
Conclusion:
The “Myntra - Festival Gift” scam is a kind of manipulation in which the fraudsters exploit the trust of the users and take advantage of a popular e-commerce website. It is equally crucial to equip the users by imparting them knowledge on fraudulent behavior tactics like impersonating brands, creating fake social proof and application of different engagement strategies. We are required to remain alert and stand firm against cyber attacks. Be careful, make sure that information is verified and share awareness to help make a safe online environment for all users.
