Доголдол кибер халдлага эсвэл хиймэл оюун ухаанаас бус, сүлжээний хүчин чадлын өмнөх шинэчлэлтэй холбоотойг Microsoft мэдэгдэв.
Арваннэгдүгээр сарын 13-ны баасан гарагийн 18:00 UTC-ийн байдлаар Microsoft үйлчилгээнийхээ ихэнхийг сэргээж, тогтворжуулж байгаагаа мэдээлсэн ч Exchange Online-тай холбогддог Microsoft 365 үйлчилгээнд доголдол үргэлжилж байв. 24 цагаас илүү үргэлжилсэн саатлын дараа компани эрэлтийн хэмжээнээс шалтгаалан үйлчилгээг шат дараатай сэргээж, үе шат бүрд тогтвортой байдлыг шалгасан байна.
И-мэйл удаашрах эсвэл нэвтрэх боломжгүй болохоос гадна Microsoft 365 Admin Center-ийн зарим хуудас, Copilot 365 Chat, Intune-ийн төхөөрөмж бүртгэл болон бодлогын зарим үйлдэлд нөлөөлжээ. Microsoft Purview, Teams, Windows 365 Cloud PC-д холбогдоход хүндрэл гарч болзошгүй бөгөөд Word, Excel хэрэглэгчид сүүлд ашигласан файлуудаа харахгүй байх тохиолдол ч байсан. Exchange Online-той холбогдох шаардлагагүй бусад бүрэлдэхүүн хэвийн ажиллаж байв.
20:00 UTC-д нийтэлсэн шинэчлэлээр Microsoft дараалалд хүлээгдсэн мессежүүдийг боловсруулж, сүлжээний урсгалыг тэнцвэржүүлж буйгаа мэдэгдсэн ч бүрэн сэргээх хугацааг тодорхойлоогүй. Нэвтрэх боломж и-мэйл дамжуулалт бүрэн хэвийн болохоос өмнө сэргэж болзошгүй гэжээ.
NCC Group-ийн кибер тагнуул, хариу арга хэмжээ хариуцсан дэд ерөнхийлөгч Мэтт Халл доголдлын дараах тодорхойгүй байдлыг ашиглан халдагчид Microsoft эсвэл байгууллагын IT багийн дүр эсгэж болзошгүйг анхааруулсан. Тэрээр нууц үг шинэчлэх, олон хүчин зүйлийн баталгаажуулалтын хүсэлт зөвшөөрүүлэх, төхөөрөмжид алсаас нэвтрэх эрх өгөхийг шаардсан сэжигтэй хүсэлтийг шалгахыг зөвлөжээ. Microsoft шалгалтаа дууссаны дараа ослын тайлан нийтэлж, хэрэглэгчид болон бизнесүүдэд учруулсан тасалдалд уучлал хүссэн байна.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
After a lengthy Microsoft 365 outage disrupted business around the globe, Microsoft is now restoring services to its customers. As of 6:00 p.m. UTC (1 p.m. ET) on Friday, Nov. 13, Microsoft said that it is seeing broad recovery and stability across its services, although it is still reporting service degradation in Microsoft 365 services that interact with Exchange Online.
“Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration,” the company said on its service health dashboard, noting that the global outage was not caused by a cyberattack or by AI.
It was, Microsoft said, a technical issue “introduced by an earlier network capacity upgrade that surfaced following a recent network change.”
A long list of services has been unavailable or intermittently impacted since the outage began more than 24 hours ago. Currently, the company says that elements of Microsoft 365 products that interact with Exchange Online and email services may be affected in various ways, but components of that don’t rely on that interaction remain functional.
Aside from email itself, which may be delayed or inaccessible, some potentially unexpected products are suffering.
For example, users may not be able to load some Microsoft 365 Admin Center pages, and Cloud Update, Cloud Policy, and Inventory in Microsoft 365 Apps Admin Center are affected. Users may not be able to load Copilot 365 Chat or receive responses from either the web version or the app, and Microsoft Intune device enrollment, device check-in, and device compliance policies “may have been intermittently impacted.” A long list of functions in Microsoft Purview and Microsoft Teams are impacted, and customers who have configured their Windows 365 tenant and Cloud PCs to use Microsoft Purview Customer Key for Windows 365 Cloud PCs may have users who are unable to connect to their Cloud PCs.
As well, users of Microsoft 365 apps such as Word or Excel may be unable to view recently used files.
A Microsoft update posted at 8:00 p.m. UTC (3 p.m. ET) said, “As infrastructure stabilizes, we’re still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes.”
Recovery from the outage creates opportunities for cyber criminals. Matt Hull, vice president of cyber intelligence and response at NCC Group, warned, “cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create. Organizations should remind colleagues to be particularly vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay.”
He noted that social engineering is a particular concern, as attackers impersonate Microsoft or internal IT teams. “We could see attempts to convince people to reset passwords, approve multi-factor authentication requests or provide remote access to their devices,” he said.
Microsoft has promised a full post-incident report once its review is complete, and said in its status update,“We are deeply sorry for the disruption this incident has caused you and your business. We know the trust you place in our services and take that responsibility extremely seriously.”
