On 6 November, the cash machines went dark. A fault at Shinkin Kyodo Center, the shared IT center that runs systems for shinkin (credit union) banks, halted fund transfers, ATMs, online transfers and app transactions at 128 of Japan’s 254 shinkin banks (50.4%) across western Japan. If you banked with one of them, you couldn’t take cash out of a wall. A month earlier, on 16 October, phones across eastern Japan screamed. An Earthquake Early Warning, relayed by J-Alert, announced a magnitude 9.9 earthquake off the Kuril Islands, with the strongest shaking forecast for 22 prefectures from Hokkaido to Aichi, Tokyo included. Eight minutes later, the phones screamed again: the warning had been cancelled. The giant quake never arrived.

In a year like this, the first thought writes itself. We were under attack.

We weren’t.

The shinkin center said the cause appeared to be an equipment failure, not a cyberattack, and the services were later restored. The earthquake warning wasn’t an attack either. The Japan Meteorological Agency ruled a cyberattack out. A real, distant, deep magnitude 6.9 off Kamchatka was briefly read as a 9.9. JMA later said the system had applied a formula meant for earthquakes in Japan to one far away, and that a safeguard introduced after a similar overestimate in 2020, which was supposed to ignore stations more than 700 kilometers from the epicenter, had not been working.

That is the pattern, and it is not confined to these two incidents. Many outages that aren’t attacks still come from decisions people made: lax administration, human error, outdated tools left in place, and the slow pile-up of old systems and quick patches that nobody fully understands any more, what’s often called technical debt. Changes get rolled out without enough testing or a way to undo them. Nobody meant any harm. It still hurts just as much.

This week the same story played out at global scale.

At around 1 p.m. US Eastern time on Thursday 12 November, about 3 a.m. Friday here in Japan, Microsoft 365 started to fall over. Outlook, Teams, Word, Excel, SharePoint, OneDrive and Copilot were all affected. The outage-tracking site Downdetector showed nearly 130,000 reports from users in 74 countries, and Microsoft said it had “no indication of a cyber-attack.” In Japan, the government said its shared IT platform was disrupted.

Microsoft’s updates point to configuration, not crime. Servers began failing automated health checks (the routine tests that decide whether a server is fit to take traffic), which pushed their work onto the remaining servers and overloaded those too. Microsoft found that a process responsible for establishing secure connections was being overwhelmed, began reverting a recent network configuration change, and switched to an alternative health check method.

Early fixes didn’t hold. Servers came back, then fell over again as traffic returned, and Microsoft said one change was “not taking as expected”. As I write this at about 5 p.m. Friday in Tokyo, some 14 hours in, Microsoft’s service status page still shows service degradation. Microsoft says it is seeing “positive results for server stability” after applying a patch, and is working to expand that fix, but it hasn’t announced a full recovery.

ANN reports, in Japanese, on the Microsoft 365 outage affecting Outlook and other services worldwide. Video: マイクロソフトで大規模な通信障害　世界各地でOutlook使用できず…(2026年11月13日) from ANNnewsCH.

Not every outage is the same kind of outage

There are different kinds of outages, and three simple questions help sort them out.

Internal or external? Did it start with your own systems or people, or with a provider, vendor or authority you rely on?
Unintentional or intentional? Was it an accident, such as a bad configuration change, or a deliberate act, such as planned maintenance, a defensive shutdown or an attack?
Nefarious or not? Is someone trying to cause harm?

Of the eight possible combinations, two can’t exist, because malice takes intent: nothing can be both unintentional and nefarious. That leaves six, with one example each.

Example	Internal or external	Intentional?	Nefarious?
Facebook’s own maintenance command, October 2021	Internal	No	No
Microsoft 365, November 2026	External	No	No
Japanese companies switching services off, October 2026	Internal	Yes	No
Microsoft retiring an old email sign-in method, from October 2022	External	Yes	No
Former Cisco engineer deleting Webex servers, 2018	Internal (insider)	Yes	Yes
Arara Message breach, October 2026	External (vendor)	Yes	Yes

Internal, unintentional, not nefarious. The most common kind, even at the biggest companies. On 4 October 2021, Facebook, Instagram and WhatsApp went dark for hours after a routine maintenance command unintentionally took down Facebook’s backbone, the private network linking its data centers. Facebook called it “an error of our own making.” In a small business, it’s a firewall change (the rules deciding which traffic gets in and out) that locks everyone out, or a security certificate, the digital ID that lets browsers trust your site, that quietly expires.

BBC News reports on the 4 October 2021 outage that took Facebook, Instagram and WhatsApp offline. Video: Global outage as Facebook, Instagram and WhatsApp go offline - BBC News from BBC News.

External, unintentional, not nefarious. Microsoft fits here, as far as anyone knows, and so does the shinkin outage. The CrowdStrike outage in July 2024 was the same kind: a faulty update from a security company affected an estimated 8.5 million Windows devices. A vendor makes an honest mistake, and its customers go down with it. Natural disasters fit here too, though they often take out the power, the phone network and your own office together, as I learned in Miyako in 2011.

CNBC reports on the July 2024 CrowdStrike update that disrupted Windows systems worldwide, and notes it was not a cyberattack. Video: CrowdStrike update causes global business outage from CNBC Television.

Internal, intentional, not nefarious. Planned maintenance is the everyday version. A sharper one came on 17 October, when several Japanese companies took whole services offline after detecting unauthorized access or attempts at it. Switching off was the responsible call, made on purpose to limit damage, but customers still lost service.

External, intentional, not nefarious. Sometimes a provider switches something off on purpose, for good reasons. From 1 October 2022, Microsoft began turning off basic authentication in Exchange Online, an old sign-in method that sends a username and password with every request. It was a security improvement announced about three years ahead, yet older email apps and scripts that hadn’t moved on simply stopped connecting.

Internal, intentional and nefarious. The insider. In September 2018, about five months after resigning from Cisco, a former engineer used an access key from his old job to delete 456 virtual servers running Cisco’s Webex Teams app. More than 16,000 accounts were shut down for up to two weeks. When people leave, their access should leave with them.

External, intentional and nefarious. This is Japan’s breach wave. Since October I’ve logged publicly disclosed cyber incidents at Japanese organizations in my Japan Cybersecurity Tracker. As of 12 November it holds 1,513 incidents disclosed between 1 June and 12 November 2026, and 937 of those 1,513 (61.9%) reached the organization through a vendor rather than its own systems. Undisclosed incidents can’t be counted, so every figure is a floor (more in my latest tracker update and the dataset). The Arara Message breach shows how a vendor’s attack becomes your outage. Attackers took roughly 77 million email addresses from client environments and sent up to 7.13 million scam emails through the service itself. The provider shut the service down on 31 October, and its 2 November notice gave no restart date. Up to about 380 client companies lost the channel they used to email their customers.

You often can’t tell at first

In the first hour, these all look alike. Email stops. Logins fail. Is it you, your provider, an attacker or a cut cable? After the cancelled earthquake warning in October, plenty of people went straight to “were we hacked?”. The reflex was understandable.

So the response plan has to work whatever the cause. Work out the why later; meanwhile, people need to keep working safely. That’s what redundancy buys you.

The cause does shape what comes next. Where an attack got through something preventable, it usually reflects missed chances to update systems. Most people involved meant well, often with tight budgets and inherited systems. But too often patches went uninstalled, the government asked for basic security work that didn’t get done, and companies assumed the risk left with the work. As I’ve argued before, you outsourced the work, not the responsibility. The fixes are achievable: update your tools, tighten who has access to what, patch on a schedule, and hold vendors to clear security terms.

You can’t patch your way out of someone else’s outage, though. What you can do is make sure it doesn’t stop you.

Bob and weave

One of the most majestic things to see is a company that can bob and weave with the punches thrown at it, and succeed because of that. Every business gets hit eventually. The ones that come through well decided in advance what to do.

This week someone pointed out that fax machines kept working. Fair enough: keep those lines open. But to rely on them obsessively? Madness in this day and age. As I’ve written about moving a Japanese business off fax, the fax number can stay as a fallback, not the front door.

The better example came from Japan’s own government. Digital Minister Toshiharu Furukawa said agencies that use Outlook “have secured multiple alternative means of communication, such as telephone, chat tools and text messages.” Not one heroic backup, but several ordinary ones, set up in advance.

What redundancy looks like in practice

None of this needs a big budget. Start with the first three: if you can’t sign in, get online or keep the power on, you have no room to move.

A way in when sign-in fails. If everyone signs in through Microsoft or Google (single sign-on, where one account unlocks many tools), an outage there can lock people out of everything. Keep a break-glass admin account: an emergency administrator login outside your normal sign-in system, used only when it fails. Microsoft’s emergency access accounts guide explains the setup. Print recovery codes and lock them away.
A second internet connection. A mobile router or a backup line from a different carrier keeps you online, and many office routers can switch over automatically (failover). Check the backup really uses a different network.
Power for when the grid goes down. A UPS (uninterruptible power supply, a battery unit that keeps equipment running through a power cut) on your router and key machines buys time to keep working or shut down safely. In Japan, where typhoons and earthquakes can cut power for a day or more, that’s ordinary planning.
A second way to talk. If your email and chat both live with one provider, set up a backup on another, plus a simple phone tree. Agree in advance which backup channels are approved, so staff don’t move customer details onto personal accounts.
Don’t put every critical function with one provider. That includes your domain: keep domain registration and DNS (the service that points your domain name to your website and email) separate from your email or hosting provider, so you can redirect mail or your website if one fails.
Backups you can restore offline. Follow the 3-2-1 rule: three copies of important data, on two different kinds of storage, with one offsite or offline (disconnected, so ransomware can’t reach it). Files synced to OneDrive or Google Drive aren’t a backup on their own. Test a restore every few months.
Offline copies of key contacts and accounts. A contact list in Outlook is out of reach when Outlook is down. Keep a printed copy of staff, key customers, vendors and IT support. Add a register of key accounts and their owners, as I describe in shared accounts and logins: who owns what.
A plan you’ve actually tested. A plan nobody has tried is a guess. Once or twice a year, run a tabletop drill: a 30-minute talk-through with key people. Try “Outlook is down; what do we do in the first hour?”, then fix the gaps.
Know your first hour. Who declares an outage? Who tells staff and customers, and how? Who checks for scams riding on the outage? To confirm an outage, go to the source: bookmark key vendors’ status pages, such as Microsoft 365’s, and subscribe to their alerts rather than relying on social media.
Give people the authority to switch. The best backup is useless if moving to it needs a meeting. Write down who can make the call, and let them.

Self-hosting and mesh networks: backups you control

Neither replaces mainstream tools. Think of them as part of the freedom to move.

Self-hosting means running a tool on a server you control instead of renting it. You could keep a backup chat system such as Mattermost or a Matrix server, or file sharing and video calls through Nextcloud. The honest trade-off: when you host it, you own the patching and the security. That’s exactly the work too many organizations in my tracker skipped, and an unpatched backup server is a liability, not a lifeline. If you can’t keep it updated, have a trusted partner run it, or don’t run it.

Mesh networks go a step further. In a mesh, devices relay messages to each other, so nothing depends on one central provider, sometimes not even the internet. Meshtastic uses inexpensive LoRa radios (a low-power, long-range radio technology) to send short texts over several kilometers with no mobile signal. Briar, an Android app, can pass messages phone to phone over Bluetooth or Wi-Fi when the internet is down.

In Japan, earthquakes and tsunamis can overload or knock out phone networks. If you try radios, buy models certified for use in Japan and set them to the Japan region.

Be prepared. Be vigilant. Be nimble.

You won’t always know at first whether you’re facing a vendor’s slip, your own mistake, a deliberate shutdown, an attacker or the weather. You don’t have to. So, again: be prepared. Be vigilant. Be nimble. Have the resources, the knowledge and the freedom to move as needs be when the time comes. That’s within reach for a company of any size.

If you need any help, don’t hesitate to get in touch.

Matt Ketchum