Several UK government departments, hospitals and schools have said they cannot send or receive email messages due to the global outage of Microsoft Exchange, which has impacted organisations that use Microsoft 365 products.
The Planning Inspectorate’s Manage Appeals Service said it has been temporarily paused for new submissions and customer access due to an email and system problem, and the Medicines and Healthcare Products Regulatory Agency claimed it has been experiencing issues sending and receiving emails, and that it has provided a phone number for urgent queries.
The Maritime and Coastguard Agency also wrote that it was experiencing problems sending and receiving emails due to the worldwide Microsoft outage, but added that its search and rescue services have not been affected.
Police Scotland said: “We are unable to receive any emails, and there may be a delay in responding to any forms sent to us in the last 24 hours as this outage continues.”
Merseyside police wrote in a post that it had staff on duty 24/7 to answer non-emergency queries on Facebook, X and Instagram.
The NHS reported that staff were working to ensure critical services and appointments continue for patients, despite the outage. It urged patients to attend appointments as usual unless told otherwise.
Mersey Care NHS Foundation Trust stated that it was aware of the outage but that teams were still available by phone to manage any urgent referrals.
Glasgow City Council said it was experiencing disruption to some services, and that schools had texted parents and carers to alert them.
Walsall Council posted that people might experience intermittent issues accessing council services online or receiving notifications, but that phones were still working.
The Royal Borough of Kensington and Chelsea said residents my “find it harder than usual to contact us, and it could take us longer to respond”.
A number of schools said their email systems were not working and advised parents to contact them by phone or in person, while the UK’s Supreme Court reported that it was not receiving emails, its online contact forms and portal were still functioning as normal.
As Computer Weekly has reported, more than 130,000 users logged problems with Outlook on Downdetector at its peak, demonstrating the economic and human costs of relying heavily on a single technology provider, which has left businesses and public services vulnerable to facing disruption.
There is also a potential cyber risk given that Microsoft security products including Microsoft Defender and Intune have been impacted by the outage, as well as its data protection and IT governance tool, Purview, which provides authorisation, data loss prevention and role-based access.
Even as some services become available, the job for IT admins is only just starting due to service degradation affecting Microsoft cyber security, data protection and compliance tools, which means hackers have had a window of opportunity to target organisations impacted by the outage.
Marie Wilcox, vice-president of market strategy at Binalyze, said: “The wisest approach is for security teams to treat the outage window as an incident in its own right. That means going back over sign-ins, mailbox rules, account changes and endpoint activity from the hours when visibility dropped, and collecting evidence directly from devices rather than relying on the platform that was down. Most will find nothing. But ‘probably nothing’ isn’t an answer a board, regulator or insurer will accept, and it’s exactly the assumption attackers count on.”
