This week’s stories share a common thread: how much of our daily work depends on systems and partners we do not control. A two-day Microsoft 365 outage tested continuity plans worldwide. An AI provider’s breach reached the customers of a company many people have never heard of. Remote management tools became a path into dozens of organizations. United Airlines drew a line on handing AI agents your login. In Missouri, a quick call to the sheriff’s office turned a $38,000 loss into a full recovery.
Microsoft 365 outage stretches into a second day, disrupting Outlook, Teams and Copilot
On Thursday, November 12, Microsoft reported that users in the Americas could not connect to Exchange Online mailboxes. It later identified possible disruption to Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR, according to SecurityWeek.
Microsoft said a large number of servers had become unavailable and that affected servers were failing automated health checks, leaving the remaining systems to carry the load. It said overall traffic had not increased and that there was no indication of malicious activity. The root cause has not been explained.
By Friday the outage was in its second day. The Associated Press reported disruption to governments and businesses in the UK, Europe and Asia. Microsoft described “encouraging recovery progress” while warning that some users may still see intermittent access problems or delayed email. Microsoft is tracking the incident in the Microsoft 365 admin center as MO1550821, and its status account says an extended 48-hour email timeout window is in place to protect delayed messages.
Why it matters
- Email, chat and meetings run through one platform for most organizations, so a single provider issue can stop daily work.
- Delayed messages may arrive in bursts as queues clear, which can affect time-sensitive communication with customers.
- Long outages are a real test of whether continuity plans work in practice.
What organizations should consider
- Confirm who on your team monitors the Microsoft 365 admin center service health page during an incident.
- Keep an out-of-band way to reach staff and key customers, such as a phone tree or text list, that does not rely on Microsoft 365.
- After service returns, check for delayed or missing messages tied to deadlines, invoices or orders.
Original article: SecurityWeek
Supporting coverage: Windows Central
Cape Girardeau County resident ships $38,000 in cash to scammers before deputies recover it
A Cape Girardeau County resident received a call about a supposed charge on his Walmart account, KFVS12 reported. A second caller, claiming to be a federal agent, told him he owed about $100,000 and could settle it through “alternative dispute resolution.” The caller told him not to contact local law enforcement and directed him to ship cash.
The resident shipped $38,000 in cash to an address in California, then became suspicious and reported it to the Cape Girardeau County Sheriff’s Office on Tuesday, November 10. Deputies worked with local UPS personnel, St. Louis airport police and UPS security to track the package. They located it at the St. Louis airport around 3:36 a.m. on November 11 and recovered the full $38,000.
The sheriff’s office advises residents to be wary of anyone who says they owe money, pressures them to send cash, or tells them not to contact law enforcement.
Why it matters
- The scam layered two impersonations, a familiar retailer and a federal agent, to build pressure and urgency.
- Telling the victim not to call police is a clear warning sign.
- Reporting quickly made the recovery possible.
What organizations should consider
- Share this example with employees. The same pressure tactics show up in workplace payment and gift card scams.
- Reinforce that no legitimate agency asks for cash by mail or secrecy from local law enforcement.
- Make it easy for staff to pause and verify any urgent payment request with a known contact.
Original article: KFVS12
United Airlines moves to block AI agents from booking flights and managing reservations
United Airlines will restrict AI agents and assistants that book flights or manage reservations for customers, TechCrunch reported. The restriction applies on United’s own digital platforms and through travel agencies and aggregators. United said it will “prohibit use by unauthorized, third-party personal AI agents or assistants” and is updating its booking, ticketing and distribution policies.
United gave several reasons. It said “sharing account credentials with personal, third-party, AI assistants can expose sensitive information,” and that “actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles.” It also said automated actions could conflict with federal aviation rules, such as the requirement that a person complete check-in and confirm that bags do not contain banned items. United did not say when the restriction takes effect.
TechCrunch noted that Bank of America recently urged customers not to share banking passwords with AI assistants.
Why it matters
- Personal AI agents often work by using a person’s own login, which puts credentials in a third party’s hands.
- Large companies are starting to set their own rules on AI agents, and others may follow.
- Employees may already be using AI assistants for travel booking and other work tasks.
What organizations should consider
- Decide whether employees may give AI agents access to company accounts, and put the answer in writing.
- Review travel and purchasing workflows for places where an agent could act without a person’s review.
- Watch for similar policies from banks, vendors and other services your organization relies on.
Original article: TechCrunch
Supporting coverage: The Record
Hack of an AI provider exposed Notion customers’ AI chat transcripts
Fireworks AI, a platform developers use to access open AI models, confirmed a cyberattack that exposed some customer data, TechCrunch reported. According to Fireworks, the attacker breached its cloud provider and used that access to reach a Fireworks development system, taking customers’ billing information and some datasets. It is the company’s second breach in two months.
Notion is the one confirmed affected customer. Notion said about 1% of its customers were affected and that the stolen data includes chat transcripts from Notion AI customers who used its “Insights” feature, covering “any input to or output from the model that was written to the chat.” Notion disconnected its systems from Fireworks on November 3, deleted the data stored there, and said it could not determine which customers’ data was taken.
Fireworks believes the attackers are financially motivated and aim to sell access to AI models obtained through breaches.
Why it matters
- Information typed into an AI feature can be processed by providers the customer never chose directly.
- Chat transcripts can contain sensitive business details that staff did not expect to leave the application.
- A breach two steps removed still lands on the customer.
What organizations should consider
- Ask SaaS vendors which AI providers process your data and how they are notified of incidents.
- Set clear guidance on what staff should not enter into AI features, such as customer records or credentials.
- Review AI features that are turned on by default in tools your team already uses.
Original article: TechCrunch
ConnectWise investigates ScreenConnect breaches at nearly 50 organizations tied to a third-party extension
ConnectWise is investigating unauthorized access to customers of its ScreenConnect remote access tool after several security firms reported nearly 50 breached organizations, The Record reported. ConnectWise linked the activity to RMM+, an independent third-party extension that lets outside tools control remote sessions through an API. Huntress reported 288 affected endpoints across 48 organizations.
About 400 partner environments had at least one RMM+ family extension installed, though ConnectWise said “their presence alone does not establish compromise.” Attackers deployed additional remote access software and created persistent backdoors. ConnectWise disabled RMM+ in those cloud environments, while on-premises customers must disable it themselves. How attackers first got in is unclear. Researchers tie the campaign to CVE-2026-84869, a ScreenConnect flaw CISA flagged as exploited in September, and Blackpoint Cyber found that a fully patched client blocks the exploit.
In a separate incident this week, SecurityWeek reported that attackers began exploiting newly published zero-day flaws in N-able’s N-central management platform within hours of proof-of-concept code appearing online.
Why it matters
- Remote management tools reach many computers at once, so a single compromise can spread widely.
- Third-party extensions add capability and also add risk.
- ConnectWise warned that “disabling extensions and resetting credentials alone may not remove unauthorized software.”
What organizations should consider
- Ask your IT provider which remote access tools and extensions can reach your systems.
- Confirm remote access software is fully patched and that RMM+ is disabled where present.
- Watch for unusual sign-ins and repeated login failures on remote access accounts.
Original article: The Record
Supporting coverage: SecurityWeek
Vanderbilt University hit by cyberattack as ransomware audio threat plays on campus computers
On Monday, November 9, Vanderbilt University in Nashville announced that it was dealing with “an active cybersecurity incident” that could affect university devices, systems and cloud services, The Register reported. The university told students and staff to shut down university devices and disconnect from campus Wi-Fi.
According to the student newspaper The Vanderbilt Hustler, campus computers played an audio message attributed to the BYOD ransomware group, saying “You have been compromised by BYOD.” By Monday evening Wi-Fi was restored, but access to most university systems remained restricted, and the athletics ticketing system was unavailable. Vanderbilt said its IT team “is working with government agencies and other partners to manage this situation.”
BYOD claimed on its leak site to have taken research data and more than 1 million Social Security numbers. Vanderbilt has not confirmed those claims. Earlier this month, The Record reported that BYOD added Michigan State University to its leak site, a claim the university has not confirmed.
Why it matters
- A clear, fast instruction to power down devices can limit how far an attack spreads.
- Disruption reached everyday services like ticketing, not only core IT.
- Data theft claims from attackers often arrive before verified facts.
What organizations should consider
- Decide in advance who can order devices offline and how that message reaches every employee.
- Plan how staff will keep working when most systems are restricted for days.
- Treat attacker claims as unverified until your own investigation confirms what was taken.
Original article: The Register