Friday, 13 November 2026

Global Microsoft 365 outage takes down Teams and Outlook

A global Microsoft 365 outage took down Teams and Outlook on Friday, with Word and Excel also reported affected. Microsoft was still working to restore services at midday, and it says it has ruled out malicious activity as the cause. In the Netherlands, municipalities, courts and universities were hit, and thousands of users were affected. BBC reporting points to a server outage. Treat the stated cause as Microsoft's own account until an incident review is published. The practical lesson is dependency. Email, chat, calendars and document access sat on one vendor, and when it failed, staff lost their normal channels at once. Security teams should check that incident response plans do not rely on the affected platform for alerts, call trees or crisis communication. Confirm that out-of-band contact lists and a secondary messaging route are current and tested. Watch for phishing that exploits the confusion, such as fake service restored or password reset notices. Document which business processes stalled, and for how long, so recovery targets can be tested against real data.

Our cyber security team helps organisations test incident response plans that assume the main collaboration platform is down.

Iran threatens unlimited response over Hormuz after US attack

Al Jazeera reports that Iran has threatened an unlimited response over the Strait of Hormuz after a US attack. Euronews reports that the IRGC claims it destroyed a US radar in Bahrain after the strike on southern Iran. That claim comes from a party to the conflict and has not been independently verified here. NOS notes that oil exports are recovering towards pre-war levels and petrol prices are falling, so calmer conditions had begun to return. A renewed Hormuz threat puts that recovery at risk. For European organisations the exposure is indirect but real: freight and insurance costs, fuel supply, delayed cargo, and staff or assets in the Gulf. The claimed strike in Bahrain shows that Gulf sites near US assets can be targeted. Companies with Gulf operations should review travel approvals, confirm duty-of-care contact lists, and check evacuation routes and trigger points. Logistics teams should ask carriers about rerouting plans and surcharge triggers. Security directors should brief executives on what would prompt a change in travel status.

Our advisory and intelligence desk tracks Gulf developments and turns them into travel and duty-of-care decisions for clients.

Russian warship hit by Ukrainian drone in Gulf of Finland

A Ukrainian drone hit a Russian warship in the Gulf of Finland, according to the BBC. Al Jazeera asks why Kyiv is attacking Russian warships in the Baltic Sea while peace talks are under way. The strike moves the war into waters bordered by several EU and NATO states, close to busy commercial routes. Details on damage and casualties are not in the headlines, so treat the scale as unconfirmed. The risk for business is spillover rather than direct targeting: GPS interference, navigation warnings, temporary closures, and new questions from insurers for vessels and ports in the region. Retaliation against Ukrainian or allied shipping is a further possibility, though nothing reported so far points to it. Shipping and port operators should review their Baltic voyage plans and bridge procedures for interference. Energy and cable operators should confirm their monitoring and reporting channels with national authorities. Security teams with Baltic port exposure should brief staff on how to report suspicious craft and drones.

US pushes for European seat at Ukraine-Russia talks; Moscow won't confirm

The US is pushing to bring European negotiators into Ukraine-Russia talks, which Zelensky welcomes. Moscow has not confirmed it. The Kremlin says Europe may take part 'if it contributes to the peace process', while EU foreign policy chief Kallas warns that Europe should not walk into Russia's 'traps'. Four outlets carry the story, but the substance is still a negotiating position, not an agreed format. It matters because European seats at the table would shape sanctions relief, security guarantees and any ceasefire monitoring, all of which carry compliance and operating consequences for European firms. Russian conditions on participation may also be used to divide European governments. Companies exposed to Russia sanctions, defence supply chains or Eastern European operations should map which outcomes would change their obligations. Compliance teams should keep sanctions screening current and avoid assuming relief before legal texts exist. Corporate security should expect more hybrid activity and information operations around the talks, and should brief executives travelling to the region.

NATO issues, then withdraws, Russian taxi app advice for defence conference

The Record reports that NATO issued and then withdrew travel advice about a Russian taxi app for a defence industry conference. The headline does not say why the guidance was pulled, and no second outlet carries the story, so the reason remains unknown. The episode still points at a real exposure: ride-hailing and other travel apps collect location, schedule and contact data, and that data can reveal who attends sensitive events and when. Defence suppliers and their staff are natural targets for collection, whether by state services or by criminals. Reversals in official guidance also create confusion about what is actually advised. Organisations sending staff to defence or government events should set their own rules on transport apps, using vetted car services or pre-booked drivers where the risk warrants. Travel briefings should cover device settings, location sharing and what not to discuss in vehicles. Security teams should check which apps on corporate devices request location access.

Executive protection planning covers secure transport and travel-app discipline for staff attending sensitive events.

Two detained over railway sabotage that disrupted trains on Budget Day

Dutch police have detained two people over railway sabotage that disrupted train services on Budget Day, according to NOS and NL Times. Reports do not say who the suspects are, what the motive was, or how the sabotage was carried out. The case matters because rail is critical infrastructure that depends on long, open lines, and because a small act can stop services nationwide for hours. Sabotage timed to a high-profile day also raises the question of whether the aim was disruption, publicity or testing response times. Further arrests or claims of responsibility could change the assessment. Operators and logistics firms that rely on rail for staff or freight should keep alternative transport plans ready for peak days. Site owners near rail lines should review perimeter checks and camera coverage, and agree a clear route for reporting suspicious activity to rail operators and police. Facilities with commuter-dependent shifts should confirm how they communicate delays to staff.

Alarm and mobile response gives sites near rail lines a fast way to verify and act on perimeter alerts.

Police find 3D-printed brass knuckles and firearms in Eindhoven home

Police found 3D-printed brass knuckles and firearms in a home in Eindhoven, NOS reports. The headline gives no detail on arrests, the number of weapons or whether the guns were also printed, so those points remain open. The find matters because home 3D printing lowers the barrier to producing weapons that are hard to trace and can bypass the usual supply routes. For corporate security the issue is practical: venues, offices and events may face visitors carrying items that do not look like conventional weapons, and plastic parts may escape basic metal detection. Treat this as an early indicator, not a trend, until more cases are reported. Organisations running public-facing sites should review search procedures and signage, and brief guards on what printed weapons can look like. Hospitality and event operators should agree how staff escalate a suspected weapon without confronting the person alone. Incident reporting should capture these items so patterns become visible to police liaison officers.