One Company's Bad Upgrade Froze Hospitals in 74 Countries

A network capacity upgrade at Microsoft knocked its products offline in 74 countries and territories, according to the outage tracker Downdetector, and the people who felt it first were patients, visa applicants and schoolteachers. NHS staff taking emergency calls were "unable to refer patient details in the normal way," said Rachel Harrison, public services head at the GMB union, creating what she called a massive backlog. One company's maintenance error. A hospital system's paralysis.

Who Gets Crushed

The outage started Thursday and kept rolling. It disrupted healthcare services, delayed corporate earnings reports and left schools struggling to communicate. Immigration New Zealand halted processing of every visa application. Airlines in India, including IndiGo and Akasa Air, warned that customer queries might not be getting through after their email support services went down. Japan's economy, trade and industry minister Ryosei Akazawa warned of a "significant impact" because Microsoft products are used by a "vast number of people."

At the bottom of the chain, the shrug was practical. Sheera, a risk manager at a mid-sized bank who declined to give her last name, said: "You wake up and Outlook is not working and it's the main communication we use for our global team." Prins Ralston, CEO of the Australian Computer Society, pointed out that small businesses may not have any workaround when Outlook fails. The big players get recovery teams. Everyone else gets a loading screen.

Who Has the Power

Microsoft said it was "deeply sorry" and reported "broad recovery." It ruled out "cyber or AI" activity and blamed "elevated load" on its infrastructure after a network capacity upgrade. By Friday the explanation had shifted: the "incident was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change." The company first said it was investigating reports "in the Americas," then admitted the issue apparently affected "Microsoft 365 service connectivity for users in any region."

The recovery itself stumbled. Just after 9am AEST Microsoft announced a "gradual recovery." An hour later, servers were becoming unresponsive again, and the company spent the day reporting ups and downs. Customers, partners and patients got the apology. Nobody got a say in how the infrastructure they depend on gets managed.

Andrew Cullen of the University of Melbourne, who specialises in cybersecurity and artificial intelligence, laid out the dependence plainly. "Most of our emails come through either Microsoft or Google. Most of our websites are managed under the hood by Amazon or a few other kind of key cloud providers. So, it's really challenging for us all to kind of have control of our own digital destiny," he said.

Toby Murray, who previously worked for the Department of Defence, described how organisations got here. The usual path over the last 10 to 15 years has been moving to cloud services, and "it is a real challenge once you move these systems into the cloud and when we all rely on a very small number of vendors." Building alternatives would be more expensive, he said, and "you're then responsible for maintaining them yourself." Cheaper and often more secure to stay put, in other words. That's how a handful of vendors become unavoidable.

The Regulation Reflex

The proposed fixes arrive on cue. The Australian Computer Society wants a national review of sovereign IT risk. Cullen said governments should treat these services as not "too big to fail" and make them "as robust as our banking system is through legislation, through oversight and regulatory controls." The same oversight model that governs the banks. Cullen also suggested Australia could invest in services that are "Australian made, Australian owned, Australian controlled," though he added that Australia probably shouldn't shed Amazon or Microsoft entirely, "because these companies do provide good services." Swap one landlord for a local one, keep the lease.

Toby Walsh, chief scientist at the UNSW AI Institute, offered the bleakest read. "I hate to be a doom monger, but we're discovering that the foundations of the internet are somewhat shaky," he said, pointing to vulnerabilities in PHP, used by more than two-thirds of websites, that led to millions of hacking attempts. Last month, hackers launched a "large-scale" attack on French supermarkets, raising refrigerator and freezer temperatures at hundreds of stores to as high as 50 degrees Celsius, causing fires and spoiling food. Walsh said digital systems are critical assets like power stations and air traffic control.

The Alternative

There's one model on the table that doesn't involve a new boss. In April, about seven months ago, the French government announced it would move its operating systems from Microsoft to Linux, a free open-source operating system. Cullen said France is leading Europe's digital sovereignty push, with its own versions of Zoom and Teams, and that authorities in Germany and Austria are reassessing their dependency on US-based technology companies. Free, open-source software that nobody owns. Cullen also asked the question the whole episode raises: which things actually need to be connected to the internet?