How a wrong cause travels: "unusually high demand"

On Thursday evening Microsoft told the world that its email outage was not caused by a surge in traffic. A handful of news reports said the opposite: “unusually high demand”. In LSN News, my news engine, about 80 articles carried Microsoft’s actual wording and only about 6 carried the wrong one. And yet the wrong one made it into my own AI-written brief of the story. This post is about how that happened, what I am changing, and what it teaches anyone who reads news or reads AI summaries of news.

Contents · 10 sections

TL;DR #

• Microsoft said the elevated load on its servers “wasn’t driven by an increase in traffic”. About 80 articles reported that correctly; about 6 said “unusually high demand”.
• LSN News’s own AI brief picked up the wrong version from two outlets, because it was written two hours into the story and never refreshed.
• Two fixes are in place: briefs now refresh by story size and growth, and conflicting causes are weighed, with the party’s own statement first.
• Cyberattack headlines were 1 to 2 percent of the coverage, mostly denials. Two Greek sites stated it as fact early; nothing supports them.
• For readers and AI summaries alike: go to the primary statement, check the majority wording, and watch the clock.

What Microsoft actually said #

Microsoft 365 went down on 12 November. Microsoft dates the start of impact to about 16:17 UTC, according to NBC News, and users noticed at scale around 17:50 UTC.

In its first updates that evening, Microsoft said “a portion of infrastructure is experiencing elevated load across multiple regions”. Then it clarified. According to Fox Business, quoting the Microsoft 365 admin center, the elevated load “wasn’t driven by an increase in traffic”, but by “a number of servers being unexpectedly unavailable, straining the remaining infrastructure”. ZDNet, BleepingComputer and The Register reported the same.

On Friday Microsoft went further and tied the start to “an earlier network capacity upgrade”, which it was rolling back, according to NBC and Al Jazeera. The final root cause waits for Microsoft’s post-incident review, which, as of 13 November, has not been published.

So the documented chain is: a change, then servers failing health checks and dropping out, then the remaining servers overloaded. High load, yes. High demand, no.

How “elevated load” became “unusually high demand” #

You can see the mistake forming. “Elevated load” is engineering language. To most readers, and to many reporters on deadline, load sounds like people using it. Paraphrase it once and you get “high demand”. The clarification (“not traffic”) came in a later update, and not everyone went back to their copy.

Here is what LSN News found in the text of the outage coverage:

• About 80 articles from 78 outlets carried the correct wording: “not driven by an increase in traffic” or “servers being unexpectedly unavailable”. The first appeared around 20:00 UTC on Thursday.
• 6 articles carried the demand version. Three were American local TV stations running the same copy (“a portion of its infrastructure was experiencing unusually high demand across multiple regions”). One was a Pacific news site. Two were BBC explainers on Friday that said Microsoft blamed “a higher-than-usual stress on its servers”.

That is about 13 to 1 for the correct version. The wrong cause was not a rumour that spread. It was a paraphrase that a few desks made early and didn’t revisit.

My own brief got it wrong #

LSN News writes a short AI summary for big stories: a headline, key points, who said what, and which claims are disputed. For this outage, the brief says:

“The company identified unusually high demand on infrastructure as a likely cause.”

Its claims list attributes “unusually high demand contributed to the connectivity problems” to two outlets, a US local TV station and an Italian regional paper, and marks it as not disputed.

That is wrong, and it is my system that said it. I want to be specific about why, because the reason is more useful than the apology.

The brief was stale. It was written at 20:38 UTC on Thursday, from the first 176 articles, when the story was barely two hours old and the clarification had only just started to appear. Then it was never refreshed, while the story grew past 4,600 articles.

Why? The queue that decides which briefs to write always served stories with no brief first. On a busy news day that left room for only about five refreshes a day. When we looked, 290 big stories had stale briefs, and 36 of them had grown three times or more since their brief was written.

The brief also had no rule for conflicting causes. It recorded a claim from two outlets as if it were settled, because nothing in its first 176 articles contradicted it strongly enough.

What is being fixed #

Two changes are now in place in the brief pipeline:

1. Refreshes go where the story moved. The refresh queue now ranks stories by size, weighted by how much they have grown since their last brief. A story that went from 176 articles to 4,600 jumps the queue.
2. Causes are weighed, not copied. When outlets give different causes, the brief now reports the majority version and marks the others as disputed. A statement from the party itself (the company, the agency, the regulator) outweighs an outlet’s paraphrase. A minority cause is never stated as fact.

The outage brief was rewritten at 19:31 UTC on Friday, from 4,795 articles, under the new rules. It now says the cause was a process on the affected servers becoming overwhelmed, marks the “high server load” and third-party-failure versions as disputed, and adds that it was not a cyberattack or a traffic spike. The words “unusually high demand” are gone.

The other wrong cause: was it a cyberattack? #

The second question every big outage raises is “were we hacked?”. Here the data is reassuring, with one caveat I did not expect.

Depending on how wide you cast the keyword net, between 44 and about 90 headlines out of more than 4,500 in the story mention a cyberattack, hacking or sabotage. That is 1 to 2 percent. Most of them are denials: “Microsoft rules out cyberattack” (The Economic Times), “aucun signe d’action malveillante ou de cyberattaque” (Le Figaro, franceinfo), “geen hack” (NOS), “Microsoft исключила признаки кибератаки” (Russian-language outlets). The first denial headline I found was on Romania’s Știrile ProTV at 06:12 UTC on Friday.

Microsoft’s own wording moved from “no indication this is the result of malicious activity” in the early hours of Friday to “not related to cyber or AI/agents” in the afternoon, according to The Register and NBC. Australia’s Home Affairs Minister said on Friday that Microsoft did not believe it was a cyber event, according to ABC News.

The attack-raising headlines were mostly questions: “Is Microsoft Outlook Outage a Cyberattack?” (IBTimes UK), “Is a cyberattack behind…?” (several Indian tech sites). IBTimes UK kept an “insider threat” angle going on Friday afternoon, after the denials.

The caveat: when I re-ran the count for this post, I found two Greek sites that stated it as fact in a headline on Thursday evening, before any denial: one said Teams, Outlook and Copilot “collapsed after a wave of cyberattacks”, the other reported “extensive problems after cyberattacks on Outlook”. One of the two dropped the claim in its later stories. A Pakistani site’s article also said Australia’s federal police had been “hit with a new wave of attacks”. So “no outlet claimed an attack” is not quite true. A handful did, early, and nothing supports them.

There is also a subtler way an “attack” impression forms. On Thursday a separate story warned about an exploited Outlook security flaw. AOL ran a headline joining the two: “Microsoft Hit By Dual Crises: Global Server Outages And Active Outlook Security Hack”. No source said the hack caused the outage. Put the two in one headline and readers will connect them anyway.

Checklist for readers #

Three habits would have protected you from both wrong causes:

• Go to the primary statement. Microsoft’s status posts were quoted widely and they were clear. When an article gives a cause, ask: whose words are these? The company’s, or the reporter’s summary?
• Check the majority wording. If 80 reports say “not traffic” and 6 say “demand”, the 6 are not “another view”. They are probably a paraphrase.
• Watch the clock. Early explanations are provisional. The demand wording was still being published at 23:30 UTC on Thursday, hours after Microsoft’s correction, and the BBC used its own version of it on Friday.

In my library, Walter Lippmann put the limit of the press plainly a century ago, in Public Opinion: the press “can normally record only what has been recorded for it by the working of institutions. Everything else is argument and opinion”. The status page is the institution’s record. The paraphrase is already opinion.

What this means for AI summaries #

An AI summary has the same weaknesses as a hurried reporter, plus one: it sounds equally confident about everything. Mine took a claim from two outlets, found nothing in its narrow window that contradicted it, and printed it as a key point.

So the rules I am now holding my own system to are rules I would apply to any AI summary of news:

• A summary is only as current as the articles it was built from. Ask when it was written and from how many articles.
• A claim needs a count. “Two outlets say X” is not the same as “X”.
• The party’s own statement outranks a paraphrase, and a minority cause is never fact.

Frequently asked questions #

What caused the Microsoft 365 outage of 12–13 November 2026? #

According to Microsoft’s preliminary updates, a change (later described as a network capacity upgrade) led servers to fail health checks and drop out, and the remaining servers were overloaded. The post-incident review, not yet published as of 13 November, will give the final cause.

Was it caused by unusually high demand? #

No. Microsoft said the elevated load “wasn’t driven by an increase in traffic” but by servers being unexpectedly unavailable. “High demand” was a paraphrase in a handful of reports.

Was the outage a cyberattack? #

Microsoft said it saw no sign of malicious activity and later called it a technical issue not related to cyber. No evidence I found supports an attack.

Why did the LSN News brief repeat the wrong cause? #

It was written at 20:38 UTC on Thursday from the first 176 articles and not refreshed as the story grew, and it had no rule for weighing conflicting causes. Both problems have been changed, and the rewritten brief now gives Microsoft’s own explanation.

How can I tell if an AI summary of news is reliable? #

Check when it was written and from how many articles, whether a claim is backed by a count of sources, and whether it quotes the primary party rather than a paraphrase.

The lesson #

A wrong cause rarely travels as a rumour. It travels as a paraphrase written early and never revisited, and an AI summary can freeze that paraphrase and repeat it with confidence. The cure is the same for people and machines: count the versions, go to the party’s own words, and check the time stamp. LSN News labels every AI text, and the original articles are always one click away on the story page. This week that click mattered.