With core communications stalled, BCS leaders call for tested disaster recovery plans, strict data discipline and greater diversity across critical digital infrastructure
Summary
A global Microsoft outage has knocked out Outlook, Teams and Copilot. Schools, the NHS and local councils are among those hit. BCS, The Chartered Institute for IT, says it is unlikely to be a cyber-attack
It’s a resilience issue, not a cyber issue, says Patrick Burgess FBCS; with only Microsoft and Google running most email, too many eggs sit in too few baskets
Keep work off personal WhatsApp and home email, advises Adam Leon Smith FBCS; these workarounds are less secure and Under UK GDPR they can also lead to ICO fines
Max Hemmingway FBCS urges firms to check when they last tested their disaster recovery plan and test them now. Professor Dame Wendy Hall DistFBCS says supplier diversity is the answer
Mike Lloyd FBCS calls for cloud concentration to be treated as a national security risk, and public-sector contracts to require interoperability and clear exit routes, plus investment in UK-owned infrastructure
Following a global service outage, swathes of Microsoft customers are struggling to access core digital services such as Outlook for email, Teams and Copilot.
The incident has left organisations struggling to operate internally and to communicate effectively with customers externally. It’s widely reported that schools, the NHS and local authorities are having problems.
Though the exact cause of the outage has not yet been disclosed by Microsoft, it seems unlikely to have been caused by a malicious cyber-attack.
Summing up the outage thus far, Professor Dame Wendy Hall FRS FREng DistFBCS Dame Wendy Hall, Regius Professor of Computer Science at the University of Southampton, Director of the Web Science Institute and Distinguished Fellow of BCS said: 'We depend on digital services and the internet more than we realise. We take them so much for granted, we only notice our dependence when they don’t work. Critical services such as the NHS, the emergency services and government itself all rely on them. When they fail we, as a community of tech professionals, must study the incidents closely and learn from them.’
‘We have a lot of eggs in very few baskets at the moment – and this is more so with email than with cloud.’
Patrick Burgess FBCS said: ‘One of the hardest parts of this is you lose the ability to do mass communication by the usual methods. It’s a resilience issue not a cyber issue.’
Going further, Wendy Hall said: ‘We are so dependent on the big US tech companies we need to build resilience into our systems in case of failure just like we use emergency generators when the electricity fails. Diversity is the key.’
Max Hemmingway FBCS said: ‘The outage highlights areas businesses need to reflect on. When was the last time your [disaster recovery] plan was tested?’
This a serious and evolving incident and it highlights IT's ever-growing criticality in life and in the economy', said Sharron Gunn, BCS’ CEO. ‘IT teams are likely to be working hard today and possibly over the weekend to remedy the situation. Please be patient with your IT colleagues and, when you can, thank them for their professionalism.'
Resilience, compliance and professionalism
Microsoft’s failure will push resilience and an over-reliance on a small number of hyper-scale tech providers up the corporate agenda.
‘It’s a resilience issue,’ says Patrick Burgess . ‘We have a lot of eggs in very few baskets at the moment – and this is more so with email than with cloud. With cloud there are three or four big providers. In email there are just two – Microsoft and Google.’
The danger of shadow IT
More immediately, and as the incident remains live, BCS warns organisations about the risk of deploying ad hoc fall-backs using team members’ personal WhatsApp and home email addresses. These, though tempting, convenient and immediate, carry potential data privacy risks.
‘People should be cautious when using alternatives such a personal email or chat,’ advises Adam Leon Smith FBCS, chair of BCS’ Fellows Technical Advisory Group (F-TAG). ‘Whilst tempting, these are often not as secure [as official corporate solutions] from a contractual or technical perspective.’
For you
Be part of something bigger, join BCS, The Chartered Institute for IT.
Crucially, routing client names, contact details, or sensitive records through unapproved personal accounts strips away corporate encryption and access controls. This creates a ‘shadow IT’ compliance trap.
Under UK GDPR, moving personally identifiable information onto personal devices leaves organisations unable to track, audit, or delete that data.
Despite good intentions, this could expose organisations to regulatory fines from the ICO if a personal account is compromised or a message is sent to the wrong recipient.
Sovereign infrastructure
Beyond immediate disaster recovery, the disruption is likely to reignite high-level debate around digital sovereignty and the UK’s reliance on overseas hyperscale providers.
Mike Lloyd FBCS said: 'The UK must now act: treat cloud concentration as a national security risk, mandate interoperability and credible exit paths in public-sector procurement, and build domestic capability for critical services.'
When core productivity and communication tools are concentrated in the hands of a tiny number of global tech giants, a single point of technical failure can instantly stall public services, supply chains, and private enterprise across the country.
For policymakers and enterprise leaders alike, the lesson extends beyond simple back-up protocols. Building genuine national and organisational resilience means reassessing vendor lock-in, supporting interoperable open standards, and investing in sovereign digital infrastructure - ensuring that critical UK operations can keep running even when global platforms go dark.
Take it further
Interested in this and similar topics? Explore BCS' books and courses:
