A failure in Microsoft's systems caused significant disruption to the daily routines of many people between Thursday (12) and Friday (13), interrupting vital tools for work in over 70 nations. Affected platforms included Outlook, Teams, and Microsoft's artificial intelligence, Copilot.
This event adds to a series of major cyber disruptions recorded since 2024; since a previous failure at CrowdStrike, at least five more large-scale shutdowns have occurred.
Beatriz Ferreira da Silva, a lawyer and contractual law specialist at the firm Lopes Muniz Advogados, commented in an interview with Olhar Digital that the recent shutdowns demonstrate that high market concentration also implies a concentration of legal risk.
An infographic summarizes six incidents of cyber failures that impacted the lives of many people globally. On July 19, 2024, the world experienced one of the biggest technological collapses in history. The problem began when CrowdStrike, an American digital security company, released a faulty update for its antivirus protection software.
Due to the way this system operates deeply within Windows computers, the error resulted in the freezing of approximately 8.5 million machines simultaneously, displaying the well-known 'blue screen of death' and preventing the devices from booting up. Unlike a simple internet outage, which usually resolves with the server coming back online, this defect required manual repairs on each computer by technical teams, making recovery slow and affecting crucial services in various countries.
The consequences were severe: thousands of flights were canceled, hospitals had to postpone procedures, and banking systems became inoperable, generating billions in losses and long queues.
On June 12, 2025, a failure in Google Cloud servers triggered a cascade effect that brought down numerous popular worldwide websites and applications. The incident originated from an incorrect automatic update in an internal Google system responsible for managing data flow and cloud access. Since many corporations use Google's infrastructure to keep their services active, the error paralyzed platforms used by millions, such as Spotify, Discord, and Google's own tools, including Meet and Gmail. The main interruption lasted about three hours and affected parts of Cloudflare's systems, another major website host.
Later, on October 20, 2025, a failure in Amazon Web Services (AWS) servers, located in the state of Virginia, USA, caused the biggest internet problem since the CrowdStrike case. The start was caused by an error in the DNS system, which acts as a digital directory to help applications locate the correct server addresses on the network. Given the concentration of one of the planet's largest cloud infrastructures in this region, the failure generated a domino effect that took down thousands of daily-use websites and apps. Social networks like Snapchat and Reddit, games like Roblox and Fortnite, as well as tools like Zoom and Duolingo, and Amazon's own services, such as Alexa, were impacted. Full network restoration took more than 14 hours, generating millions of error alerts on monitoring platforms.
Nine days after the Amazon cloud outage, Microsoft was the protagonist of another blackout. This occurred in Azure, the company's cloud computing platform. The problem arose from an accidental modification to the settings of Azure Front Door, a system that acts as a digital 'reception,' directing internet traffic to the appropriate servers. With this entry point blocked by a technical error, thousands of pages and applications lost connection to the network. The outage persisted for just over eight hours, affecting both Microsoft's own work tools, such as Microsoft 365, and essential global services.
In the transport and telecommunications sector, the failure deactivated the systems of the airline Alaska Airlines, brought down the Heathrow airport website in London, and affected the operator Vodafone.
On November 18, 2025, a failure in Cloudflare's systems interrupted access to dozens of popular websites and applications in several nations. The reason was an internal error; after a permissions update in the database, a configuration file used to filter automated accesses (bots) generated duplicate data. By exceeding the memory limit of the servers, the file crashed the mechanism responsible for displaying pages to users. Since Cloudflare functions as a shield and bridge for approximately 20% of the world's internet, the failure resulted in error messages on platforms used by millions, such as ChatGPT, X/Twitter, Canva, and Discord. The main instability lasted about four hours and even affected network outage monitoring tools.
Microsoft reported that the outage began due to unexpected server unavailability, which occurred after an internal overload. The result was a concentration of digital traffic on the remaining machines, creating a domino effect. The blackout lasted for more than 20 hours, and system recovery is gradually ongoing. The possibility of a cyber attack was ruled out.
Much of the public administration and private sector depends on these programs for communication, causing the blackout to cross borders. Government agencies in the United States, Japan, and Australia were affected, as well as the communication of hospitals, ambulances, and police in the United Kingdom. In Brazil, the Microsoft blackout primarily impacted corporate work routines and the functioning of the Judiciary. Courts such as the Supreme Federal Court (STF), the Superior Court of Justice (STJ), the Superior Electoral Court (TSE), and the São Paulo Court of Justice (TJ-SP) had to redirect services to WhatsApp or suspend virtual deadlines and hearings. This led the Brazilian Bar Association (OAB) to request the national suspension of judicial deadlines, as many lawyers could not even receive codes via email to file lawsuits.
Beatriz Ferreira da Silva clarifies that 'large providers impose standardized contracts that limit their liability to discounts in the form of credits, as happens with Microsoft, or reduced amounts, while the company using these services continues to bear the full responsibility towards its own clients, especially consumers.' The lawyer adds that 'courts usually consider the failure of a technology provider chosen by the company as the risk of its business, not as force majeure. In practice, the company pays the bill and then tries to recover the amount from the provider, encountering barriers in contractual limitations.'
André Luiz Pignatari Filho, partner at the firm Ernesto Tzirulnik Advocacia and a master's student in civil law at USP, states that 'the scenario is one of strong dependence on a few digital infrastructure providers, whose contracts are adhesion contracts,' meaning the client has no power to negotiate the clauses. The lawyer explains that 'the reasoning, therefore, is the same for any of these providers: prolonged service interruption, like the one happening, generates the duty to compensate for proven damages.'
Regarding the recent Microsoft blackout, André Luiz Pignatari Filho advises that 'the company that, because of the failure, failed to serve its own clients may have to answer to them, but it can seek reimbursement from Microsoft. It is crucial to document the damages.' Beatriz Ferreira da Silva reinforces that 'the first right of the harmed company is in the contract.' She details that Microsoft 365 has a Service Level Agreement (SLA), where Microsoft guarantees 99.9% availability in services like Outlook and Teams. If this commitment is not met, the client is entitled to a credit of 25%, 50%, or 100% of the monthly fee, depending on the downtime.
However, Beatriz da Silva emphasizes that 'this credit is not automatic. It must be requested by the end of the month following the incident.' For the failure that started on Thursday, the deadline extends until December 31, 2026. The lawyer advises that the request must include detailed data on times, duration, and affected users. Finally, she points out that 'those who suffered the greatest loss, such as lost sales, paralyzed operations, or fines paid to clients, will need to debate the validity of this limitation in court.'
