Weeks of Internet Horror: No One Is Safe

Departures halted at every airport in the United States. Cash machines dark at 128 Japanese banks. Supermarket freezers in France switched to defrost by hackers, some heating to 50°C. Company email gone for more than a day. All of it in five weeks.

Kunkafa News confirmed 16 outages, exploited flaws and attacks between 12 October and 13 November, and there were surely more that never made the record. Some were attacks. Most, the companies say, were accidents. Almost none came with a full account of what went wrong.

The latest came on 13 November, when every US departure stopped over what the Transportation Secretary called a "communication issue" [1]. A day earlier, Microsoft's business email had failed worldwide for more than 24 hours [2]. Neither has said in public what broke.

This is the record: what failed, what the people in charge said, what they left out, and why governments are now telling households to keep cash, water and a radio at home.

What this report covers:

• Five weeks, sixteen confirmed failures, and surely more
• "Communication issue", "power event": the art of saying nothing
• Hackers in the freezer: the attacks you could touch
• Patch, panic, repeat: life with zero-days
• Coincidence or pattern? What the evidence shows
• Keep cash and a radio: governments tell people to prepare
• The question nobody answers: what if it all goes dark?

Five weeks, sixteen confirmed failures, and surely more

This is not a full count. It lists only what could be confirmed from the companies, the authorities or reliable reports; many smaller outages and breaches never get a public word. "What they said" is the responsible party's own explanation; "what they did not say" is what was still open on 14 November.

"Communication issue", "power event": the art of saying nothing

The FAA, 13 November. Transportation Secretary Sean Duffy announced a nationwide ground stop after a communication issue hit all of the country's en-route air traffic control centres [1]. The FAA called it a "temporary telecommunications outage" and said every flight in the air was accounted for [4].

The @FAAnews issued a nationwide ground stop for all U.S. airports following a communication issue impacting all Air Route Traffic Control Centers. FAA technicians are investigating the issue. We will provide immediate updates as we have them.

View on X

There has been a temporary telecommunications outage - out of an abundance of caution all flights have been halted. Every flight has been accounted for and international flights will be handled on a case by case basis.

View on X

More than 9,000 flights were delayed and 440 cancelled [3]. Homeland Security Secretary Markwayne Mullin said there was no sign of an attack, but did not rule one out [5]. Which system failed, and why its backup did not take over, has not been said. Kunkafa covered the day live: US flights grounded.

Microsoft, 12–13 November. Exchange Online, Outlook and Teams faltered from 16:17 UTC on 12 November [6]. The outage ran for more than 24 hours and drew over 7.4 million problem reports on Downdetector, one of the longest in Microsoft's history. Microsoft blamed "server issues" and said it was not aware of any outside interference [2]. It then reversed a configuration update [27], and its incident notes later pointed to an earlier network-capacity upgrade exposed by a later change [6].

Three explanations in two days. Euronext, Maersk, Aviva, the NHS and London's Metropolitan Police were among those hit, Reuters reported [2], and Deutsche Bahn struggled to send timetables for diverted trains [27]. More in Microsoft's email backlog.

Shinkin banks, Japan, 6 November. ATMs, counters and transfers stopped at 128 regional banks for about five and a half hours. The operator blamed an "equipment malfunction" and said it was not a cyberattack [11]. It did not name the equipment, or explain why one fault could stop 128 banks at once.

Orange, France, 21 October. Orange and Sosh customers lost calls, texts and mobile data for about ten hours. On the day, Orange spoke only of a failure in equipment in its mobile core [16]. A week later the head of Orange France named a software bug in Nokia equipment, and said the backup ran the same software, so it failed too [17].

That came in a newspaper interview, not a published report. Customers were offered extra mobile data, not refunds [17]. Orange is seeking compensation from Nokia, Clubic reported; neither company commented on that [18].

Google Cloud, London, 20 October. One London zone went down for about eight hours. Google called it "a power event" at a "third-party facility" [21]. Lloyds and HSBC confirmed disruption [19], and Revolut was out of service for a while. Google has not named the facility or said why one building's power could reach so far.

ChatGPT, 15 October. Logins and sign-ups failed on every mobile app for 2 hours 26 minutes. The status entry gave no cause at all [23].

Hackers in the freezer: the attacks you could touch

The outages were officially accidents. The attacks were not, and they hit things people can touch.

France's fridges, 12–14 October. Hackers set supermarket fridges and freezers to defrost overnight, some reaching 50°C, causing food losses and fires; Paris prosecutors opened an investigation [25]. Finance Minister Roland Lescure put the toll at about 700 of France's 10,000 supermarkets [26].

Europe's fridges, 2–4 November. A second wave reached at least 11 countries. France's blood service found cold storage at three or more blood banks set far too high, with no patients harmed. The EU called the attacks "not isolated"; Romania's cyber chief called them "semi-amateurish" [12]. Danfoss said many affected units no longer get security updates [28].

The Fehmarnbelt tunnel, 12–13 October. The contractor building the tunnel between Denmark and Germany confirmed a cyber incident: ships stopped and staff were sent off their computers [24].

Maersk and GitHub, 10–12 November. Maersk confirmed data was stolen from an acquired company's system, with bookings unaffected [8]. On GitHub, attackers hijacked 4,837 accounts and stole secrets from more than 1,835 code repositories, by Aikido Security's count, which it calls a lower bound [7].

In none of these attacks has anyone been named. No group has claimed the fridge attacks, and no demand has been made public [12].

Patch, panic, repeat: life with zero-days

A zero-day is a flaw attackers use before the maker has a fix, so defenders have had zero days to prepare. Once the fix ships, the race flips: attackers study the patch to find the hole, while every company and phone owner still has to install it.

In five weeks: two critical PHP flaws, "PHP2Shell", were targeted four days before their fix [22]. Apple extended its fix for an iPhone PDF flaw used in "an extremely sophisticated attack" to older phones [14], a flaw first patched on 28 September [15]. A Node.js flaw went on the US government's exploited list [13].

Then, on 10 November alone, Chrome had its eighth exploited zero-day of the year [9], and Microsoft fixed 1,094 flaws in one monthly update, including an Outlook flaw already in use [10]. Who used these flaws, and against whom, was not said in any of the cases.

The hard part for ordinary users is that the weak point is usually not theirs. A shop does not write its fridge software; a bank does not run Microsoft's mail servers; a mobile customer cannot choose Orange's core-network supplier. Installing updates still matters, but it cannot cover a supplier's mistake or a device its maker has stopped supporting.

Coincidence or pattern? What the evidence shows

What follows is Kunkafa's reading of the public record above, not a finding by any investigator. Each point says how solid it is.

Proven: the explanations were thin. Four of six outages were first explained in a few words: "communications issue", "power event", "equipment malfunction", a failure "in equipment". ChatGPT gave none. Microsoft's changed twice. Only Orange named a fault, a week later, in an interview. Kunkafa found no public post-incident report for any of the six.

Proven: changes keep turning up as triggers. Microsoft tied its outage to an upgrade and a later change. Orange's backup ran the same faulty software as the main system. A backup that copies the main system also copies its bugs.

Proven: one supplier's failure becomes everyone's. Microsoft's outage reached an exchange operator, a shipping line, hospitals, police and a railway. One equipment fault stopped 128 banks. One power problem in one London building hit two of Britain's biggest banks. The fridge attacks worked through a few refrigeration-control makers.

Not proven: a link between the outages and the attacks. Microsoft and the Japanese banks ruled out an attack; US officials saw no sign of one but ruled nothing out. No investigator has tied any outage to any attack, and no public evidence connects them.

Possible, not ruled out: coincidence. Clusters like this can happen by chance when the world runs on a few huge systems. With so little published, chance cannot be confirmed either. A post-incident report from each operator, naming the failed part and the change behind it, would settle it. Until then, a coordinated campaign is speculation.

Keep cash and a radio: governments tell people to prepare

While companies said little, governments have been saying more, to households. At least 33 countries now publish advice on keeping emergency supplies, from three days to ten [29]. Several name the same threats this report lists: lost power, phones and internet.

United Kingdom, 22 October 2026. The government's "Be Ready" campaign asks households to prepare for three days of disruption, noting that emergencies can affect "power, water, phones and the internet" [30]. Reports of its checklist list water, food that needs no cooking, a battery or wind-up radio and cash [31].

Households encouraged to take small, simple steps to stay prepared in an emergencyHouseholds are being encouraged to take a few simple steps to stay prepared if everyday services are temporarily disrupted, under updated advice published today.GOV.UK

Norway, October 2026. Norway's civil protection directorate asks people to be ready to manage on their own for a week [32]. This year's preparedness week was about mobile network and internet outages, and state offices advised keeping a battery, hand-crank or solar radio [33].

Egenberedskapdsb.no

Germany. The federal civil protection office advises stocks for ten days, with three days as a start, and explains how to stay informed in a power cut [34].

Vorsorgen für Krisen und KatastrophenBBK

The Netherlands and the Czech Republic. Both governments ask households to cope alone for the first 72 hours. The Dutch site gives a long power cut as its example and recommends a radio [35]; the Czech guide warns of interruptions to water, heating, electricity and internet [36].

Home | Denk vooruitWie zich zorgen maakt over onverwachte gebeurtenissen of risico’s, kan zich alvast voorbereiden. Dit is vaak makkelijker dan je denkt. Op www.denkvooruit.nl vind je informatie over verschillende (nood)situaties.denkvooruit.nl 72 hours | 72hodinWhy is it important to be prepared for 72 hours? Everyone should be able to handle the first three days of a crisis without the help of rescue services. We'll show you how.72h.gov.cz

The European Union, March 2025. The Commission's preparedness strategy asked every citizen to be able to manage for at least 72 hours; the kit it showed included a radio, cash and a power bank [37].

The advice is careful not to alarm, and most of it names storms and floods alongside cyberattacks. But the shopping list says what governments are planning for: a few days when cards, phones and screens do not work.

The question nobody answers: what if it all goes dark?

Most events in this report stayed local: one country, one company, one day. The question none of the responsible parties has answered is what happens when they stop being local.

Five weeks of thin explanations do not answer these questions. They are left open here, on purpose.

Sources: [1] Sean Duffy, 13 November 2026 · [2] Reuters, 13 November 2026 · [3] Yahoo News, 13 November 2026 · [4] FAA, 13 November 2026 · [5] Jackson Gosnell, 13 November 2026 · [6] Microsoft incident feed (University of Pennsylvania), 12–13 November 2026 · [7] Aikido Security, 12 November 2026 · [8] BleepingComputer, 11 November 2026 · [9] BleepingComputer, 10 November 2026 · [10] SecurityWeek, November 2026 · [11] Jiji Press via Nippon.com, 6 November 2026 · [12] Al Jazeera (AFP, Reuters), 4 November 2026 · [13] GCN, 6 November 2026 · [14] BleepingComputer, 27 October 2026 · [15] Decalage, 2 October 2026 · [16] Sortiraparis, 22 October 2026 · [17] France Mobiles, 28 October 2026 · [18] Clubic, 29 October 2026 · [19] Computing, October 2026 · [20] The Register, 20 October 2026 · [21] Google Cloud status page, 20 October 2026 · [22] BleepingComputer, 26 October 2026 · [23] MIXED News, 16 October 2026 · [24] Ingeniøren, 13 October 2026 · [25] Al Jazeera, 13 October 2026 · [26] Korea Times (AP), 14 October 2026 · [27] The Local Germany, 13 November 2026 · [28] Privacy Guides, 4 November 2026 · [29] The Vibes, 2 November 2026 · [30] UK Government, 22 October 2026 · [31] Fortune, 26 October 2026 · [32] DSB (Norway) · [33] Statsforvalteren i Nordland, 26 October 2026 · [34] BBK (Germany) · [35] Denk vooruit (Netherlands) · [36] Czech Ministry of the Interior, 72h.gov.cz · [37] Euronews, 26 March 2025