When Outlook went down, the biggest risk to many small businesses was not a hacker. It was a helpful member of staff with a deadline, a client waiting and no email. Left without an approved way to get the work done, people improvise, and some of those workarounds send client information somewhere you cannot see it.
What is being warned about
Insurance Business UK reports multiple unattributed warnings that staff were turning to unprotected devices and mail systems during the outage. The examples it lists are forwarding client files to personal Gmail accounts, sharing them over WhatsApp, and pasting work into free AI chatbots.
These are warnings, not measured incidents. The outage itself began on Thursday 12 November, and TechRadar's live coverage reported more than 131,000 Outlook problem reports at the peak. Microsoft says it is not aware of any malicious activity, and the recovery was still under way on Friday morning.
Why a kind workaround is still a risk
You lose sight of the file. Once a client document sits in a personal inbox or a chat app, you cannot see who has it, who it has been shared with, or whether it has been deleted. Personal accounts may also lack protections you have set up on business ones, such as multi-factor authentication.
Free AI tools can keep what you paste. Depending on the service's terms and settings, text pasted into a free chatbot may be stored or used by the provider. A contract clause or a customer's details is not something you would normally hand to an outside company.
The copies outlive the outage. When email returns, everyone gets back to normal and nobody remembers where the files went. A lost phone or a breached personal account months later can then become a client-data problem.
What this means for UK small businesses
Your staff are not the villains here. They were trying to keep customers happy with no guidance. Clients trust you with contracts, invoices and personal details, and they will not distinguish between a hacker and a well-meant workaround if their information ends up somewhere it should not be.
The fix is not a ban on being helpful. It is an agreed plan, written down before the next outage, so that the safe option is also the easy one.
What to do this week
Agree an approved fallback. Decide which business-controlled tool people use when email is down, who can use it, and for what. Ask your IT provider what your existing Microsoft 365 set-up already allows.
Say plainly what not to do. No client files to personal email, no client documents over messaging apps, and no client details pasted into free AI chatbots. Put it in one short message and repeat it.
Ask what happened last week, without blame. Invite staff to tell you what they used, then ask them to move or delete those copies once the work is safe. You can only tidy up what you know about.
Make the safe route easy. Name one person people can ring for urgent decisions, and keep a list of key contact numbers outside the mailbox, so nobody has to improvise to meet a deadline.
Check for fallout. If anything sensitive did go to a personal account or an AI tool, tell your IT provider, and ask whoever looks after data protection in your business what you need to do next.
Sophia Says
People do not break the rules because they do not care. They break them because the work still has to be done and nobody told them what to do instead. An outage is the moment the gap in the plan becomes visible.
At HackRisk we help teams build good habits before the pressure arrives, and we help you see whether your business details have already leaked. A calm, written fallback plan is one of the cheapest security controls you will ever put in place.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Want everyone on the same page? Security awareness training explained covers how short, regular training helps people make safer choices under pressure.
Worried details have already leaked? Dark Web Scan helps you see whether your business email addresses and credentials have turned up in leaked data.
Get your free HackRisk report
See where your business stands before the next outage tests your plan. Get your free HackRisk report.
