On November 13, 2026, the FAA halted departures nationwide after a communications problem hit its air route traffic control centers. The order was lifted at 8:15 pm ET, more than four hours later, after disrupting thousands of flights. Officials expect delays to continue for several days. Early indications point to a software or equipment failure rather than an attack.
What Officials Have Said
No official root cause has been announced, and accounts differ:
- Transportation Secretary Sean Duffy blamed legacy equipment, saying switches and routers were flooded with data and produced inconsistent information, so the agency shut the system down.
- Homeland Security Secretary Markwayne Mullin said the FAA had been applying patches and installing new equipment, which "was overwhelming the older system."
- CBS News, citing multiple sources, reported the outage followed an update to the private communications network linking the air traffic control system. The network rebooted and then crashed. The network is operated by L3Harris.
- Officials said the outage was unrelated to the Microsoft outage earlier in the week and that the FAA's recently deployed AI systems played no role.
Cyberattack Assessment
Mullin said the incident did not appear to be a cyberattack and that the failure appeared mechanical. He said, "there's no chatter, we haven't seen any footprints," but added, "we're not going to rule that out." Officials described the ground stop as a precaution.
Bloomberg, citing a person familiar with the matter, reported that the FBI does not believe a cyberattack or criminal activity caused the outage and is examining whether a software update was responsible. Mullin said the NSA, the Department of Defense, CISA and other agencies are involved in the investigation.
Precedent
The last nationwide ground stop was in January 2023, caused by a contractor who unintentionally deleted files on the system that delivers safety notices to pilots. No evidence of a cyberattack was found then either.
Takeaways for IT Teams
- Change management on critical infrastructure is a larger outage risk than attackers in many cases. Staged rollouts and tested rollback paths matter.
- Legacy network gear under a surge of new patches and equipment can fail in ways that look like an attack at first. Keep incident triage open to both explanations.
- Treat early attribution statements as provisional. The cause here is still unconfirmed.