FAA Ground Stop: Was It a Cyber Attack? What We Know So Far

The FAA ground stop on Friday 13 November 2026 halted every departure in the country for more than four hours and left thousands of flights cancelled, with cancellations still piling up this Saturday. The question everyone kept asking online was whether the FAA ground stop was caused by a cyberattack. In this post I pull together what we know, what we still do not know and what this failure teaches anyone who runs a critical system, from an airport to a company website.

TL;DR (updated 10:00 GMT, 14 November 2026)

• The FAA halted every departure in the country on Friday evening UK time, at around 20:40 GMT. The order was not lifted until 01:15 GMT on Saturday.
• The official reason was a communications failure affecting the regional air traffic control centres. Radar and radio became unstable but, according to the US administration, were never completely lost.
• There is no sign of a cyberattack. The Department of Homeland Security (DHS), the FBI and the Department of Transportation all said they saw no indication of criminal activity, though the investigation is still open.
• The most widely cited explanation so far: old routers and switches were overloaded after changes to the network (new equipment, an update or security patches).
• More than 4,700 flights were cancelled and 10,000 delayed on Friday alone. The system will take days to recover.

FAA ground stop timeline (UK time, GMT)

I built this FAA ground stop timeline from official statements and from US press coverage. Times are converted to GMT (five hours ahead of the US East Coast), and some are approximate, because sources differ by a few minutes.

Friday 13 November

• Around 20:30: according to Transportation Secretary Sean Duffy, the FAA starts seeing "instability for our radar and communications" at en route centres and approach facilities (TRACONs).
• Between 20:36 and 20:54: the FAA issues a nationwide ground stop, meaning no aircraft departs from any US airport. The stated reason: "extraordinary circumstances and reasons for safety." Between 3,100 and 3,500 planes were in the air.
• 21:16: Duffy confirms on X a "communication issue impacting all Air Route Traffic Control Centers" (there are 22 nationwide).
• 22:52: the FAA says "every flight has been accounted for." International flights are handled case by case. Medical evacuations, organ transport and law enforcement operations remain cleared.

Saturday 14 November

• 00:05: more than 820 flights had been diverted to other airports, according to Cirium.
• 01:15: after testing its systems for stability, the FAA lifts the order. Departures resume gradually.
• Overnight (US time): United, American, Southwest and JetBlue restart some flights but warn of delays and cancellations throughout Saturday. Homeland Security Secretary Markwayne Mullin says new equipment "overwhelmed" older systems.
• Morning: between 700 and more than 1,600 flights are already cancelled for Saturday, depending on the source (FlightRadar24 or FlightAware).

This was only the second nationwide stop on departures since the 11 September 2001 attacks. The previous one was in January 2023, when the system that sends notices to pilots (NOTAM) failed.

Was it a cyberattack? What we know about the cause of the FAA ground stop

Short answer: nothing suggests it was. But it is worth separating who said what, because on social media it is all blended together.

What officials said on the record

• DHS: Markwayne Mullin said there was no indication of a "nefarious act" against the country and that, "as of now," it was a telecommunications outage. He later said he had seen "no evidence that this was a cyberattack" and summed it up: "This is not another 9/11." At the same time, he cautioned that "you just can't rule out anything at this point."
• FBI: an official cited by Bloomberg said the FBI does not believe a cyberattack or criminal activity caused the failure. Law enforcement sources who spoke to CNN said the same.
• Department of Transportation: Sean Duffy said old switches and routers got overloaded with data, started producing inconsistent information, and the system was shut down as a precaution. He stressed that radar and communications were never fully lost.

The strongest lead: a change to an ageing network

The accounts point to the same place: the private telecommunications network that links the FAA's towers, approach facilities and en route centres.

• Sources told CBS News that an update to that network triggered a reboot, which led to a crash and a communications outage. The network is operated by L3Harris, which inherited the contract signed in 2002. The company did not immediately comment.
• Mullin said new security patches applied to the older system appeared to "overwhelm" its routers. According to the administration, the newer IP-based switches did not fail. It was the legacy part that went down.
• An investigator quoted in the press said a software update is being examined as a possible cause, but that the exact cause has not been determined.

In other words: everything points to the FAA ground stop coming from a failed change on old infrastructure, not an intrusion. It is the same pattern behind many recent major outages, including the Microsoft outage that began the day before.

What has been ruled out (and the rumor going around)

• It is not connected to the Microsoft outage. The timing fueled speculation, but Microsoft and DHS said the two incidents do not appear to be linked.
• It was not the controllers' new AI tool. Air Space Intelligence, which supplies the SMART system to the FAA, said its technology was not responsible. Mullin, however, did not rule it out.
• It is unrelated to the tanker crash in New Orleans, according to Mullin.
• Be careful with the "contract workers deleted files" story. It has been repeated on some sites, but that was the explanation for the January 2023 outage. So far, no official statement has attributed the 2026 failure to deleted files.

What we still don't know about the FAA ground stop

Question	Status on 14 November, morning
What was the root cause?	Not confirmed. The symptom is known (old routers overloaded). The trigger is not.
Was it an update or a security patch?	Leading theory, not confirmed. Sources and DHS point to it, but there is no official report.
Has a cyberattack been ruled out?	No sign of one, per DHS and the FBI. Officially, nothing is ruled out until the investigation ends.
How many passengers were affected?	About 1.5 million, according to the Associated Press. There is no official FAA figure.
When will the system be back to normal?	Within days. Duffy expects full operations before US Thanksgiving, on 26 November.
Could it happen again?	Yes. The administration itself says more failures are likely unless the network is modernised.

When the FAA publishes the findings of its investigation, I will update this table.

How big the FAA ground stop was

The impact of the FAA ground stop goes far beyond the four hours of stoppage:

• Flights: more than 4,700 cancellations and 10,000 delays on Friday, compared with about 100 cancellations on a normal day that week. More than 820 flights were diverted.
• Full airports: Reagan National in Washington ran out of space to park planes, and Chicago O'Hare came close.
• Ripple effect: recovery is slow because planes and crews ended up in the wrong places. Pilots and flight attendants have duty-time limits, and Duffy said crew availability is the main bottleneck.
• Cargo and sports: FedEx and other cargo carriers were affected. NBA, NHL and college teams were stranded or had to reschedule games.

And all of this two weeks before Thanksgiving, the busiest travel period at US airports. Transatlantic routes were not the focus of the stoppage, but aircraft and crews out of position can still knock on to flights from the UK.

Flying after the FAA ground stop? What to do now

If you are travelling in the next few days, here's the playbook:

1. Check your flight status directly with the airline, in the app or on its website, before you leave for the airport. Onward connections inside the US are the most exposed.
2. If your flight was cancelled and you do not want the rebooking, you are entitled to a refund, both under UK261 and under US Department of Transportation rules. Several airlines, including American and Southwest, also waived change fees.
3. Do not expect fixed compensation. An air traffic control failure counts as an extraordinary circumstance, so the UK261 compensation payments normally do not apply. In the US, airlines are not required to pay anything beyond the refund or rebooking.
4. Duty of care still applies on UK261 flights. For flights departing the UK, or arriving in the UK on a UK or EU airline, the carrier must still provide meals, a way to communicate and a hotel if you have to stay overnight, even in extraordinary circumstances.
5. Keep receipts for expenses and all messages from the airline, so you can claim reimbursement later.

The lesson for businesses: the problem is rarely a hacker

The FAA ground stop holds a lesson for any business, even one that will never run an airport. Based on what we know so far, the whole country stopped because of three things I see every week on small and medium-sized businesses' websites and systems:

• Legacy infrastructure nobody replaces. A 2023 review commissioned by the FAA itself already called this network obsolete and warned that an unexpected failure could disconnect facilities from the wider system. In September, the US Government Accountability Office (GAO) warned again about ageing copper cables and poorly scheduled changes. The warning was there. Action was not.
• Changes pushed to production without a safety net. Everything suggests an update or a patch took down the old part of the network. Updating is mandatory, but updating without testing first in a separate environment, without a planned window and without a rollback plan is a gamble.
• A single point of failure. In the FAA ground stop one network linked every control centre, so a problem in it became a national problem.

Notice that none of these three is a cyberattack. Most recent major outages, like Microsoft's this same week, the Twitter (X) outage and the Slack outage, started from the inside: configuration, updates or capacity. Security against intrusions is essential, but availability also depends on process.

For your organisation's website, online store or system, that translates into:

• Test updates first. Plugins, themes, PHP, operating system: first on a copy of the site (a staging environment), then in production.
• Have a way back. A recent, tested backup taken before every change, so you can undo what went wrong in minutes.
• Monitor from the outside. An alert that tells you when the site goes down or slows down, before a customer does.
• Replace what is old before it breaks. An unsupported server, an end-of-life PHP version and an abandoned plugin are the small-scale version of the FAA's routers.
• Know who to call. In the middle of a crisis, you cannot raise a ticket in a queue and wait.

How Agathas Web keeps your site from having its own "ground stop"

This is exactly the kind of routine we run with Agathas Web Managed Hosting. In practice:

• Updates tested in staging before going live, in an agreed window, with a backup taken right before so we can roll back if anything goes wrong.
• Daily and incremental backups, encrypted and stored off the main server.
• 24/7 monitoring of uptime and performance, with our team acting when an alert goes off.
• Server, PHP and components kept on supported versions, without waiting for legacy to turn into a crisis.
• Support over WhatsApp, from people who know your setup.

How it works: we review the website or system you have today, flag the risks (what is out of date, what has no backup, what nobody monitors) and migrate it without taking anything offline. If the FAA ground stop got you thinking about what would happen if your site went down tomorrow, request a managed hosting quote and I will talk you through what makes sense for your case.

Conclusion

The FAA ground stop of 13 November halted every departure in the country for more than four hours and will disrupt air travel for days. So far, officials say it was not a cyberattack. The strongest lead is a change (an update, a patch or new equipment) that overloaded old routers on a network the FAA itself already knew was obsolete.

The official cause will come out of the investigation, and I will update this post when it does. In the meantime, the lesson is already clear: critical infrastructure does not only fail because of intrusions. It also fails for lack of testing, of a rollback plan and of maintenance on what is old. If you want that routine on your website, talk to us about managed hosting.

Sources: statements from Sean Duffy (Department of Transportation) and Markwayne Mullin (DHS); coverage by NBC News, CBS News, ABC News, Al Jazeera and CNN. Post updated at 10:00 GMT on 14 November 2026; it will be revised when the FAA publishes the official cause.