FAA Ground Stop: Was It a Cyberattack? What We Know So Far

The FAA ground stop on Friday, November 13, 2026, halted every departure in the country for more than four hours and left thousands of flights canceled, with cancellations still piling up this Saturday. The question everyone kept asking online was whether the FAA ground stop was caused by a cyberattack. In this post I pull together what we know, what we still don't know and what this failure teaches anyone who runs a critical system, from an airport to a company website.

TL;DR (updated 5 a.m. ET, Nov 14, 2026)

• The FAA halted every departure in the country on Friday afternoon, at around 3:40 p.m. ET. The order wasn't lifted until 8:15 p.m.
• The official reason was a communications failure affecting the regional air traffic control centers. Radar and radio became unstable but, according to the administration, were never completely lost.
• There is no sign of a cyberattack. The Department of Homeland Security (DHS), the FBI and the Department of Transportation all said they saw no indication of criminal activity, though the investigation is still open.
• The most widely cited explanation so far: old routers and switches were overloaded after changes to the network (new equipment, an update or security patches).
• More than 4,700 flights were canceled and 10,000 delayed on Friday alone. The system will take days to recover.

FAA ground stop timeline (Eastern Time)

I built this FAA ground stop timeline from official statements and from US press coverage. Some times are approximate, because sources differ by a few minutes.

Friday, Nov 13

• Around 3:30 p.m.: according to Transportation Secretary Sean Duffy, the FAA starts seeing "instability for our radar and communications" at en route centers and approach facilities (TRACONs).
• Between 3:36 and 3:54 p.m.: the FAA issues a nationwide ground stop, meaning no aircraft departs from any US airport. The stated reason: "extraordinary circumstances and reasons for safety." Between 3,100 and 3,500 planes were in the air.
• 4:16 p.m.: Duffy confirms on X a "communication issue impacting all Air Route Traffic Control Centers" (there are 22 nationwide).
• 5:52 p.m.: the FAA says "every flight has been accounted for." International flights are handled case by case. Medical evacuations, organ transport and law enforcement operations remain cleared.
• 7:05 p.m.: more than 820 flights had been diverted to other airports, according to Cirium.
• 8:15 p.m.: after testing its systems for stability, the FAA lifts the order. Departures resume gradually.

Saturday, Nov 14

• Overnight: United, American, Southwest and JetBlue restart some flights but warn of delays and cancellations throughout Saturday. Homeland Security Secretary Markwayne Mullin says new equipment "overwhelmed" older systems.
• Morning: between 700 and more than 1,600 flights are already canceled for Saturday, depending on the source (FlightRadar24 or FlightAware).

This was only the second nationwide stop on departures since the September 11, 2001 attacks. The previous one was in January 2023, when the system that sends notices to pilots (NOTAM) failed.

Was it a cyberattack? What we know about the cause of the FAA ground stop

Short answer: nothing suggests it was. But it's worth separating who said what, because on social media it's all blended together.

What officials said on the record

• DHS: Markwayne Mullin said there was no indication of a "nefarious act" against the country and that, "as of now," it was a telecommunications outage. He later said he had seen "no evidence that this was a cyberattack" and summed it up as: "This is not another 9/11." At the same time, he cautioned that "you just can't rule out anything at this point."
• FBI: an official cited by Bloomberg said the FBI does not believe a cyberattack or criminal activity caused the failure. Law enforcement sources who spoke to CNN said the same.
• Department of Transportation: Sean Duffy said old switches and routers got overloaded with data, started producing inconsistent information, and the system was shut down as a precaution. He stressed that radar and communications were never fully lost.

The strongest lead: a change to an aging network

The accounts point to the same place: the private telecommunications network that links the FAA's towers, approach facilities and en route centers.

• Sources told CBS News that an update to that network triggered a reboot, which led to a crash and a communications outage. The network is operated by L3Harris, which inherited the contract signed in 2002. The company didn't immediately comment.
• Mullin said new security patches applied to the older system appeared to "overwhelm" its routers. According to the administration, the newer IP-based switches did not fail. It was the legacy part that went down.
• An investigator quoted in the press said a software update is being examined as a possible cause, but that the exact cause hasn't been determined.

In other words: everything points to the FAA ground stop coming from a failed change on old infrastructure, not an intrusion. It's the same pattern behind many recent major outages, including the Microsoft outage that began the day before.

What has been ruled out (and the rumor going around)

• It's not connected to the Microsoft outage. The timing fueled speculation, but Microsoft and DHS said the two incidents don't appear to be linked.
• It wasn't the controllers' new AI tool. Air Space Intelligence, which supplies the SMART system to the FAA, said its technology was not responsible. Mullin, however, didn't rule it out.
• It's unrelated to the tanker crash in New Orleans, according to Mullin.
• Be careful with the "contract workers deleted files" story. It has been repeated on some sites, but that was the explanation for the January 2023 outage. So far, no official statement has attributed the 2026 failure to deleted files.

What we still don't know about the FAA ground stop

Question	Status as of Nov 14, morning
What was the root cause?	Not confirmed. The symptom is known (old routers overloaded). The trigger isn't.
Was it an update or a security patch?	Leading theory, not confirmed. Sources and DHS point to it, but there's no official report.
Has a cyberattack been ruled out?	No sign of one, per DHS and the FBI. Officially, nothing is ruled out until the investigation ends.
How many passengers were affected?	About 1.5 million, according to the Associated Press. There's no official FAA figure.
When will the system be back to normal?	Within days. Duffy expects full operations before Thanksgiving, on Nov 26.
Could it happen again?	Yes. The administration itself says more failures are likely unless the network is modernized.

When the FAA releases the findings of its investigation, I'll update this table.

How big the FAA ground stop was

The impact of the FAA ground stop goes far beyond the four hours of stoppage:

• Flights: more than 4,700 cancellations and 10,000 delays on Friday, compared with about 100 cancellations on a normal day that week. More than 820 flights were diverted.
• Full airports: Reagan National in Washington ran out of space to park planes, and Chicago O'Hare came close.
• Ripple effect: recovery is slow because planes and crews ended up in the wrong places. Pilots and flight attendants have duty-time limits, and Duffy said crew availability is the main bottleneck.
• Cargo and sports: FedEx and other cargo carriers were affected. NBA, NHL and college teams were stranded or had to reschedule games.

And all of this two weeks before Thanksgiving, the busiest travel period at US airports.

Flying after the FAA ground stop? What to do now

If you're traveling in the next few days, here's the playbook:

1. Check your flight status directly with the airline, in the app or on its website, before you leave home. Planes and crews out of position can still affect connections.
2. If your flight was canceled and you don't want the rebooking, Department of Transportation rules entitle you to a refund. Several airlines, including American and Southwest, also waived change fees.
3. Don't expect extra compensation. Airlines aren't required to pay compensation beyond the refund or rebooking when the cause is an FAA failure.
4. Ask about meal and hotel vouchers anyway. They aren't guaranteed in this situation, but some airlines offer them, and it costs nothing to ask.
5. Keep receipts for expenses and all messages from the airline, so you can request reimbursement later.

The lesson for businesses: the problem is rarely a hacker

The FAA ground stop holds a lesson for any business, even one that will never run an airport. Based on what we know so far, the whole country stopped because of three things I see every week on small and midsize companies' websites and systems:

• Legacy infrastructure nobody replaces. A 2023 review commissioned by the FAA itself already called this network obsolete and warned that an unexpected failure could disconnect facilities from the wider system. In September, the Government Accountability Office (GAO) warned again about aging copper cables and poorly scheduled changes. The warning was there. Action wasn't.
• Changes pushed to production without a safety net. Everything suggests an update or a patch took down the old part of the network. Updating is mandatory, but updating without testing first in a separate environment, without a planned window and without a rollback plan is a gamble.
• A single point of failure. In the FAA ground stop one network linked every control center, so a problem in it became a national problem.

Notice that none of these three is a cyberattack. Most recent major outages, like Microsoft's this same week, the Twitter (X) outage and the Slack outage, started from the inside: configuration, updates or capacity. Security against intrusions is essential, but availability also depends on process.

For your company's website, online store or system, that translates into:

• Test updates first. Plugins, themes, PHP, operating system: first on a copy of the site (a staging environment), then in production.
• Have a way back. A recent, tested backup taken before every change, so you can undo what went wrong in minutes.
• Monitor from the outside. An alert that tells you when the site goes down or slows down, before a customer does.
• Replace what's old before it breaks. An unsupported server, an end-of-life PHP version and an abandoned plugin are the small-scale version of the FAA's routers.
• Know who to call. In the middle of a crisis, you can't file a ticket in a queue and wait.

How Agathas Web keeps your site from having its own "ground stop"

This is exactly the kind of routine we run with Agathas Web Managed Hosting. In practice:

• Updates tested in staging before going live, in an agreed window, with a backup taken right before so we can roll back if anything goes wrong.
• Daily and incremental backups, encrypted and stored off the main server.
• 24/7 monitoring of uptime and performance, with our team acting when an alert fires.
• Server, PHP and components kept on supported versions, without waiting for legacy to turn into a crisis.
• Support over WhatsApp, from people who know your setup.

How it works: we review the website or system you have today, flag the risks (what's out of date, what has no backup, what nobody monitors) and migrate it without taking anything offline. If the FAA ground stop got you thinking about what would happen if your site went down tomorrow, request a managed hosting quote and I'll walk you through what makes sense for your case.

Conclusion

The FAA ground stop of November 13 halted every departure in the country for more than four hours and will scramble air travel for days. So far, officials say it was not a cyberattack. The strongest lead is a change (an update, a patch or new equipment) that overloaded old routers on a network the FAA itself already knew was obsolete.

The official cause will come out of the investigation, and I'll update this post when it does. In the meantime, the lesson is already clear: critical infrastructure doesn't only fail because of intrusions. It also fails for lack of testing, of a rollback plan and of maintenance on what's old. If you want that routine on your website, talk to us about managed hosting.

Sources: statements from Sean Duffy (Department of Transportation) and Markwayne Mullin (DHS); coverage by NBC News, CBS News, ABC News, Al Jazeera and CNN. Post updated at 5 a.m. ET on Nov 14, 2026; it will be revised when the FAA releases the official cause.