Travel + Remote Work Briefing — November 13, 2026

Today's four stories are about the systems a mobile working life quietly runs on. A Microsoft 365 outage cut many users off from Outlook and Teams from Thursday into Friday. Expedia has confirmed that attackers got in through one of its vendors, while an extortion group makes far larger claims that no one has verified. Cyprus is aiming to join Schengen in mid-2027, which would change how its days count for anyone juggling the 90/180 rule. And Korean Air is adding a Newark–Seoul route. The common thread is the fallback: a second way to reach your team, a password you have not reused, a Europe plan that does not depend on one exception, and a second airport worth pricing.

What happened in the Microsoft 365 outage, and what does it mean if you work remotely?

A widespread Microsoft outage disrupted Outlook, Teams and other Microsoft 365 services on Thursday and Friday, according to CNBC, and the BBC reported that many customers could not send or receive email.

CNBC reported that connectivity issues began shortly before 1 p.m. ET on Thursday and continued into Friday, also affecting SharePoint and Copilot, along with external services that connect to Microsoft products, such as Outlook Calendar. Email and related tools were unavailable for Microsoft users throughout the Asian business day on Friday and across the European and early U.S. morning, CNBC said.

On the cause, Microsoft said it was not aware of any malicious activity, per CNBC. The BBC reported that the company attributed the outage to "elevated load" on its infrastructure after a large number of servers became "unexpectedly unavailable," straining the remaining ones. The BBC added that Microsoft had said earlier that its attempted fixes were "not taking as expected."

As for status, the BBC's latest update said Microsoft was seeing "early signs of stabilisation" on Friday morning, but capacity had "not yet returned to normal levels." In an update at around 5 a.m. ET, CNBC said, Microsoft told users they might still be unable to connect to multiple Microsoft 365 products, including Outlook on web or desktop, and gave no timeline for full restoration. Most access to Teams was available.

On delayed email, CNBC reported that Microsoft was prioritizing efforts to preserve emails delayed during recovery, extending the timeout window in which delayed messages keep attempting delivery for up to 48 hours.

The BBC said more than 430 million people use Microsoft 365 apps, according to Microsoft's website, and that Downdetector had 140,000 people from 74 countries reporting Outlook issues on Thursday evening.

Why it matters for remote workers and nomads: This paragraph is our read, not reporting. If your job runs through one vendor's email, calendar and chat, agree on a backup channel with your manager and key clients before you need it, such as a messaging app or a phone number, and note who should be told when you go quiet. Keep offline copies of the files and calendar entries you need for the next few days, especially if you work across time zones where a colleague's morning is your night. Before blaming hotel or coworking wifi, check the Microsoft 365 status page and your other sites. If you freelance, consider keeping a log of when you couldn't work and what you tried, in case you need to explain it. If you are choosing where to base yourself for a while, our guide to long-term stays and coworking covers setting up a work base you can rely on.

Was Expedia breached, and what has actually been confirmed?

Expedia Group confirmed Thursday that attackers reached its systems through a compromised third-party data platform provider, according to Skift, but the company has not said what data was exposed or how large the breach is.

Confirmed (per Skift): Expedia said the attack was part of a supply chain attack that also affected multiple companies. It said it contained the issue as soon as it became aware, is investigating with outside security experts, and that its platforms remain safe for travelers and partners. Expedia did not identify the vendor, and Skift reported that the scale of the breach is unconfirmed.

Claimed, not verified: The acknowledgment followed reports about an extortion group calling itself n0n. Cybernews reported that the group claims to hold more than 830 million loyalty program records, 58 million traveler profiles and over 333 million consumer account records, and has threatened to publish the data unless Expedia reaches a settlement. Cybernews said the claimed data includes emails, loyalty details, booking records and password-like tokens. These figures are the group's allegations; neither outlet has verified them.

Cyber Daily reported that the group initially offered no evidence, then published what appears to be an extract on the dark web. It said some email addresses in that material had appeared in earlier breaches, many had not, and the data may be historical based on date ranges in several files.

Cybernews listed Hotels.com and Vrbo among the Expedia Group brands, alongside Expedia itself.

Why it matters for remote workers and nomads: This paragraph is our read, not reporting. If you book through Expedia, Hotels.com or Vrbo, treat any message about a reservation with suspicion until you confirm it inside the official app or site. Change your password there and anywhere you reused it, and turn on two-factor authentication. Never pay through a link in an email, text or chat message that says there is a "booking issue"; contact the platform or host directly instead. Check your loyalty balances and account activity for anything unfamiliar, and keep your travel insurance and connectivity details organized in case you need to rebook quickly, as we outline in our guide to staying connected and insured while working abroad.

Is Cyprus really joining Schengen on July 1, 2027?

Not yet confirmed: Cyprus could complete Schengen accession by July 1, 2027, according to President Nikos Christodoulides, but that is a target date, as Sigmalive reports, and not a final decision.

The Cyprus Mail reports that the Greek government wants Cyprus to join on July 1, 2027, the day Greece takes over the rotating presidency of the Council of the EU. Christodoulides told the paper that objections from member states have largely been overcome. The paper adds that the European Commission backed Cyprus's accession in July, but that others remain unconvinced: the Council's Justice and Home Affairs configuration did not put Cyprus on the agenda of its October meeting, and its next meetings are on December 3 and 4.

Politis reports that Christodoulides has set 2027 as the target and that a political-level decision is still needed, which he hopes will come soon.

Open questions remain. The Cyprus Mail says the EU's digital Entry/Exit System is a sticking point, because arrivals through Ercan airport in the Turkish-administered north who then cross the Green Line would not be recorded. Christodoulides said a control mechanism at Larnaca and Paphos airports would address the issue but gave no details, per the same report.

For travelers, Travel Off Path notes that Cyprus currently grants U.S. visitors a stay of up to 90 days within any 180-day period, separate from time spent in the Schengen Area. It says that if Cyprus joins, time spent on the island will count toward the shared Schengen limit.

Why it matters for remote workers and nomads: This paragraph is our read, not reporting. If you have been treating Cyprus as the place to wait out your Schengen days, avoid building 2027 plans that depend on it staying outside the zone, especially anything scheduled for the second half of the year. Keep a buffer, favor routes with a non-Schengen fallback, and check for news after the next Council meetings, since a target can still slip. We track rule changes like this on our digital nomad visa tracker.

Is Korean Air launching nonstop flights from Newark to Seoul?

Yes: Korean Air plans daily nonstop flights between Newark Liberty International Airport (EWR) and Seoul's Incheon Airport (ICN) starting May 22, 2027, The Points Guy reported.

The SkyTeam carrier will fly a Boeing 777-300ER on the route, according to The Points Guy, which said the airline did not specify the aircraft's configuration. One Mile at a Time lists the plane as having 277 seats: 8 first, 42 business and 227 economy. It also lists KE97 from Incheon to Newark, departing at 10:00 PM and arriving at 11:00 PM, and KE98 from Newark to Incheon, departing at 1:00 AM and arriving at 5:15 AM the next day.

Newark would become Korean Air's second New York-area gateway. The Points Guy said it complements the airline's long-standing twice-daily service to John F. Kennedy International Airport (JFK), and that Newark is the carrier's first new U.S. destination since Boston in 2019.

Competition is already there. The Points Guy said United Airlines launched its first-ever Newark-Incheon nonstop in September, flying a Boeing 787-9. One Mile at a Time also lists Air Premia, a South Korean budget carrier that began the route in May 2023.

The Points Guy also said the new flight creates a connection with joint venture partner Delta Air Lines, and that the partnership lets Delta and Korean Air coordinate commercial matters, including fares and schedules, between the U.S. and South Korea.

Why it matters for remote workers and nomads: This paragraph is our read, not reporting. If you want a Seoul base, or a hub for onward trips elsewhere in Asia, a Newark departure is worth pricing against your usual airport once the schedule opens. Compare all three airlines on the same dates, and check whether a SkyTeam or Delta route could put your miles to use. Late-night departure and arrival times can change your first-night lodging plans, so factor them in before you book. Set a fare alert early and pair it with the tactics in our cheap flights guide.

What to watch

• Microsoft 365 capacity: the BBC's latest update said Microsoft saw early signs of stabilisation but capacity had not yet returned to normal levels.
• Whether Expedia says what data was exposed. So far, Skift reports, it has not identified the vendor or the scale of the breach.
• The EU Council's Justice and Home Affairs meetings on December 3 and 4, per the Cyprus Mail, after Cyprus was left off the October agenda.
• Korean Air's Newark–Seoul launch, scheduled for May 22, 2027.