NHS Reply-All Storm Cascade Simulator

Incident Controls ● LIVE MODEL

Initial List Recipients 840,000

Human Reply-All Rate (%) 2.0%

Auto-Responder / Out-of-Office Rate 5.0%

Exchange Server EPS Capacity 50,000

IT Policy Sandbox

BCC-Only Large Distribution Hides recipient list to prevent reply-all targets

Strip Reply-All Headers Re-writes distribution headers to disable reply-all

Rate-Limit Storm Throttle Caps duplicate subject fan-out per minute

Mail Cascade Network Visualizer OPERATIONAL

QUEUE DELAY: 0 min

FAN-OUT MAGNIFICATION: 1x

Queue Depth Telemetry

System Telemetry T+00:00:00

Total Emails Generated

168,000,000

Max Queue Delay

480 min

Time to Outage

0.5 hrs

Active Outage State

TRUE

Console Audit Log

ASSERTION STATUS MIRROR:

Total Emails: 168000000

Max Delay: 480 min

Outage Triggered: true

Time to Outage: 0.5 hrs

Active Policy: none

📋 INCIDENT POST-MORTEM & ANALYSIS NHS Cascade Reconstitution

In November 2016, an accidental test message transmitted to 840,000 NHS England employees initiated a compounding reply-all storm. Approximately 186 reply-all messages combined with automatic out-of-office responses created over 168 million email deliveries within hours, overwhelming Exchange queue buffers and disabling primary healthcare email services for half a day.

Primary Amplification Factor: 840,000 recipients per reply-all payload

Queue Saturation EPS Limit: 50,000 msgs/sec standard processing capacity

Mitigation Effectiveness: 0% (No IT Policy Active)