There is a special kind of heartbreak available only to people whose files live inside somebody else’s computer, and a number of nonprofits have just experienced it. Microsoft, according to The Register’s reporting on September 28, 2026, confirmed that an internal error deleted data tied to some expired Microsoft 365 Business Premium nonprofit subscriptions — deleted it early, before the company’s own retention period had run out — and that at least one affected organization has been told the data cannot be restored.
To appreciate the mechanics of the betrayal, you need the schedule. Microsoft’s standard offboarding for an expired subscription works like a slow drain: a 30-day grace period, then a 60-day activation window, then deletion under normal retention rules. Ninety days of runway in which an organization can migrate, export, or at least photocopy its digital life on the way out. The error shortened that runway without notice. The data went away before the timer said it should.
How the nonprofits got here
The expirations were not a surprise; they were policy. Microsoft announced in May 2025 that it would retire its Business Premium and Office 365 E1 grants for nonprofits at each organization’s next renewal on or after July 1, 2025. The replacement offers included up to 300 free Microsoft 365 Business Basic licenses and discounted pricing on several paid plans — a downgrade with a consolation basket, but a structured one. Organizations were given a defined window to migrate or export what they had. Some of them, it turns out, were racing a clock that had already been quietly unplugged.
Here is the part that elevates the incident from regrettable to faintly existential. Microsoft, in a statement reported by The Register, acknowledged it could not provide a list showing which data may have been deleted — or even confirm whether any data was deleted at all in a given case. Consider what that means operationally: not only is the milk spilt, the dairy cannot tell you which bottles it came from, or whether your fridge was among the casualties. An affected nonprofit cannot audit its own loss, because the party performing the deletion cannot enumerate the deletion.
The apology, and what it does not fix
Microsoft apologized and offered affected nonprofits a free concierge session with a Microsoft specialist, to help set up a new Microsoft 365 environment and answer questions. This is a real service and presumably a sincere one. It is also, as an answer to the problem at hand, roughly analogous to a moving company that has mislaid your furniture offering to help you pick out new curtains. The concierge configures replacement accounts. It does not restore deleted data, because the deleted data, Microsoft says, is unrestorable.
If your nonprofit held a Business Premium grant and its subscription expired during the transition, the practical advice is unglamorous: preserve every piece of Microsoft correspondence you still have, along with administrative records and audit logs. Nothing in the available reporting establishes that these documents will produce recovery — they may simply produce a more detailed record of the loss — but they are the materials most likely to matter if anything moves.
The questions without answers
What Microsoft has not disclosed would fill a small binder: how many organizations were affected, the precise dates the deletions occurred, and the root cause of the error. All remain unclear. Which means the scope of this is currently known only to the company that caused it, and possibly not even fully there.
The episode does draw one clean, useful line, and it is worth tattooing on the inside of every IT budget. A retention window is a schedule the vendor controls. A backup is a copy you control. The first is a promise about someone else’s behavior; the second is a fact about your own. The nonprofits that lost data this month were not careless — they were relying on the promise, and the promise turned out to have an error in it.
There is, at the bottom of the reporting, one genuinely clarifying detail. Microsoft has confirmed the data cannot be recovered — and also confirmed it cannot identify what the data was. It is possible, in other words, to lose something irreplaceable and never find out what it was. The cloud, it turns out, can rain on you in both directions.