Microsoft put a number on it two days after the crash: 8.5 million Windows devices. “We currently estimate that CrowdStrike’s update affected 8.5 million Windows devices,” the company said in a blog post.
The trouble began on 19 July 2024, when the American security firm CrowdStrike distributed a faulty update to its Falcon Sensor software. Computers running it crashed and could not restart. CrowdStrike said the cause was a defect in the update to Falcon, its security software for Windows hosts. Microsoft stressed that the fault was not in its own software.
What 8.5 million machines meant
David Weston, a Microsoft vice-president, wrote that the figure was less than 1% of all Windows machines worldwide. The damage was out of proportion to that share, he said, because “the broad economic and societal impacts reflect the use of CrowdStrike by enterprises that run many critical services”.
Airlines, banks, call centres, transport systems and health services struggled around the world. Hospitals, GPs, pharmacies and supermarkets were hit. By the third day, more than 1,500 flights in the US had been cancelled, with dozens more in the UK. About 100,000 travellers were affected over the weekend, according to the Independent’s Simon Calder.
Delta Air Lines took the worst of it. It cancelled another 1,250 flights on Sunday on top of the 3,500 it had already scrapped, and by then had called off more than 5,000 since Friday. Chief executive Ed Bastian told customers that a crew-tracking tool was “unable to effectively process the unprecedented number of changes triggered by the system shutdown”. Transportation Secretary Pete Buttigieg spoke with him and said the department had received hundreds of complaints. “No one should be stranded at an airport overnight or stuck on hold for hours,” he said.
At the US-Mexico border, the San Diego Union-Tribune reported, even approved Border Protection vehicles sat stranded for about 90 minutes, and officials fell back on colour-coded cards.
Recovery
Microsoft sent hundreds of engineers to help customers over the weekend and released a recovery tool for affected machines. CrowdStrike said a significant number of the devices were back online by Monday. Experts warned that full recovery of the world’s tech infrastructure could take weeks. David Wrigley of the BMA’s GP committee said GPs would still need time to catch up on lost work. The NHS asked patients to come to appointments as usual unless told otherwise.
Scale was the other story. The BBC noted that the figure made it probably the largest cyber-event on record, well past WannaCry in 2017, which is estimated to have hit around 300,000 computers in 150 countries.
Scammers move in
Cyber agencies in the UK and Australia warned of fake emails, calls and websites posing as official help. CrowdStrike chief executive George Kurtz said, “We know that adversaries and bad actors will try to exploit events like this.” Researchers at Secureworks reported a sharp rise in CrowdStrike-themed domain registrations.
Ciaran Martin, the former head of the UK’s National Cyber Security Centre, told Sky News that the worst was over because the fault was spotted quickly and “essentially, it was turned off”. He said a similar outage was likely again unless governments and industry worked together to “design out” such flaws.
Sources
- CrowdStrike IT outage affected 8.5 million Windows devices, Microsoft says
- Travellers still stuck as experts warn IT outage is likely to happen again – latest
- 2024 CrowdStrike-related IT outages
