Learn / Famous incidents explained
The CrowdStrike outage (2024)
Not a hack at all. A faulty security software update crashed about 8.5 million Windows computers on July 19, 2024, grounding flights and disrupting hospitals. What went wrong and why resilience is part of security.
What happened
In the early hours of July 19, 2024 (UTC), the cybersecurity company CrowdStrike pushed a routine content update to its Falcon Sensor, endpoint protection software used by many large organizations. The update contained a configuration file that triggered an error in the sensor, which runs with deep access to Windows. Affected Windows computers crashed with the "blue screen of death" and, because the faulty file loaded again at startup, many got stuck in a reboot loop.
CrowdStrike identified the problem and reverted the update in about an hour and a half, but machines that had already received it stayed broken. Microsoft estimated that about 8.5 million Windows devices were affected, less than one percent of all Windows machines, but concentrated in airlines, banks, hospitals, broadcasters, retailers and emergency services.
This was not a cyberattack. No attacker was involved. It is in this collection because security is about keeping systems available, not just keeping attackers out.
The impact
| Sector | Example effects |
|---|---|
| Air travel | Thousands of flights canceled worldwide; one US airline took over a week to recover fully |
| Healthcare | Appointments and procedures postponed, some systems back to paper |
| Banking and payments | Online banking and card payments disrupted at some institutions |
| Broadcasting | Some TV channels briefly went off air |
| Emergency services | Some 911 call centers had system problems |
Estimates of the financial losses ran into billions of US dollars, making it one of the largest IT outages in history.
Why recovery was slow
- Manual fixes. The standard fix required booting each machine into safe mode or a recovery environment and deleting the faulty file. That often meant someone physically at the keyboard.
- Disk encryption. Many corporate laptops use BitLocker encryption, so technicians needed the recovery key for each machine. Organizations that had not stored keys in an accessible place struggled.
- Scale. Large companies had tens of thousands of affected machines, including servers and kiosk systems.
- Scams followed. Within hours, criminals registered look-alike domains and sent phishing emails offering fake "fixes". CrowdStrike and government agencies warned customers to use only official guidance.
What changed afterward
CrowdStrike published a root-cause analysis and committed to staged rollouts of content updates, giving customers more control over update timing and adding more testing and validation. Microsoft held discussions with security vendors about reducing how much security software needs to run at the deepest level of Windows, and began work on changes to let such tools run with less risk of crashing the whole system.
Lessons for every organization
- Plan for failures, not just attacks. Business continuity planning should cover your own tools breaking. See incident response plan.
- Know where your recovery keys are. Store BitLocker and other encryption recovery keys securely but accessibly, and test retrieval.
- Have manual fallback procedures for critical operations, such as paper check-in or offline records.
- Ask vendors about rollout practices: do they stage updates, and can you control timing for critical systems?
- Verify crisis communications. During an outage, attackers impersonate vendors. Get fixes only from official channels.
What it does not mean
The outage does not mean you should turn off automatic security updates. Delaying updates leaves known, actively exploited flaws open, which remains the far bigger risk for individuals and small businesses. See software updates.
