Faulty CrowdStrike update causes major global IT outage, paralyzing banks, airlines and companies worldwide
Companies around the world are reporting IT outages, including Windows “Blue Screen of Death” errors on their computers. It is one of the most widespread IT disruptions in recent years. The outage – which was caused by a software update from well-known cybersecurity firm CrowdStrike – affected computers running Microsoft Windows in companies across a range of industries, including airlines, banks, retailers, brokerage houses, media companies and railway networks. The travel sector appears to be the most affected, according to online conversations.
CrowdStrike CEO George Kurtz confirmed in a post on X that a “defect” in a content update for Windows hosts caused the outage and ruled out a cyberattack, adding that the company was working on a fix and that Mac and Linux hosts were not affected.
“CrowdStrike is actively working with customers affected by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not affected,” Kurtz noted on X.
“This is not a security incident or cyberattack. The issue has been identified, isolated, and a fix deployed. We direct customers to the support portal for the latest updates and will continue to provide full and continuous updates on our website. We also recommend that organizations ensure they communicate with CrowdStrike representatives through official channels. Our team is fully mobilized to ensure the security and stability of CrowdStrike customers,” Kurtz said.
Later Friday, the U.S. cyber agency CISA said that while it had not found any connection between the outage and suspicious activity, it had “observed threat actors exploiting this incident for phishing and other malicious activities.”
A post on CrowdStrike’s support forums (which can only be accessed with a login) also confirmed the issue early Friday, saying the company had received reports of crashes related to a content update. CrowdStrike said the crash reports were “related to the Falcon Sensor” – its cloud-based security service that it describes as “real-time threat detection, simplified management, and proactive threat hunting.”
A moderator of the CrowdStrike The subreddit also said the company was aware of “widespread reports” of blue screen errors on Windows devices across multiple versions of its software. The company is investigating the cause, the message said.
The security company did not immediately respond to a request for comment.
Microsoft noticed issues in the early hours of July 19. The Service Health page currently states that Microsoft 365 for Consumers is now back up and running. However, enterprise apps are still experiencing disruptions, according to the Service Health Status for the enterprise cloud services.
“We are aware of an issue affecting Windows devices due to an update from a third-party software platform. We expect a fix to be in place soon,” a Microsoft spokesperson said in a statement to TechCrunch.
The Microsoft spokesperson said that the previous service disruption at Microsoft 365 on the night of July 18-19 was unrelated to the widespread outage triggered by the CrowdStrike update.
There will be many questions about the resilience – or perhaps lack thereof – of cloud services, and in particular how a single update could bring so much of the world to a standstill.
“In our view, cybersecurity products must meet higher reliability and security requirements in customer implementation than other technology products because they are mission-critical and are actively targeted by attackers,” Goldman Sachs analysts wrote in a research note on Friday. “In some ways, we believe this will increase the barrier to entry into the industry and the need for best-in-class update, failure and customer service protocols, ultimately benefiting companies with scale.”
Airlines and airports in Germany, France, the Netherlands, Great Britain and the USA as well as in Australia, China, Japan, India, Singapore and Taiwan are reporting problems with check-in and ticketing systems, leading to flight delays and major chaos at airports.
U.S. aviation authorities announced a nationwide shutdown of air travel on Friday due to the outages, which may have climate implications, experts told TechCrunch. Others were affected by the outages and flight chaos in other ways.
In the UK, the London Stock Exchange reported disruptions. Several UK medical practices reported on X that the outage affected the National Health Service’s clinical computer system, which contains medical records and is used to schedule appointments.
And in the US, some 911 operators and other call centers appear to be affected. A post by Alaska State Troopers said many of these call centers “were not functioning properly throughout the state of Alaska.”
British news channel Sky News experienced problems broadcasting live this morning due to the outage, the company’s chief executive, David Rhodes, tweeted. The New Zealand Herald reported that banking services in the country were also affected by the issue, and several Indian news channels said they also experienced problems broadcasting.
Many corporate employees have reported being unable to start their computers due to the issue. The outage came shortly after Microsoft confirmed service issues with its Microsoft 365 apps late Thursday, affecting several airlines, including Delta and United. Microsoft’s service status page says the issues are being resolved.
And amid the chaos, misinformation spread, including that a Blue Screen of Death was being displayed at the Las Vegas Sphere.
Before CrowdStrike admitted its role in the crash, businesses and security experts began pointing fingers early Friday at the company, whose software is used by millions of people in enterprises to manage security on both devices and servers. Experts told TechCrunch that competitors could also benefit from the debacle.
CrowdStrike counts nearly 60% of the Fortune 500 and more than half of the Fortune 1,000 among its customers, according to its website. Its services are used by eight of the top 10 financial services companies and an equal number of leading technology companies. The company also has a strong presence in the healthcare and manufacturing sectors, serving six and seven of the top 10 companies in those industries, respectively.
CrowdStrike shares were down about 11% at the close on Friday and had a market capitalization of $74.2 billion at the time of writing.
Ram Iyer, Ingrid Lunden and Zack Whittaker contributed to this report.
This story was originally published at 12:09 a.m. on July 19 and has been updated with new information.
