CrowdStrike Update Causes Havoc, Grounding Flights and Disrupting Businesses

The Biggest IT Outage in Recent Memory? A faulty CrowdStrike update triggered a global tech meltdown, grounding flights, disrupting banks, and crippling businesses. Dive deep into the causes, impact, and recovery efforts of this historic tech outage.

A seemingly minor software update by CrowdStrike, intended to enhance security, jolted the global IT infrastructure on Friday, marking history’s biggest-ever IT outage impacting banks, airlines, hospitals, and media outlets worldwide.

The incident is reminiscent of March 2017, when Amazon Web Services (AWS) experienced a major service disruption, causing hundreds of websites worldwide to go offline for hours. The investigation revealed that the entire havoc was caused by a minor typo made by an AWS engineer.

Reportedly, the outage caused Windows-based PCs and computer systems to reboot, network disruptions and displaying the dreaded blue screen of death. While Microsoft users were impacted worldwide, Mac and Linux hosts are safe.

CrowdStrike CEO George Kurtz states that this massive Microsoft outage was caused by an update to CrowdStrike’s ‘Falcon Sensor’. The issue has been isolated and a fix has been deployed. CrowdStrike is currently working with customers affected by a single content update for Windows hosts.

“The bug has affected many stock exchanges, supermarkets and flight operations across the globe. Users are experiencing the Blue Screen of Death (BSOD) error, which is causing their systems to shut down or restart unexpectedly.”

Screenshot: Twitter (X)

Cybersecurity researcher Kevin Beaumont posted on X that CrowdStrike is the cause of a global IT outage, not Microsoft, as its EDR product is used by large organizations worldwide. CyberKnow reports that a “decent amount of Australian Internet, Banking, and Media outlets” are affected, and the issue is a technical glitch rather than a cyberattack from China or APT40.

The Spectator Index reports that payment systems were also affected in the UK, Australia and other parts of the world. In addition, 911 services were disrupted in many US states, including Ohio, Arizona, Alaska, Indiana, Minnesota, and New Hampshire. The fault sent Sky News off the air and impacted services at the London Stock Exchange. According to DownDectector, a website that tracks internet outages, growing network disruptions were recorded at Visa, ADT security, and Amazon. 

Train services in Washington D.C. got suspended whereas major airlines, including Frontier and Sun Country Airlines, American Airlines, United, and Delta Airlines have implemented a “global ground stop” on all flights given the current situation, report Rawsalerts. In Europe, Ryanair’s app and website users reported difficulties in checking in for flights on Friday morning. Around 1,400 flights have been cancelled. The NHS reports that most GP surgeries in England are facing issues, with trains, shops, and pharmacies also facing similar challenges.

Microsoft, for its part, acknowledged the disruption and attributed it to a “third-party” issue – without explicitly naming CrowdStrike. Microsoft reported an outage in the Central US region, affecting a subset of customers with multiple Azure services. 

Microsoft 365 apps and services experienced disruptions for hours on Friday. The company is currently investigating the issue and attempting to fix it and give “gradual” relief to its users. In a series of posts on X, Microsoft stated that they are trying to reroute the impacted traffic to “healthy” alternate systems to expedite the remediation efforts. 

The incident, which some cybersecurity experts are calling the most significant tech outage in recent memory, highlighted the critical – and often precarious – reliance businesses have on a handful of major software providers. The widespread disruption prompted national emergency response teams in several countries to convene and assess the situation. Thankfully, there were no reports of essential services, such as emergency hotlines, being completely compromised.

Here are some Tweets related to the incident

Experts Comments

Tom Kidwell, Co-founder, Ecliptic Dynamics and former British Army and UK Government intelligence specialist commented on the outage stating, “The outage impacting Windows devices this morning appears to have been caused by a driver update by CrowdStrike, bricking older Windows devices and servers, which will be worst hit. Unfortunately for CrowdStrike, if that is the case, it could be nauseating to fix.”

“Due to the nature of the update, an individual from every organisation will need to boot into safemode, remove the issue file/driver, and then either roll back or update to a new version, something CrowdStrike will need to release very quickly,” he explained.

“Incidents like this highlight the vulnerability in using a single supplier on such a vast scale, and why organisations must have a backup plan. Best practice for vendors is to pressure test any updates before rollout, however, this can be difficult when you serve 60-90% of the world,” Tom added.

RELATED TOPICS