Cybersecurity firm CrowdStrike has tried to limit the fallout from its global outage last summer, which wreaked havoc on airlines, financial services, and numerous other industries. When Delta Air Lines filed a lawsuit to recoup its losses, CrowdStrike tried having the case dismissed. But now a federal judge has given Delta the okay to proceed with its lawsuit over the outage, pointing out that CrowdStrike’s own president admitted that it did something “horribly wrong”.
The July 2024 screwup, which has since been described as the largest IT outage in history, affected computers running on Microsoft Windows. Per CrowdStrike, it was caused by a faulty software update that passed the company’s validation checks “despite containing problematic content data.” Once the update went through, millions of devices worldwide displayed the infamous Blue Screen of Death.
CrowdStrike’s outage is estimated to have cost U.S. Fortune 500 Companies $5.4 billion. But amongst airline companies, Delta was hit the hardest. Per Reuters, Delta says it cancelled 7,000 flights and accrued $550 million in lost revenue and additional costs. (Although, Delta did save $50 million on fuel from cancelling flights so, hey. That’s something.)
Delta filed its initial lawsuit against CrowdStrike three months after the outage. Although CrowdStrike tried to have it dismissed, Judge Kelly Lee Ellerbe of the Fulton County Superior Court ruled that Delta can try to prove CrowdStrike’s gross negligence, writing, “Delta has specifically pled that if CrowdStrike had tested the July update on one computer before its deployment, the programming error would have been detected.”
In addition, Reuters reported that Ellerbe is allowing Delta to pursue a computer trespass claim because Delta states that CrowdStrike falsely promised not to add an “unauthorized back door” into the company’s computers.
CrowdStrike, meanwhile, claims that Georgia “specifically precludes Delta’s efforts to recover through tort claims the economic damages it claims to have suffered,” per CNBC. In addition, CrowdStrike said that Delta was an “outlier” that refused help and its own systems likely made the incident worse. CrowdStrikes wrote, “Although Delta acknowledges that it took just hours — not days — for Delta employees to [fix the outage], cancellations far exceeded the flight disruptions its peer airlines experienced.”
It’s true that other airlines recovered faster (for example, United only cancelled about 1,500 flights). Per Fortune, one reason that Delta was hit harder is because of its heavy reliance on its Atlanta hub. In an earlier letter that CrowdStrike’s lawyer, Michael Carlinsky, sent Delta denying any gross negligence, Carlinsky wrote that Delta needs to address the “design and operational resiliency capabilities” of its IT structure. He said that if Delta “pursue[s] this path, Delta will have to explain to the public, its shareholders, and ultimately a jury why CrowdStrike took responsibility for its actions — swiftly, transparently, and constructively — while Delta did not.”
But CrowdStrike really shouldn’t pat itself on the back for its response to the outage. Shortly after the incident, CrowdStrike sent out $10 apology gift cards for UberEats that didn’t even work. And about a week after Carlinsky’s letter to Delta, CrowdStrike’s president, Michael Sentonas, attended the Pwnie Awards to accept his company’s win for Most Epic Fail.
“Definitely not the award to be proud of receiving,” Sentonas said. “I think the team was surprised when I said straight away that I’d come and get it because we got this horribly wrong…It’s super important to own it when you do things horribly wrong, which we did in this case.”
Sentona’s acceptance speech was referenced in Ellerbe’s decision where she wrote that “its own president publicly stated that CrowdStrike did something ‘horribly wrong.’” But per Reuters, Carlinsky believes that a judge will either say Delta’s case has no merit or keep damages in the “single-digit millions of dollars” region.
This is a small win for Delta. But just as CrowdStrike must atone for its apparent sins, Delta has to do so, too. Earlier this month, U.S. District Judge Mark Cohen in Atlanta said that Delta must face a lawsuit from passengers who were refused full refunds for canceled flights in connection with the outage.
Read the full article here
