There’s more news around the CrowdStrike incident.
Delta Air Lines estimates that the recent CrowdStrike outage will cost the airline $500 million, primarily due to lost revenue and compensation for canceled flights. The disruption led to over 5,000 flight cancellations and significant financial repercussions, prompting Delta to seek damages. Delta Air Lines is considering legal action against CrowdStrike and Microsoft. The airline has hired attorney David Boies to explore recovery options, although no lawsuit has been filed yet.
CrowdStrike is also facing a shareholder lawsuit. Shareholders allege the company misled them about its software testing procedures, leading to significant reputational and financial damage, including a $25 billion drop in market value. CrowdStrike denies the allegations and plans to defend itself vigorously.
The Cyber Safety Review Board (CSRB) is considering whether to investigate CrowdStrike. While the Department of Homeland Security has not confirmed a formal review, many experts advocate for it, citing software liability and resilience lessons.
CrowdStrike has reported that 99% of its Windows sensors are now online.
The CrowdStrike outage on July 19 had a varied impact on managed service providers (MSPs) and their clients, with 41% of MSPs reporting no customer impact, according to a Canalys survey. Larger enterprises were more affected than small and midsize businesses. Regional differences were noted, with Latin America and Asia Pacific reporting higher impacts than North America and Europe.
In addition, over 180 software companies have now committed to CISA’s Secure by Design Pledge, emphasizing the importance of integrating security principles into product design. The initiative aims to shift the cybersecurity burden from consumers to producers, encouraging firms to take ownership of security outcomes at the executive level. Key goals include enhancing multi-factor authentication, timely vulnerability disclosure, and reducing default passwords.
So, the story has advanced into consequences, as we can note that the recovery numbers tell us the incident is decidedly over. A note on why about the impact – the incident hit Asia Pacific harder due to timezones. It started in prime time there.
What will happen? I expect the CSRB to take the case up, and I expect the lawsuits to fizzle. However, I am also noting the growth of CISA’s pledge numbers—180 companies now. Are your vendors on it?