How did CrowdStrike handle crisis communications during the July 2024 outage? CrowdStrike named the cause, a defective content update and not a cyberattack, on the day it happened and apologized within days. Its later fight with Delta Air Lines moved the story from the outage to blame. Microsoft estimated 8.5 million Windows devices crashed, and shareholders alleged a $25 billion loss in market value within 12 days.
What happened in CrowdStrike's first 72 hours?
CrowdStrike's first 72 hours ran from a faulty update at 04:09 UTC on July 19, 2024 to a public apology and recovery report by July 21. The table pairs each event with the communication move that accompanied it.
| When | Event | Communication move |
|---|---|---|
| July 19, 2024, 04:09 UTC | CrowdStrike releases a sensor configuration update for Windows hosts | None yet, because the failure was not visible |
| July 19, 05:27 UTC | The faulty file is removed; Windows devices running Falcon sensor 7.11 or later and online in that window are exposed | A spokesperson later gave the exact removal time |
| July 19 | CEO George Kurtz states the cause is a defect in a content update, not a cyberattack | Cause named on day one |
| July 20 | Microsoft estimates 8.5 million Windows devices were affected, under 1% of all Windows machines | A third party sizes the impact |
| July 21 | CrowdStrike apologizes and reports many affected devices back online | Apology plus a recovery update |
What did CrowdStrike get right?
CrowdStrike got three things right: it gave exact times, it named the cause early, and it reported recovery in numbers. The company's spokesperson placed the removal of the faulty file at 05:27 UTC, 78 minutes after the update went out, and the defined window let customers check whether their devices were exposed.
On the cause, Kurtz said the failure came from a content update defect and not an attack, which answered the first question every customer and reporter was asking. On recovery, Kurtz reported in a July 25 post that over 97% of Windows sensors were back online, and CrowdStrike's incident page later put the figure near 99% as of July 29, as TechTarget and TechRadar reported. Numbers gave journalists a measurable story to track.
Where did the communication go wrong?
The communication went wrong when the dispute with Delta Air Lines moved from private negotiation to a public contest over blame. Delta CEO Ed Bastian told CNBC at the end of July that the outage cost the airline $500 million and that Delta would seek damages, saying the airline had "no choice."
CrowdStrike's outside counsel answered in an August letter to Delta's lawyers, reported by CyberScoop and The Record. The letter said CrowdStrike offered help that Delta declined, accused Delta of a "misleading narrative," and said any CrowdStrike liability was contractually capped in the single-digit millions. Delta filed suit on October 25, 2024 in a Georgia state court, seeking more than $500 million, according to TipRanks. A CrowdStrike spokesperson called the suit a "desperate attempt to shift blame."
5W's reading: a legal position sent as a public letter invites the other side to answer in public, and the contract cap became the headline. The earlier apology was then read against the later argument.
A second problem came from the company's own words. The shareholder complaint, as Reuters reported, cited a March 2024 earnings call in which Kurtz described the software as "validated, tested and certified." After the outage, that earlier line became evidence in a lawsuit CrowdStrike said lacked merit.
What did the outage cost?
The outage cost Delta $550 million by its own SEC accounting and prompted a shareholder class action alleging a $25 billion loss in market value. The table lists each reported figure and who reported it.
| Party | Reported figure | Reported by |
|---|---|---|
| Devices affected | 8.5 million Windows devices, under 1% of all Windows machines | Microsoft |
| Delta Air Lines | $380 million in lost revenue and $170 million in costs | Delta, per its SEC filing as reported by CNBC |
| Delta flights | About 7,000 flights canceled from July 19 to 24, affecting 1.3 million customers | Delta, as reported by Dark Reading |
| CrowdStrike market value | A 32% share price fall and $25 billion lost within 12 days, as alleged | Shareholders in a class action filed in Austin, Texas |
CrowdStrike disputes the shareholder claims and said Delta's recovery was slow because of its own IT systems, according to the AP as cited by Dark Reading. The shareholder figures are allegations, and the Delta figures are company disclosures.
What can crisis teams copy from the CrowdStrike outage?
Crisis teams can copy four moves from the CrowdStrike outage: publish exact times, keep the apology separate from the legal position, audit past claims, and track recovery in numbers. The table turns each into an action.
| Move | What CrowdStrike did | What to do |
|---|---|---|
| Publish exact times and scope | Gave a start time, an end time, and the affected software versions | Write a one-line fact box with times and affected products before the first statement |
| Keep apology and liability apart | Apologized, then argued a liability cap in a public letter | Send legal positions through counsel and keep public statements on customer impact |
| Audit past claims | A 2024 "validated, tested and certified" line became part of a complaint | List every public reliability claim and check each against the incident record |
| Report recovery in numbers | Reported 97% and then about 99% of sensors online | Set a daily recovery metric and publish it at the same time each day |
For a comparison with a recall response, see 5W's Toyota recall crisis case study. For the apology mechanics, see 5W's guide to apologizing publicly, and for the wider framework, the complete guide to crisis PR.
Frequently Asked Questions
What caused the CrowdStrike outage?
A defective sensor configuration update, released at 04:09 UTC on July 19, 2024, crashed Windows devices running Falcon sensor 7.11 or later. CrowdStrike removed the faulty file at 05:27 UTC, and Kurtz said the cause was a defect, not a cyberattack.
How many devices did the CrowdStrike outage affect?
Microsoft estimated that the update affected 8.5 million Windows devices, which it said was less than 1% of all Windows machines.
How much did the CrowdStrike outage cost Delta?
Delta reported $380 million in lost revenue and $170 million in costs, a total of $550 million, according to its SEC filing as reported by CNBC. Delta sued CrowdStrike on October 25, 2024.
Did CrowdStrike apologize for the outage?
Yes. Kurtz apologized in the days after July 19, and CrowdStrike's later legal letters again expressed regret for the outage while disputing Delta's claims.
What should a technology company do before its own outage?
A technology company should write its fact box, its apology, and its recovery metric before an incident, and should audit its public reliability claims now. The CrowdStrike case shows that the first hours can go well and the following months can still be defined by a dispute.
Technology brands that want an incident plan built before it is needed can start with 5W's crisis PR firm and technology PR practices. For other technology cases, see 5W's roundup of the best technology PR campaigns.
