Delta Air Lines' response to the CrowdStrike outage shows how a company can lose control of a crisis it did not cause. The July 2024 outage left Delta with more than 6,600 cancellations by July 23, according to the Associated Press, far more than any other US airline. Delta's compensation handling and public legal threats then kept the story in the news for months, and four planning gaps explain how.
CrowdStrike is a cybersecurity company whose faulty software update crashed about 8.5 million Windows machines on July 19, 2024, according to Microsoft figures reported by the Associated Press. Airlines were among the businesses hit hardest.
Why did Delta's outage last longer than other airlines' outages?
Delta's outage lasted longer because its operations stayed disrupted after other airlines had returned to normal. On the morning of July 23, 2024, Delta's more than 400 cancellations that day accounted for about two-thirds of all US cancellations, according to FlightAware figures reported by the Associated Press.
The cause of the slower recovery was disputed in public. In letters sent in early August 2024, lawyers for CrowdStrike and Microsoft said Delta had turned down offers of help. Mark Cheffo, a partner at the law firm Dechert representing Microsoft, wrote to Delta's counsel that Delta apparently had not modernized its IT infrastructure, and Delta replied that it had invested billions of dollars in IT since 2016.
For a communications team, the dispute matters less than its effect: while the cause was argued, the customer experience stayed the headline. A vendor failure belongs on the list of situations a company rehearses, which the glossary entry on scenario planning explains.
How did compensation handling create a second wave of complaints?
Compensation handling created a second wave of complaints because customers judged Delta on refunds and hotel costs, not on the original outage. On July 23, 2024, the US Department of Transportation opened an investigation into Delta, and Transportation Secretary Pete Buttigieg said the agency had received hundreds of complaints. Delta said it had extended a travel waiver for bookings from July 19 to 28 and was covering eligible meals, hotels and ground transportation.
Passengers later sued. Plaintiffs in a class action allege that Delta offered reimbursement without making clear that it was partial, and that accepting it released legal claims. The Register reported that a federal judge cleared the class action to proceed in 2025, and Law360 reported in January 2026 that the judge allowed passengers to pursue some claims that had been dismissed.
A compensation policy with named timelines and channels, approved before an incident, removes the improvised decisions that regulators and plaintiffs examine later.
What does a public lawsuit threat do to a crisis story?
A public lawsuit threat gives every other party a reason to answer in public, which adds a new round of headlines to the original story. After Delta signaled it would seek damages from CrowdStrike and Microsoft, CrowdStrike attorney Michael Carlinsky, a partner at Quinn Emanuel, wrote that the threat had "contributed to a misleading narrative" about who was responsible for Delta's IT decisions. Microsoft answered two days later with its own letter.
The legal claim and the communications cost are separate questions. Delta sued CrowdStrike in Georgia state court in October 2024, and on May 16, 2025, Judge Kelly Lee Ellerbe of Fulton County Superior Court let claims including gross negligence and computer trespass proceed, according to ch-aviation, while dismissing parts of the fraud allegations. That ruling shows Delta had a legal basis to sue.
The communications choice is timing. A threat made before filing lets the other side reply first, and in this case both vendors did within days.
What should a crisis plan cover for an IT outage?
A crisis plan for an IT outage should close four gaps that Delta's case exposed. The table shows each gap and the plan element that answers it.
| Gap | What Delta's case showed | What the plan should contain |
|---|---|---|
| Vendor-failure scenario | The outage began with a third-party update, and the cause was argued in public for weeks | A named scenario with an owner and a holding statement |
| Compensation policy | A federal investigation opened four days after the outage began, and passengers later alleged unclear reimbursement terms | A pre-approved policy with timelines, channels and plain-language terms |
| Public legal posture | CrowdStrike and Microsoft each answered Delta's threat in public within days | A rule that communications and legal agree before any claim is previewed publicly |
| Plan testing | A technology failure moved from IT to reputation in a few days | A review once or twice a year against new threats and the current news cycle |
Common scenarios to rehearse include cyber security and data breaches, IT and system outages, diversity, equity and inclusion issues, natural disasters, active shooters and corporate malfeasance. The guide to what a crisis communications plan includes covers roles, holding statements and stakeholder protocols.
What should a company decide before the next outage?
A company should decide, before an outage, who speaks, what customers are owed and whether any legal claim is previewed in public. In Delta's case, regulators, vendors and plaintiffs' lawyers settled each of those questions in public because the company had left them open. An outside adviser can test a plan for risks an internal team may not see, and 5W's crisis PR team builds and tests crisis communications plans for companies.
Last updated October 13, 2026.
