CrowdStrike Windows Outage 07/19/2024

Key Takeaways

  • CrowdStrike experienced a significant disruption due to a misconfigured Windows update, leading to widespread issues with Windows workstations globally.
  • The outage primarily affected enterprises using Windows 365 Cloud PCs and did not impact Mac or Linux systems.
  • The incident caused operational disruptions across various sectors, including hospitals and airlines, resulting in service outages and payment processing delays.
  • For organizations to mitigate similar risks in the future, understanding Third-Party Cyber Risk Management is essential, along with employing robust Cybersecurity Services for Small Businesses.

What Happened?

CrowdStrike, a leading endpoint cybersecurity firm, reported that a routine Windows update combined with an update deployed by CrowdStrike caused widespread disruptions to Windows workstations globally on Friday. This was not a cyberattack. The issue has been traced to a misconfigured .sys file deployed by CrowdStrike to customer devices running the Falcon endpoint sensor. This defect led to workstations entering an endless boot loop and displaying the “blue screen of death.”

Who was Affected?

CrowdStrike’s CEO, George Kurtz, stated that the defect originates from a single content update for Windows hosts and does not affect Mac or Linux systems. A large number of affected customers are enterprises using Windows 365 Cloud PCs with CrowdStrike’s endpoint detection software. The outage has also extended to Google Cloud Compute Engine, causing crashes and unexpected reboots of Windows virtual machines running CrowdStrike’s csagent.sys.

What is the Impact?

The disruption has been extensive, affecting hospitals, financial institutions, media outlets, various airlines, retail stores, and more. This has led to service outages, flight cancellations and groundings, payment processing issues, and various other operational disruptions. In the U.S., emergency call centers in Alaska were non-operational, and border crossings with Canada were slowed.

What Can be Done?

CrowdStrike has deployed a fix and advised affected customers to consult their support portal for updates. The recovery is anticipated to take several days since the issue must be resolved manually, one endpoint at a time. Although the misconfigured file was automatically distributed to endpoint devices, there is no automated solution for repairing the crashed computers at the time of this writing. Each workstation must be manually restarted in safe mode followed by the removal of the faulty software. For organizations looking to enhance their cybersecurity posture, exploring comprehensive Cybersecurity Services for Small Businesses can be beneficial.