In what will go down as the most spectacular IT failure the world has ever seen, a botched software update from cybersecurity firm CrowdStrike Holdings Inc. crashed countless Microsoft Windows computer systems globally.
Microsoft Corp. and CrowdStrike have rolled out fixes and systems are being restored. But for several hours, bankers in Hong Kong, doctors in the UK and emergency responders in New Hampshire found themselves locked out of programs critical to keeping their operations afloat.
“This is unprecedented,” said Alan Woodward, professor of cybersecurity at Surrey University. “The economic impact is going to be huge.”
The catastrophic failure underscores an increasingly dire threat to global supply chains: The IT systems of some of the world’s biggest and most critical industries have grown heavily dependent on a handful of relatively obscure software vendors, which are now emerging as single points of failure. In recent months hackers have exploited this phenomenon, targeting vendors to bring down entire sectors and governments.
Adding to the disruption, Microsoft experienced a separate and apparently unrelated problem with its Azure cloud service on Thursday that lasted for several hours. On Friday afternoon, the company said in a post on X that all Microsoft 365 apps and services had been restored.
By the New York morning, many systems were coming back online. CrowdStrike’s Chief Executive Officer George Kurtz said in a pre-6 a.m. post on X that the fault had been identified and that the company had deployed a “fix” which required manually rebooting Windows machines. Microsoft said later that it had addressed the underlying cause of its IT issue.
Shares of CrowdStrike dropped 11% at 9:45 a.m. in New York trading, wiping about $7.4 billion off its market value. Shares fell as much as 15% earlier in the day, the biggest intraday decline since February. Microsoft shares were little changed at $437.65.
There are precedents for such outages. In 2017, a series of errors within Amazon.com Inc.’s cloud service affected the operation of tens of thousands of websites. In 2021, issues at content delivery network Fastly took out several media networks including Bloomberg News. Disruptions also incapacitated Amazon’s AWS cloud service.
But none of those approached the scale of the CrowdStrike outage, which hit airlines, banks and health-care systems, and whose repercussions are still being felt.
“I don’t think it’s too early to call it: this will be the largest IT outage in history,” Troy Hunt, an Australian security consultant and creator of the hack-checking website Have I Been Pwned, said in a post on social media platform X.
Airlines
Airport hubs from Berlin to Delhi struggled with delays, cancellations and stranded passengers on a day that was particularly busy for travel. FlightAware said more than 21,000 flights were delayed globally.
United Airlines Holdings Inc. and Delta Air Lines Inc. gradually resumed operations on Friday, though the effects of the disruption may continue for several days in light of the busy flight season.
Other US carriers that had temporarily grounded flights included American Airlines Group Inc. and Spirit Airlines Inc., according to the Federal Aviation Administration.
Finance
The London Stock Exchange Group has resolved an issue that stopped the bourse from publishing news on its website via RNS, a service that publicly traded companies use to distribute price sensitive regulatory announcements.
A number of banks were forced to revert to backup systems during the IT failure. Bankers at JPMorgan Chase & Co., Nomura Holdings Inc. and Bank of America Corp. were unable to log on for part of the day on Friday and the trading desk at Haitong Securities Co. was out of action for about three hours.
Health
The disruptions also impacted critical infrastructure, including emergency services.
Doctors at the UK’s National Health Service couldn’t access scans, blood tests and patient histories. Memorial Sloan Kettering Cancer Center in New York and Boston-based Mass General Brigham warned that the CrowdStrike issue was affecting patient care. Hospitals in Europe reported having to close clinics and cancel procedures.
New York’s 911 and emergency systems were also impacted. While the state’s chief cyber officer said that fixes were underway, there was no clarity on when services would be fully restored. New Hampshire’s emergency 911 services are functioning again after a failure in which operators could see calls coming in but couldn’t answer them.
Photo: A self check-in kiosk is unavailable at the the Jetstar check-in area of Sydney Airport in Sydney, Australia, on Friday, July 19, 2024. Photographer: Brendon Thorne/Bloomberg