CrowdStrike outage (July 2024)
A global outage caused on July 19, 2024 by a faulty update to the Falcon security agent, which crashed some 8.5 million Windows computers with no malicious intent at all.
CrowdStrike's Falcon agent runs at the core of the operating system to detect attacks, and it receives configuration files describing new threats several times a day. One of them contained an error the driver could not handle: every machine that received it crashed to a blue screen and rebooted in a loop. The fix went out in under an hour and a half, but machines already stuck often had to be repaired one by one, by hand. The event became the textbook case of non-malicious accumulation risk: a single vendor, present at a large share of companies, can simultaneously halt thousands of policyholders without any attacker involved. It forced insurers to reread their system failure and dependent business interruption covers, their hourly waiting periods and their infrastructure exclusions.
The faulty file was published on July 19, 2024 at 04:09 UTC and pulled at 05:27. Microsoft estimated the number of affected machines at 8.5 million. Delta Air Lines canceled about 7,000 flights over five days and put its cost at some 500 million dollars; Parametrix estimated the direct losses of the 500 largest US companies at 5.4 billion dollars, only a small share of which was insured.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.