🧔♂️ A friendly human may check it before it goes live. More news here
CrowdStrike defeats investor lawsuit over software outage
A US federal judge has dismissed a lawsuit from CrowdStrike shareholders who claimed the cybersecurity company hid flaws in its software testing and quality assurance before a July 2024 outage that affected more than 8 million Windows computers.
Austin-based CrowdStrike faced allegations led by the New York State Common Retirement Fund, one of the largest US pension funds, that it lacked proper test plans and quality controls, allegedly prioritizing speed and profit.
Judge Robert Pitman found that the shareholders did not provide enough evidence that CrowdStrike or its executives intended to defraud investors or made materially misleading statements.
The July 19 outage, caused by a faulty update to CrowdStrike’s Falcon software, disrupted airlines, banks, hospitals, and emergency services.
Delta Air Lines said it lost US$500 million and canceled over 7,000 flights due to the incident, and has filed a separate lawsuit against CrowdStrike.
🔗 Source: Reuters
🧠 Food for thought
Implications, context, and why it matters.
The dismissal leaves litigation risks unresolved for CrowdStrike
- Judge Pitman dismissed the shareholder suit without prejudice (meaning it can be refiled), allowing plaintiffs to file an amended complaint 1.
- Delta Air Lines’ $500 million case in Georgia state court moved past a motion to dismiss 2, so CrowdStrike still faces risk.
- The airline passenger suit is under appeal 2, so liability could still widen.
- Guy Carpenter, a global reinsurance broker, estimates insured losses from the outage could top $1 billion 2. That would push costs beyond lawsuits, including insurance claims and indirect hits.
- The ruling sets a high bar for securities fraud and requires proof of intent to defraud 3. It did not endorse CrowdStrike’s testing practices, so reputational questions remain.
Software sellers should focus on staged updates to meet post-outage demand
- Sectors hit included airlines, banks, and hospitals with emergency services 2. These sectors plan to fund safer deployment.
- The US Cybersecurity and Infrastructure Security Agency (CISA) worked with CrowdStrike during recovery with over 1,000 federal agency representatives 4. Buyers in government will examine vendors’ update processes.
- IT with security teams want vendors with tiered rollout systems (staged releases to subsets of users or devices) and quick rollback (rapidly reverting a bad update) 5. That opens demand for canary deployments (testing on a small slice before broad release) and kill-switch functionality (remotely disabling problematic code).
- In PagerDuty’s 2024 survey, 88% of IT executives expect another incident within a year 6. Budgets are shifting to resilience-focused tools.
- Sellers that ship staged updates and fast rollback can stand out in enterprise deals, where risk now outweighs speed to market 5.
