The use of information technology (IT) across industries has created opportunities for disruptions and vulnerabilities in the supply chain for products and services. For example, some firms may be more susceptible to system failures, data breaches, and cyberattacks than others depending on the security of the IT systems used.¹ Recent examples include the February 2024 cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group, Inc.,² and a series of data breaches beginning in April 2024 that may have affected about 165 organizations using Snowflake, a cloud-based data management platform.³ The impact of these disruptions may be more widespread when components of IT systems are concentrated among a limited number of providers.

On July 19, 2024, CrowdStrike Holdings, Inc. (hereinafter CrowdStrike) released a software update with a defective file for devices using the Windows operating system, causing some Windows devices to crash. CrowdStrike and Microsoft subsequently released updated safe files and recovery tools.⁴ Some users were able to fix the issue by rebooting impacted devices multiple times, while others had to take additional steps.⁵ CrowdStrike's faulty update does not appear to be related to a cyberattack or data breach; instead, it is an example of the pervasiveness of some IT components and how an issue with an IT component may affect multiple sectors simultaneously, resulting in a host of disruptions domestically and internationally.

This FAQ provides a description of CrowdStrike and the faulty update and discusses how the faulty update affected certain sectors in the United States. For an overview of the incident and potential considerations for Congress, see CRS Insight IN12392, The July 19th Global IT Outages, by Chris Jaikaran.

How did the faulty CrowdStrike update occur, and what is CrowdStrike?⁶

CrowdStrike delivers cybersecurity products and services to its customers via a cloud computing platform—the Falcon platform.⁷ CrowdStrike, through its cloud-based platform, deploys and installs a software called the Falcon Agent or the Falcon Sensor on each connected endpoint device (e.g., individual computer) of its customers.⁸ On July 19, 2024, CrowdStrike released "a sensor configuration update" over the cloud to its customers' endpoint computers that were running the Falcon sensor for Windows operating systems.⁹ The update "triggered a logic error resulting in a system crash and blue screen [error]" on impacted computers.¹⁰ Those computers that were online and downloaded the faulty update within a certain time period on that day "were susceptible to a system crash."¹¹ CrowdStrike's faulty update does not appear to be related to a cyberattack or data breach. The outage occurred as part of the company's effort to deliver its cybersecurity services.

CrowdStrike claims that its cybersecurity products through the Falcon Agent can identify and prevent "known and unknown malware and fileless attacks" to protect its customers' endpoint devices while "capturing and recording … endpoint data."¹² The cyberattack events and data captured by the agent are streamed back to the Falcon platform's cloud infrastructure in real time "in order to be further analyzed" to optimize its cybersecurity algorithms.¹³ The agent can also be remotely reconfigured in real time to take other actions "as risk and threat postures change."¹⁴ This agent is built to support major computer operating systems, including Microsoft's Windows.¹⁵

What businesses were affected by CrowdStrike's faulty update?¹⁶

As of July 20, 2024, Microsoft estimates that about 8.5 million Windows devices, or less than 1% of all Windows devices, were affected by CrowdStrike's faulty update.¹⁷ The faulty update affected various entities around the world, including airlines, banks, retailers, and emergency service providers.¹⁸ On its website, CrowdStrike states that its software is used by 298 of the Fortune 500 companies, including food and beverages companies, automotive companies, manufacturers, health care providers, and firms providing financial services.¹⁹

How did CrowdStrike's faulty update affect airlines?²⁰

CrowdStrike's faulty update had a significant effect on some airlines. On July 19, 2024, and the following weekend, Delta Airlines, American Airlines, United Airlines, Allegiant Air, and Spirit Airlines grounded flights in the United States, which led to thousands of flight cancellations, extensive delays, and long waits at airports.²¹ While most airlines appeared to have recovered from the disruptions and restored operations after the weekend, issues at Delta persisted beyond the initial incident weekend.²² Delta reportedly has canceled more than 5,500 flights since the start of the Friday outage, including at least 700 flights on July 22, accounting for about two-thirds of all cancellations worldwide that day.²³

The Office of Aviation Consumer Protection in the U.S. Department of Transportation reportedly released a statement on Tuesday, July 23, 2024, that it was launching an investigation into Delta's widespread flight disruptions and concerning customer service failures.²⁴

How did CrowdStrike's faulty update affect banks?²⁵

Several banks reported being affected by CrowdStrike's faulty update, according to various media reports.²⁶ Some of the banks that experienced issues include TD Bank, Bank of America, JP Morgan Chase, Wells Fargo, Synovus Financial, Fifth Third Bank, Canandaigua National Bank, and American Express.²⁷

The types of problems reported differ across affected banks. They include temporary difficulties processing transactions, inability of customers to access accounts, and trouble among employees logging onto their workstations.

What role did the Cybersecurity and Infrastructure Security Agency (CISA) and relevant Sector Risk Management Agencies (SRMAs) play in consequence mitigation and recovery of critical infrastructure functions related to CrowdStrike's faulty update?²⁸

There are currently 16 federally designated critical infrastructure sectors, which cover wide areas of the national economy, governance, and essential services.²⁹ In each critical infrastructure sector, one or more federal agencies fulfils the role of SRMA.³⁰ These federal agencies coordinate risk management activities in their respective sectors and lead federal outreach to owners and operators of critical infrastructure systems and assets in these sectors. Infrastructure owners and operators within several sectors were affected by the outage. Table 1 lists critical infrastructure sectors that were affected by CrowdStrike's faulty update and corresponding SRMAs.

CISA created a web-based resource providing updates and links to information on the outage, referring users to CrowdStrike resources for affected entities.³¹