CrowdStrike Holdings, Inc.

Overview

CrowdStrike is an American cybersecurity company whose Falcon platform — endpoint detection and response software installed on millions of corporate computers — became the instrument of a global outage that crashed about 8.5 million Windows devices worldwide. grounding flights, freezing hospitals and banks, and forcing manual, machine-by-machine recovery (TechTarget). The aftermath brought a shareholder class action, a $500-million-claim lawsuit from Delta Air Lines, and a congressional hearing that put the industry’s kernel-level security architecture itself on trial (Reuters; Associated Press; U.S. House Committee on Homeland Security).

The company before the crash

CrowdStrike began in September 2011, co-founded by George Kurtz as CEO and Dmitri Alperovitch as CTO; Alperovitch designed the architecture of the Falcon platform along with its AI-based malware engine and endpoint detection and response (EDR) offering (CRN). Alperovitch left in 2020 to launch a cybersecurity-policy nonprofit (CRN). The company began public trading on the Nasdaq in June 2019 (CRN), and is based in Austin, Texas (Reuters).

19 July 2024: a 78-minute window

At 04:09 UTC on 19 July 2024, CrowdStrike published a faulty channel-file update — Channel File 291 — for its Falcon Windows sensor; the defect was reverted at 05:27 UTC, a 78-minute window (TechTarget). Machines that had already loaded the file entered crash-and-reboot loops with the blue screen of death, and because the file reloaded on every boot, each affected device required manual remediation — Safe Mode, file deletion, reboot (TechTarget). Microsoft estimated about 8.5 million Windows devices were affected — under 1% of all Windows devices, but concentrated in airlines, hospitals, banks, and emergency services (TechTarget).

CrowdStrike’s own root cause analysis, published 6 August 2024, traced the crash to a confluence of three issues: a mismatch between the 21 inputs validated by its Content Validator and the 20 inputs provided to the Content Interpreter, a latent out-of-bounds memory-read issue in the interpreter, and the absence of a specific test for non-wildcard matching in the 21st field (TechTarget). The deeper process failure: the bad file was “Rapid Response Content” — template instances for behavioral pattern-matching — which did not undergo the staged, dogfooded rollout reserved for “Sensor Content.” The company promised staggered deployment starting with canary releases, more validation checks, and greater customer control over updates (TechTarget).

The fallout: courts, Congress, and the kernel question

Shareholders sued first. On 30 July 2024 a proposed class action was filed in federal court in Austin, Texas — Plymouth County Retirement Association v. CrowdStrike Inc et al (W.D. Texas No. 24-00857) — alleging the company concealed how inadequate software testing could cause the outage; Reuters reported the shares fell 32% over the next 12 days, wiping out $25 billion of market value, from $343.05 the day before the outage to $231.96 (Reuters). Kurtz and CFO Burt Podbere were named as defendants; the company said the case lacked merit (Reuters).

Delta Air Lines sued on 25 October 2024 in Fulton County Superior Court, Georgia, alleging CrowdStrike “cut corners, took shortcuts, and circumvented the very testing and certification processes it advertised,” seeking compensation and punitive damages for more than $500 million in losses after cancelling about 7,000 flights over five days (Associated Press). CrowdStrike called Delta’s claims “misinformation,” said its liability was under $10 million, and blamed the airline’s “antiquated IT infrastructure” — while the U.S. Department of Transportation separately investigated why Delta recovered more slowly than other carriers (Associated Press).

Congress came calling too. The U.S. House of Representatives Homeland Security Committee had initially asked CEO George Kurtz to testify on 22 July; the company sent Senior Vice President Adam Meyers instead, and he appeared before the cybersecurity subcommittee on 24 September (U.S. House Committee on Homeland Security). Meyers testified that the company ships 10 to 12 content updates daily and that the faulty file had gone “to all customers in one session” — a model since revised — and confirmed federal agencies including the FCC, Social Security, Customs and Border Protection, and even CISA were affected (U.S. House Committee on Homeland Security). Pressed on whether Falcon must run inside the operating-system kernel rather than user space, Meyers defended kernel access as “the industry standard” for visibility, enforcement, and anti-tamper (U.S. House Committee on Homeland Security). CISA Director Jen Easterly had earlier called the incident a “dress rehearsal for what China may want to do” (U.S. House Committee on Homeland Security).

The Kurtz–McAfee parallel

Within hours of the outage, industry analyst Anshel Sag’s viral post noted an uncomfortable résumé line: Kurtz had been McAfee’s chief technology officer in 2010, when a faulty McAfee antivirus-definition update crashed Windows XP machines around the world (BusinessToday). Kurtz apologised publicly for the CrowdStrike outage, and Forbes tracked his net worth falling from $3.2 billion to $2.9 billion as the stock dropped 11% (BusinessToday). The parallel is a reported observation about two update pipelines failing the same way fourteen years apart — not evidence of a single cause.

What this profile does not claim

• It does not report outcomes for the Delta lawsuit or the shareholder class action; no resolutions were verified from fully-read sources.
• It does not verify whether CrowdStrike fully implemented its promised canary/staggered deployment model.
• The technical root cause is CrowdStrike’s own account as reported by specialist press; independent reproduction of the 21-vs-20 mismatch was not examined.
• The 8.5-million-device figure is Microsoft’s estimate; it measures devices, not organisations or people affected.
• The McAfee 2010 parallel is included as a reported observation with attribution, not as proof of a pattern.