Delta Air Lines filed a lawsuit against cybersecurity giant CrowdStrike on Friday, seeking massive damages for a catastrophic technology outage that paralyzed the carrier’s operations this summer and resulted in losses exceeding $500 million.
The lawsuit, filed in Fulton County Superior Court near Delta‘s Atlanta headquarters, stems from a July incident when a faulty CrowdStrike software update triggered widespread system failures, including the infamous “blue screen of death” on Windows computers worldwide, according to the Associated Press.
Delta’s suit states the cybersecurity firm’s negligence in rolling out an untested Microsoft computer update led to the cancellation of approximately 7,000 flights over five days during the peak summer travel season. The airline is pursuing both compensatory and punitive damages, asserting that the company’s actions caused widespread disruption during one of the busiest travel periods of the year.
The July incident’s impact extended far beyond aviation, affecting emergency services across six states, including Alaska, Arizona, Indiana, Minnesota, New Hampshire, and Ohio.
The outage also disrupted major financial institutions, with the London Stock Exchange reporting its Regulatory News Service experienced “third party global technical issues.” Several Australian banks also reported operational problems. Media organizations felt the impact as well, with the UK’s Sky News and BBC channels temporarily forced off the air.
CrowdStrike’s CEO George Kurtz confirmed the outage resulted from “a defect found in a single content update for Windows hosts” rather than a security breach or cyberattack.
Microsoft acknowledged the issue on its platform, stating that the “affected update has been pulled by CrowdStrike” and directing affected customers to seek additional assistance from the cybersecurity firm.
In response to the lawsuit, a CrowdStrike spokesperson told Newsweek: “While we aimed to reach a business resolution that puts customers first, Delta has chosen a different path. Delta’s claims are based on disproven misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its slow recovery away from its failure to modernize its antiquated IT infrastructure.”
Travelers wait in line on the check-in floor of the Delta Air Lines terminal at Los Angeles International Airport (LAX) on July 23, 2024 in Los Angeles, California. Delta Air Lines is still reeling in the aftermath of the CrowdStrike outage with 24 flights cancelled and 27 flights delayed at LAX today and 434 cancelled Delta flights nationwide today. (Photo by Mario Tama/Getty Images)
Newsweek contacted Delta Airlines via email on Saturday for comment.
CrowdStrike’s stock plummeted more than 20 percent in early trading following the July outage, dropping from $343.05 to $273 before slightly recovering to $301.97 per share. Microsoft shares also suffered, falling more than three percent to $426 before stabilizing at $434.80 during the busy summer travel season.
Previous attempts to resolve the dispute have failed. The cybersecurity company’s legal team had suggested in August that the company’s liability to Delta should not exceed $10 million – a figure that stands in stark contrast to the airline’s stated losses of over $500 million in lost revenue and additional expenses.
The U.S. Department of Transportation (DOT) has launched an investigation into Delta’s notably slower recovery compared to other affected organizations.
Transportation Secretary Pete Buttigieg announced the probe would encompass customer service complaints, including reports of stranded unaccompanied minors and excessive wait times for assistance during the crisis.
