(Reuters) — On Friday, services from airlines to healthcare, shipping, and finance began coming back online after a mistake in a security software update caused hours-long global computer system outages. This incident highlighted the vulnerability of the world’s interconnected technologies.
Companies faced backlogs of delayed and canceled flights, missed medical appointments, missed orders, and other issues that could take days to resolve. Businesses now face questions about preventing future blackouts triggered by technology meant to safeguard their systems.
A software update by global cybersecurity firm CrowdStrike triggered system problems that grounded flights, forced broadcasters off the air, and left customers without access to healthcare or banking services. Global shipper FedEx experienced major disruptions, and some moderators on Meta’s Facebook were affected.
CrowdStrike, a significant player in the cybersecurity industry with more than 20,000 subscribers, including Amazon and Microsoft, identified a defect in a single content update for Windows hosts that affected Microsoft customers. CrowdStrike CEO George Kurtz apologized on social media platform X for the impact caused.
CrowdStrike’s market share dominance has led some industry analysts to question whether control over such critical software should be concentrated in just a few companies. The outage also raised concerns about organizations’ preparedness to implement contingency plans for single points of failure in IT systems.
CrowdStrike shares closed down 11%, while competitors SentinelOne and Palo Alto Networks saw their shares rise. Microsoft shares closed down 0.7%.
Ann Johnson, head of Microsoft’s security and compliance business, stated that hundreds of engineers are working with CrowdStrike to restore customer systems. President Joe Biden was briefed on the outage, and the U.S. Cybersecurity and Infrastructure Security Agency reported observing hackers using the outage for phishing and other malicious activities.
U.S. Customs and Border Protection experienced processing delays, and the Dutch and UAE foreign ministries reported disruptions.
Gil Luria, a senior software analyst at D.A. Davidson, noted the event as a reminder of the complexity and vulnerability of global computing systems. He emphasized that CrowdStrike and Microsoft have significant work to ensure other systems and products do not cause similar failures in the future.
Wall Street’s main indexes fell on Friday, driven by the tech stock sell-off and mixed earnings. The Cboe Volatility Index hit its highest level since early May, and the dollar climbed as the cyber outage unnerved investors.
Air travel was severely impacted, with over 5,000 out of more than 110,000 scheduled commercial flights canceled globally, according to Cirium. Delta Air Lines was one of the hardest hit, with 20% of its flights canceled. Airports from Los Angeles to Singapore experienced delays as airlines resorted to handwritten boarding passes.
Banks and financial services companies warned customers of disruptions, and traders across markets reported problems executing transactions. Insurers may face numerous business interruption claims.
U.S. healthcare providers reported outages affecting call centers and patient portals, with Mass General Brigham in Boston treating only urgent cases and Tufts Medical Center warning of delays and potential rescheduling. In Britain, booking systems used by doctors were offline, and Sky News was taken off the air.
As the day progressed, more companies reported a return to normal service, including Spanish airport operator Aena, U.S. carriers United Airlines and American Airlines, and Australia’s Commonwealth Bank. U.S. Transportation Secretary Pete Buttigieg said system issues appeared to be resolving, with hopes for transportation to be back to normal by Saturday.
