CrowdStrike's outage: who pays?

A faulty software update from cybersecurity firm CrowdStrike crashed an estimated 8.5 million Microsoft Windows systems around the world on 19 July, grounding airlines and disrupting hospitals and banks. The damage runs into billions of dollars, and the fight over who pays for it has only just started.

The fault was mundane. CrowdStrike pushed a routine content update to Falcon, the security software that runs deep inside the Windows operating system on its customers' machines, and the update caused those machines to crash and then fail to restart. The company quickly confirmed that it was not a cyberattack and issued a fix, but many affected computers had to be repaired by hand, one at a time, which is why the disruption dragged on long after the cause was known. Apple and Linux machines were unaffected.

Capped by contract

Customers suffered heavy losses, but CrowdStrike's standard enterprise licences cap its direct legal liability at a multiple of the subscription fees paid. That pushes most of the cost onto the customers themselves and their insurers. The outage also showed how exposed critical infrastructure is when so much of it depends on a few dominant software suppliers.

Such caps are standard across enterprise software, and they exist for a reason. A vendor charging a hospital or airline a modest annual fee cannot underwrite the full value of everything that customer does with its computers. Courts generally enforce these terms between sophisticated commercial parties, and they usually exclude lost profits and other indirect damages altogether. A customer that has lost a day of revenue can reclaim, at most, a sum linked to what it paid for the software, which for most will be a small fraction of the harm.

Where the losses land

The first loss sits with the companies whose systems went down. Airlines cancelled thousands of flights and will face refund and compensation claims from passengers, on top of the cost of stranded crews and aircraft. Hospitals postponed procedures. Banks and payment processors lost transaction volume, and broadcasters briefly went off air. Much of that will simply be absorbed as an operating loss.

The second layer is insurance, and here the outcome is less predictable. Cyber policies were written mainly with hackers in mind, and not all of them cover business interruption caused by a non-malicious failure at a supplier. Some policies do include such system-failure cover, often with waiting periods of several hours before payments start, which an outage lasting a day or more would easily exceed. Insurers will read their wording closely, and disputes are likely wherever it is ambiguous.

The NotPetya attack of 2017 offers a guide to how those arguments go. Mondelez spent years in court with Zurich over whether a war exclusion applied to its losses, and Merck fought its insurers over the same question before settling. That episode was malicious and this one was not, but it showed that large claims tend to end in litigation rather than prompt payment.

A familiar kind of failure

Faulty updates are not new. In 2010 a McAfee antivirus update misidentified a core Windows XP file as malicious and knocked many corporate computers offline. In 2021 a configuration error at Fastly, a content-delivery network, took down major websites for about an hour. What distinguishes this week's outage is scale, which follows from the market's concentration: CrowdStrike is among the leaders in protecting corporate endpoints, and its software sits on machines that run check-in desks, trading floors and hospital wards.

That concentration is the uncomfortable lesson for regulators. Security software needs deep access to an operating system to do its job, which means a mistake by the security vendor can do the same damage as an attack. The European Union's Digital Operational Resilience Act, which takes effect for financial firms next January, already requires them to manage the risks of their technology suppliers, and supervisors elsewhere will be tempted to follow.

The case against the caps holding

There are circumstances in which the caps could give way. Many contracts carve out gross negligence or wilful misconduct, and plaintiffs will argue that shipping an update simultaneously to millions of machines without staged testing meets that bar. CrowdStrike will reply that it followed its normal process and that the failure was an error, not recklessness. The company's shareholders face their own risk, since a sharp share-price fall on the day invites securities suits alleging that its testing practices were overstated.

Even if the caps hold in court, commercial pressure may not respect them. Large customers can demand credits, discounts or free services as the price of staying, and CrowdStrike will want to keep them. Rivals such as Microsoft's own Defender, SentinelOne and Palo Alto Networks will use the episode in every sales pitch for the next year.

What to watch

The signals will come from CrowdStrike's explanation of how the update escaped testing, from any congressional hearings, and from its next quarterly report, where customer retention and renewal pricing will show whether the damage is lasting. Insurers' first estimates of claims will indicate how much of the bill they intend to accept.

CrowdStrike's customers will carry most of the cost of the outage, with insurers taking a share. The liability caps will probably hold, and the lasting consequence may be tougher bargaining when those licences come up for renewal. Over the next year, expect CrowdStrike to pay in discounts and slower growth rather than damages, and expect large buyers of critical software to insist on staged roll-outs and higher caps as a condition of signing.