Case B: The Day the Screens Went Blue

Resit Dossier: Digital Leadership (DL)

Author

Andy Weeger

Published

Sep 24, 2026

Modified

Sep 25, 2026

Overview

Leader George Kurtz, co-founder and CEO of CrowdStrike
Organization CrowdStrike, provider of the endpoint security platform Falcon
Period July 19, 2024 (aftermath until autumn 2024)
Situation type Crisis response after a self-inflicted global IT outage
NoteAssigned Theoretical Lens

Stakeholder Salience Theory

Background

CrowdStrike’s Falcon sensor runs with deep system privileges on millions of Windows computers of companies and public authorities worldwide. In addition to software updates, CrowdStrike delivers several “content updates” per day that inform the sensor about new attack patterns. Until July 2024, these content updates were distributed to all customers at the same time.

Kurtz was CTO of McAfee in 2010, when a faulty McAfee update also crashed a large number of Windows computers. Before the outage, CrowdStrike was one of the best-performing stocks of the year.

Timeline

Date Event
Jul 19, 04:09 UTC A faulty content update (Channel File 291) is deployed and causes Windows systems to crash. Microsoft estimates about 8.5 million affected devices. Airlines, hospitals, banks, broadcasters, and emergency services are disrupted. The faulty update is reverted after 79 minutes, but affected computers often have to be repaired manually.
Jul 19 Kurtz’s first post on X states that the issue has been “identified, isolated and a fix has been deployed”, without an apology. Hours later, he says on NBC’s Today show: “We’re deeply sorry for the impact that we’ve caused to customers, to travelers, to anyone affected by this, including our company.”
Jul 22 The House Committee on Homeland Security asks Kurtz to testify. CSO Shawn Henry writes on LinkedIn: “On Friday, we failed you […]. The confidence we built in drips over the years was lost in buckets.”
Jul 23/24 CrowdStrike sends $10 Uber Eats vouchers to partners as a thank-you; the gesture draws public ridicule. The Preliminary Post Incident Review is published. The share price has fallen by almost a third.
Jul 29 About 99% of affected sensors are back online.
Aug 6 CrowdStrike publishes a detailed Root Cause Analysis and announces staged rollouts (“concentric rings”) and more customer control over the timing of content updates.
Sep 24 Adam Meyers (SVP Counter Adversary Operations) testifies before Congress on behalf of CrowdStrike.
Oct 2024 Delta Air Lines sues CrowdStrike over losses of about $500 million; CrowdStrike countersues and holds Delta partly responsible for its long recovery time.

Key Actors

  • George Kurtz: CEO and public face of the crisis response.
  • Customers: companies and public authorities, some of them critical infrastructure; notably Delta Air Lines.
  • End users: travelers, patients, and others affected indirectly.
  • Microsoft: operating system provider, publicly associated with the outage.
  • Regulators and politicians: e.g., the House Committee on Homeland Security.
  • Investors, partners, employees, and the security community.

Contested Points

  • Assessments of the response range from “a rare, swift apology in the security industry” to “underwhelming” (e.g., because the company website remained upbeat for days).
  • Responsibility for consequential damages: CrowdStrike’s legal position toward Delta vs. its public apology.

Sources

This list is not exhaustive.