2024 CrowdStrike incident facts for kids
Quick facts for kids 
Screenshot of a blue screen of death as captured on a Windows Server 2016 machine with the faulty CrowdStrike driver installed
|
|
| Date | 19 July 2024 |
|---|---|
| Location | Global |
| Type | Outage |
| Cause | Computer crash caused by a faulty CrowdStrike driver update |
On Friday, 19 July 2024, computer systems around the world experienced an outage that has led to ongoing disruptions across multiple different industries, relating to a faulty CrowdStrike security software update for Microsoft Windows systems.
Contents
Technical details
An update to CrowdStrike's Falcon Sensor security software at 04:09 (UTC) included the faulty kernel driver csagent.sys causing Windows machines a blue screen of death with the message PAGE_FAULT_IN_NONPAGED_AREA. This left machines in bootloops or recovery mode.
Affected machines were restored by booting into safe mode and deleting the %windir%\System32\drivers\CrowdStrike\C-00000291*.sys files. This process, while trivial to complete, requires manual application on each computer affected, which could take days to be completed for larger organizations.
CrowdStrike reverted the content update at 05:27 (UTC). Devices booted after the update was reverted are expected to not be affected. As of 09:45 (UTC), the CEO confirmed the fix was deployed.
Impact
Outages were experienced worldwide. As many IT systems across the world use Windows and the CrowdStrike software, outages were reported across many business sectors. More than 1,000 flights were cancelled globally, the travel sector in general being the most affected. The company Crowdstrike whose update has caused the problems has approximately 24,000 customers, and so the number of individual computers affected is hard to estimate as many of the 24,000 customers are large organisations.
Air transport
Hong Kong International Airport experienced delays during check-in. The Hong Kong Airport Authority activated the emergency response, after airline websites and automatic check-in malfunctioned. Local Airlines Cathay Pacific, Hong Kong Express and Hong Kong Airlines's booking systems are unavailable.
A ground stop was issued by United, Delta and American Airlines. Flights in the air will continue flying, but no new flights will take off. Allegiant Airlines were also grounded by the outage according to the FAA.
Swiss International Air Lines had 30% of flights grounded. Czechia's Prague Airport and Budapest Airport experienced issues. Ryanair reported that booking and check-in were unavailable, and its flights from Slovakia's Bratislava Airport were affected. Planes were not allowed to land at Zurich Airport. Wizz Air blamed the incident for its online services going offline. Dutch airline KLM suspended most operations, announcing that flight handling is impossible with the issue. The Berlin Airport planned to stop flights until 8 (UTC). Lufthansa has also been affected. In Brussels, Charleroi Airport's employees manually checked passengers in, but other software alleviated issues by 10:00 and there were minimal delays. Spanish airports were disrupted.
Spring Japan is experiencing issues. Korean airline Jeju Air is experiencing issues. Some of Singapore's Changi Airport's self-check-in machines were affected, delaying and forcing airlines switch to manual check in. Cebu Pacific and Philippines AirAsia flights are delayed. Long queues formed at the Ninoy Aquino International Airport.
Africa
Banks in South Africa, including Capitec Bank, were experiencing issues.
Asia
China
Some companies excused employees early as a result of the disruption. The topic "Thank you Microsoft for an early vacation" momentarily became Weibo's most popular term.
Many users have reported encountering blue screens of death on Windows PC, and some companies have let their employees go home early.
India
Outages are being experienced with Air India, Indigo Airlines, Akasa Air, SpiceJet and Vistara. Handwritten boarding passes are being issued during the outage.
Major IT firms in India such as TCS, Infosys, Oracle, Nokia and many others also face the outage, resulting in thousands of issues raised by employees and devices being stuck in bootloop and unable to recover.
Israel
In Israel, Magen David Adom and its emergency service line, as well as several public hospitals such as Sheba, Laniado, and Rambam were affected. Other affected organizations include Israel Post and several local banks. Many pharmaceutical companies are also impacted.
Philippines
IT workers in the Philippines who are using Windows laptops are experiencing the Blue Screen of Death. Major banks, telecommunications, radio and TV broadcasts, and supermarkets are affected due to crashed POS systems.
Banks in the Philippines such us RCBC, Metrobank, LandBank, BDO, UnionBank, BPI, and PNB online systems was down due to the outage. E-wallets such us Maya, and GCash were reported also experiencing issues.
Government websites in the Philippines, such as the website of the House of Representatives of the Philippines, were down due to the outage.
Other
Malaysia's railway operator KTMB confirmed that its KITS ticketing system is experiencing technical issues.
Numerous Singaporean companies, including Singapore Airlines, Scoot, Singapore Post, Singapore Exchange (SGX), SPH Media, Singtel, M1, Grab and DBS Bank, reported various levels of service difficulties throughout the day on 19 July.
Carpark entrance and exit gantries in Singapore were affected across 185 locations managed by the Housing and Development Board (HDB).
Europe
Belgium
In Belgium, the issue affected the purchase of train tickets and digital announcements in the National Railway Company of Belgium stations, the office laptops of DPG Media Belgium – which impacts JOE and QMusic Radio, banks, post services, government agencies, telephone communication with the urban services in Antwerp.
A spokesperson for the National Railway Company of Belgium said there is no impact to actual train traffic, but to all digital applications. They previously advise passengers to listen to the audio announcements in the various train stations, and if you are unable to buy a ticket to contact the train conductor.
The Centre for Cybersecurity Belgium stated that the impact in Belgium is limited.
FPS Public Health have confirmed that there were two hospitals impacted and have activated their emergency IT plans. They have also stated there is no impact to care, only to new patient admissions.
The National Crisis Center were evaluating the impact in Belgium and stated there had no reports of significant problems in the security sectors and our critical infrastructure (e.g. power plants or transport sector). They also were informed of the issue impacting two hospitals in Belgium.
France
Several French TV channels affected by the issues include TF1, TFX, LCI and Canal+ Group networks. Phone and internet service provider Bouygues Telecom has also announced the unavailability of its customer service as a result of the outage. Charles de Gaulle Airport and Orly Airport both also experienced problems related to check in and suspension of flights.
The operations of the 2024 Summer Olympics, which is scheduled to officially begin in a week in Paris, France, have also been affected. The incident happened a day after the Olympic Village opened, and organizers were processing the arrivals of athletes and delegates. The organizing committee said that a contingency plan was activated, and that only the delivery of uniforms and accreditations were impacted. The incident, however, is slowing down the operations with the accreditation desk at the press center closed, and security checks done manually using a list of names.
Germany
Two hospitals in Lübeck and Kiel have cancelled non-emergency operations. Supermarket chain Tegut has closed some of its stores.
Ireland
The Irish Times reported that several Irish businesses were impacted, including Ryanair. Transport for Ireland said its apps were down due to the outage. GAA clubs reported that they were unable to acess All Ireland tickets.
Isle of Man
Manx Radio reported that GP surgeries were impacted and that a number of flights to the island could be affected, particularly to and from the United Kingdom. Businesses were reported to be "mostly unaffected".
Netherlands
Businesses operating in the Netherlands experiencing issues include Schiphol airport, KNAB bank, Transavia Airlines, Keolis Nederland, government services and hospitals are starting to cancel operations and scale down medical care.
Norway
One of the largest pharmacy chains in Norway, Apotek1, had to shut down their stores for some time.
Spain
ENAIRE's Aena, the national airport traffic control manager, has also made reference to an IT outage in their website and social media. All Spanish airports reported disruptions and the regional governments of Aragon, Basque Country, Castilla-La Mancha, Catalonia and Galicia reported issues with their healthcare services.
Turkey
Turkish Airlines cancelled some of its flights to avoid disruptions in flights. The website and mobile banking application of DenizBank, cannot be accessed.
United Kingdom
24 hour news channel Sky News was unable to broadcast live, as well as the BBC's CBBC, a free-to-air children's television channel. Several airports experienced difficulties, including Edinburgh, whose departure boards froze, and Gatwick Airport, where automatic barcode scanning stopped working and had to be checked manually. Rail companies were also affected. The National Health Service (NHS) said that the issues are "causing disruption in the majority of [English] GP practices", with some of its services, such as GP surgeries, which rely on a software product called EMIS Web, unable to view and manage medical records, issue and manage prescriptions, or make appointments. The London Stock Exchange, while operating normally, was unable to push news updates to its website.
Gambling company Ladbrokes Coral and supermarket chain Morrisons also reported problems. Amadeus, which manages baggage at Heathrow, says they were affected by the IT outage.
News sources in the UK have reported that the government's COBR committee has met to discuss the incident.
Other
The Central Health Information System of Croatia in Croatia was affected, although it was clarified that it was a separate issue tied with moving their servers to a new location as well as the Croatian Air Traffic Control. Professor Doctor Fernando Fonseca Hospital in Portugal has registered problems. The National Security Authority spokesman confirmed several institutions in Slovakia were affected. The pharmaceutical company Krka in Slovenia is said to have suffered a full outage of production and sent its workforce home. In Sweden, Air traffic was disrupted, tickets for soccer games and public transport could not be sold and the Malmberget mine was evacuated as a precaution. Vodafone, Nova Poshta, and Sense Bank in Ukraine experienced outages due to the update.
North America
Canada
Montreal-Trudeau International Airport and Toronto Pearson International Airport were affected. Vancouver International Airport was also reportedly affected, although it was unclear whether this was directly related to the global outages. The Canadian Broadcasting Corporation was also impacted.
United States
There are outages in 911 service or disruptions in 911 call centers' operation in some parts of Alaska, Arizona, Florida, Indiana, Kansas, Michigan, Minnesota, New York, Ohio, and Pennsylvania. 911 was down for all of New Hampshire. In addition, Alaska is experiencing issues with non-emergency call centres.
Shares have dropped in both Microsoft and CrowdStrike as a result of the outage. CrowdStrike's stock fell nearly 12 percent in premarket trading early Friday.
Oceania
Australia
Australian businesses and government agencies were impacted by the outages, including media companies, airlines, airports, supermarkets, hospitals, universities, law firms, pharmacies, casinos, train networks, petrol stations, stadiums and banks. Australian media firms affected by the issues include ABC, SBS, Seven Network and Nine Network.
Airlines affected include Qantas, Virgin Australia and Jetstar. A Sydney Airport spokesperson said that the outage had impacted some airline operations and that the airport may experience some delays throughout the evening. In its news bulletin, Nine Network reported that the Sydney Airport curfew meant that there wouldn't be enough time to clear the backlog before 11 pm and it may take several days to clear the backlog. Melbourne Airport has also been affected, with website statements underlining the "global technology issue" as impacting check-in procedures, and advising passengers to consult with relative airlines. Canberra Airport, Darwin Airport, Adelaide Airport, Perth Airport, Hobart Airport, Launceston Airport and Brisbane Airport were also affected.
Retailers and fast food chains are also hit by the outage, causing self-checkout and online order systems out of service. Supermarkets resorted to placing upside down shopping baskets on self-checkouts. Fuel stations have also been affected, with people stuck at fuel pumps unable to pay for petrol because payment systems aren't working.
Supermarkets affected include Woolworths and Coles. Banking apps were down which affected banks such as NAB, Westpac, ANZ, Commonwealth Bank, Bendigo Bank and Suncorp. Freight train operator Aurizon was affected. Regional trains in NSW on the Hunter Line and the Southern Highlands Line were cancelled or delayed with the Regional Bus and Train network in Victoria operated by V/Line having all lines suspended. Systems in some Ramsay Health Care and Uniting Care hospitals were affected, including Wesley Hospital and St Andrews Hospital in Brisbane. Sunshine Coast Council was one of several councils affected. Ticketing at Docklands Stadium was affected.
Victorians were advised to call 000 if a fire alarm sounds or smoke is detected, as some automatic alarms in buildings may not automatically call fire services due to the outage.
The Australian government held a national emergency meeting to address the outage. It was declared that the National Coordination Mechanism had been activated, with Prime Minister Anthony Albanese saying "I understand Australians are concerned about the outage that is unfolding globally and affecting a wide range of services. My Government is working closely with the National Cyber Security Coordinator". He later said "There is no impact to critical infrastructure, government services or Triple-0 services at this stage. The National Coordination Mechanism was activated and is meeting now".
New Zealand
Businesses operating in New Zealand experiencing issues include ANZ, ASB, Kiwibank and Westpac banks, Woolworths, and Auckland Transport's HOP card. Christchurch Airport is also having problems, as well as Parliament. Customers have also experienced payment issues at Foodstuffs supermarkets.
See also
In Spanish: Incidente de CrowdStrike de 2024 para niños
