CrowdStrike Disruption Frontline

“CrowdStrike is the Ferrari of enterprise cyber detection and response, so the ones that are affected are the ones with deep pockets. This was a blip in Southeast Asia, but developed countries like Australia and New Zealand were hit really hard,” Pal said. “We were hit first while the U.S. was asleep.”

loading

CrowdStrike released its first post-incident report on the outage on Thursday. The report said the incident was caused by a vulnerability in an update for CrowdStrike Falcon, a piece of the company’s software that runs in the background of computers to monitor for cyber threats. CrowdStrike Falcon runs at the kernel level of Windows systems, which means it has more permissions than most other programs.

But reports later said the update was “buggy” and caused memory issues, triggering Windows’ infamous “blue screen of death.” Mac and Linux hosts were not affected. CrowdStrike has a “content validator” that reviews software updates before they are released, but due to a bug, the program missed the update’s erroneous content.

Pal said saving a customer’s machine was simply a matter of entering safe mode, restarting the machine, deleting the offending file, and restarting it again.

“It took quite a bit of effort because there are some machines you can do remotely, but there are some you have to do in person,” he said. “Microsoft also has a security feature called BitLocker that encrypts your hard drive. That also had to be disabled before we could do anything.”

A week after the incident, the impact is still ongoing — some organizations may take months to fully recover — and hackers have already begun taking advantage of the opportunity to target CrowdStrike customers.

US Republicans who lead the House Homeland Security Committee said this week they want answers and have subpoenaed CrowdStrike CEO George Kurtz to testify before Congress.

“While we appreciate CrowdStrike’s response and coordination with stakeholders, we cannot discount the magnitude of this incident, which some are claiming is the largest IT outage in history,” Mark E. Green of Tennessee and Andrew Garbarino of New York said in a letter to Kurtz.

They added that Americans “are entitled to detailed information about how this incident occurred and the mitigation steps CrowdStrike is taking.”

Australians are demanding answers, too.

Melbourne-born Mike Sentonas was at the center of Friday’s chaos. He is CrowdStrike’s global president and has risen through the ranks over the past decade to become one of Australia’s highest-ranking global technology executives. Sentonas is now based in Las Vegas and is worth an estimated $225 million.

CrowdStrike has refused to make Sentonas available for an interview since the outage last Friday, despite repeated requests and detailed written questions from the newspaper. On Wednesday, he spoke to Sky News and apologized to viewers.

“We are deeply sorry. I personally apologize for what happened,” he said on the show.

“We understand that we have caused a lot of distress and pain to a lot of people. First, I think it’s important to note that we release updates regularly and we have been doing so for more than a decade. But we got it wrong in this case.

“We identified the issue very quickly. We stopped the file from spreading, but unfortunately a lot of people around the world accessed it… The consequence people experienced was a blue screen of death.”

loading

CrowdStrike gave $10 Uber Eats gift cards to team members and partners who worked overtime on the weekends. Uber flagged the gift cards as fraudulent because they were used so frequently.

“To show our appreciation, your next cup of coffee or midnight snack is on us!” Daniel Bernard, CrowdStrike’s chief business officer, wrote in an email, as seen on the masthead.

However, Uber Eats gift cards won’t be enough for affected businesses. Early estimates put the cost of the blackout at more than $1 billion in Australia alone, raising questions about who will foot the bill.

James North is head of technology at independent law firm Corrs Chambers Westgarth, which has been in talks with affected businesses over the past week.

According to North, businesses across the country are now weighing whether they can recoup the financial losses caused by the outage, including the need to add IT staff and the inability to trade.

Whether a company’s cyber policy or business interruption policy applies remains an open question, he said.

To be more specific, CrowdStrike will only refund customers for subscription fees. Its standard contract means the company won’t have to pay for damages caused by the outage.

“Liability for lost revenue and other consequential losses is not covered by CrowdStrike’s standard contract,” North said. “And Australian customers also cannot turn to local courts when considering legal remedies because they must consent to New York governing law and Singapore arbitration as set out in CrowdStrike’s standard contract.

“Some customers may have a better agreement with CrowdStrike than the standard liability arrangements. For others, the Australian Consumer Law may provide the best approach.”

Mr North said Australian businesses could obtain statutory guarantees in certain circumstances, particularly when the value of goods or services purchased was $100,000 or less.

“In Australia, any service is guaranteed to be provided with due care and skill. If an IT vendor introduces a coding error in a software update, or fails to properly test the update before deploying it to a customer’s IT system, some may argue that this guarantee has been breached,” he said.

“Businesses can also recover ‘reasonably foreseeable losses’ if a supplier ‘materially breaches’ a statutory warranty. In some cases this may include trading and other financial losses.”

loading

He said class actions could be extremely difficult because of arbitration clauses embedded in customer contracts.

For Pal, software companies are unlikely to change their standard contracts in the future because an outage like this could put them out of business. He said the incident highlights the importance of having adequate insurance.

Pal noted that Australian regulators, including APRA, may soon weigh in once the dust settles, and mentioned CPS 230. This is a new standard that will come into effect in July 2025 and focuses on business resilience, including third-party risk management and business continuity, both of which were severely impacted by the CrowdStrike outage.

“Now looking ahead to the next six to 12 months, I expect these two areas will receive a lot of attention as regulators take action to ensure that when something like this happens, whether it’s malicious or otherwise, it doesn’t bring the world down,” he said.

“I will be frank in saying this clearly demonstrates a complete failure of the organization in terms of IT disaster recovery and business continuity planning.

“It’s not an ordinary event, but it’s something you have to be prepared for regardless. Because if you’re prepared for something like this, then everything else becomes easier.”

The Market Review newsletter is a summary of the day’s trading. Get it every weekday afternoon.