CrowdStrike Update Causes Global IT Outage: Legal Implications and Recourse Options

A recent software update from CrowdStrike, a Texas-based company specializing in endpoint detection security software, has caused widespread disruption, affecting 8.5 million devices globally. The faulty update led to the infamous “blue screen of death” on a Windows-based supermarket self-service kiosk, highlighting the potential cascading impact of routine software updates.

Investigations into possible federal securities laws violations by CrowdStrike have been announced, raising questions about the company’s testing and deployment processes. Russell McVeagh, a law firm, emphasized the importance of thorough testing in simulated environments before rolling out updates to live customer environments to prevent such widespread disruptions.

The event has prompted discussions about the interconnectedness of global IT systems and the need for robust contingency and continuity plans in the face of IT outages. Affected organizations are now considering their options for recourse, with insurance potentially providing a pathway for some, but not all, affected parties.

Regulators and legislators are also taking note of the incident, with potential regulatory investigations and considerations for additional legislation to mitigate against future crises of this nature. In the UK, a new cyber security and resilience bill has been announced to improve infrastructure resilience and avoid similar issues.

The CrowdStrike update serves as a wake-up call for organizations to prioritize cyber governance and incident response preparedness, not only for their own systems but also for their supply chain. The incident is expected to refocus board and C-Suite attention on cybersecurity measures to prevent similar disruptions in the future.