What is CrowdStrike and how did an IT update cause a global outage?

A presumed fault in a security update that rolled silently across the world caused chaos in computer systems from Australia to the US and Europe in a matter of hours

Cybersecurity firm CrowdStrike's software appears to be behind issues with the Windows operating system abruptly shutting computers down. Bloomberg

The first inklings that something had gone badly wrong started to emerge around 9.30am GST.

Computers in Asia were showing the infamous "blue screen of death", known in the IT world as BSOD. Companies from airlines to supermarkets to television broadcasters and beyond were being shut out of their networks due to a global IT outage.

The source of the problem and the cause of chaos that ensued - hitting flights, banks, shops and TV - seemed to be an issue with an update that was being rolled out by CrowdStrike, one of the world's largest cybersecurity companies.

"CrowdStrike is aware of reports of crashes on Windows hosts related to the Falcon Sensor," the company said in an alert, as it started to roll back its faulty update.

Passengers wait at Berlin Brandenburg Airport as a widespread Microsoft outage disrupted flights, banks, media outlets and companies around the world on Friday, July 19. AP

Screen shows an error at a currency exchange store at Hong Kong International Airport. Reuters

Passengers queue at check-in desks at London Gatwick Airport. @sellwithDean / PA Photo

Passengers wait at Barajas Airport in Madrid. Reuters

A United Airlines passenger waits at Los Angeles International Airport. AP Photo

Jetstar passengers at the Gold Coast Airport in Bilinga, Australia. EPA

A sign showing departure information at Schiphol Airport, Amsterdam. EPA

Hong Kong Express Airways passengers queue at Hong Kong International Airport. Reuters

Travellers wait at Hamburg Airport, Germany. AP

Passengers form long queues at Singapore Airport. AFP

Delayed flights are displayed on a screen at Barcelona Airport. Getty

Passengers crowd the International flights departure terminal of Rome's Fiumicino airport. AP

Display screens show error messages at the Indira Gandhi International Airport in New Delhi. AFP

Passengers line up for check-in at Don Mueang International Airport in Bangkok. AP

Long queues of passengers form at the check-in counters at Ninoy Aquino International Airport in Manila. Getty

Turkish Airlines planes are parked at Istanbul Airport. EPA

What does CrowdStrike do?

As a company, CrowdStrike helps companies manage their security online, by protecting them against hackers, stopping data breaches and ransomware attacks.

As such, its customers number in the thousands across the global and include some of the world's largest companies.

CrowdStrike's chief executive, George Kurtz, a former staff member at the software security maker McAfee, founded the company 12 years ago.

What is Falcon Sensor?

The company's main product is CrowdStrike Falcon, which it describes on its website as "providing real-time indicators of attack, hyper-accurate detection and automated protection".

It's believed that an update to its Falcon Sensor software is the cause of the IT outage as it effectively caused a fault with computers running Windows software, as users experienced the BSOD and were such out of their systems.

A blue error screen is displayed at a self-checkout terminal in a supermarket in Sydney, Australia. A large-scale disruption has wrought havoc on IT systems around the globe. AFP

Passengers queue at London Gatwick Airport. PA

A television screen in London displays a BBC announcement which reads "Sorry! Somethings gone wrong" as the CBBC channel is off air. Getty Images

Passengers wait in front of check-in counters at the capital's Berlin Brandenburg Airport, in Schönefeld, Germany. AP

The Paris Olympic Games press accreditation centre has been affected by global IT outage in France. Reuters

Passengers look at signs displaying departure information at Schiphol Airport, southwest of Amsterdam, in the Netherlands. EPA

A screen shows an error at a currency exchange store at Hong Kong International Airport in China. Reuters

Travellers sleep in a loading bridge at Los Angeles International Airport after a United Airlines flight was delayed due to the widespread global disruption. AP

A message displayed on the Sky News channel, which has been knocked off air online. PA

Passengers wait at Barajas Airport after a computer systems 'incident' was reported at all Spanish airports. Reuters

A sign notifies customers of a temporary closure at a shop due to IT issues in Canberra, Australia. EPA

A checkout terminal hit by IT issues at a store in Canberra, Australia. EPA

What was the impact?

Because the Falcon update was coming through Windows, the speed and scale of the impact was enormous. By Microsoft's own calculations there are about 1.4 billion Windows PCs worldwide, which are in use in different industries.

This means that the faulty update caused retailers' payment systems to crash, and airline computer systems to fail, which led to thousands of planes being grounded and global broadcasters to fall off air. In addition, train companies and airports were thrown into chaos and medical services were disrupted, while banks and stock exchanges had issues.

Essentially, every transaction, payment or booking made online using Windows software that received the Falcon update was potentially vulnerable.

Many people had to resort to paying cash, as retailers were unable to accept cards on Friday morning.

Share price plunges

CrowdStrike's share price plunged 15 per cent in pre-market trading in the US on the back of the global IT outage.

Essential CrowdStrike's shares are owned by institutional investors, who own 40 per cent of the stock and public companies and individual retail investors who own 57 per cent of the company.

The US investment fund, Vanguard Group is the largest single investor with a slice of the company that amounts to just less than 7 per cent.

What has CrowdStrike said?

Mr Kurtz said that the company was "actively working with customers impacted by a defect found in a single content update for Windows hosts.

"Mac and Linux hosts are not impacted. This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed."

As the world awaits for the fix to roll out, Kevin Reed, chief information security officer of Swiss-based cybersecurity firm Acronis, said the update "necessitates manual intervention to resolve, specifically rebooting systems in 'safe mode' and deleting the faulty driver file.

"This process is cumbersome and leaves systems vulnerable in the interim, potentially inviting opportunistic attacks."

Meanwhile, cyber security expert Dan Card, from BCS, The Chartered Institute for IT, said that "companies should make sure their IT teams are well supported as it could be a difficult and highly stressful weekend for them as they help customers".

"People often forget the people that are running around fixing things," he added.