CrowdStrike is being sued by shareholders over a huge software outage

CrowdStrike, a leading cybersecurity firm, is embroiled in a legal battle after a significant software outage led to a class-action lawsuit filed by its shareholders. The outage, which occurred on July 19, 2024, was caused by a problematic update to CrowdStrike's Falcon security software, rendering millions of PCs and servers inoperable. This incident has not only impacted the company's reputation but also led to a substantial drop in its stock price.

On July 19, 2024, CrowdStrike's Falcon security software experienced a catastrophic failure due to a defective update. This update caused widespread crashes on Windows hosts, leading to significant disruptions across various sectors, including banking, healthcare, and aviation. The company quickly identified the issue and rolled back the problematic update, but the damage had already been done.

Shareholder Lawsuit

The Plymouth County Retirement Association, representing shareholders who held CrowdStrike stock from November 29, 2023, to July 29, 2024, has filed a securities class-action lawsuit against the company. The lawsuit alleges that CrowdStrike misled investors about the reliability and effectiveness of its Falcon platform. According to the complaint, "CrowdStrike consistently promoted the effectiveness of the Falcon platform while reassuring investors that the company technology was validated".

Impact on Stock Price

Before the outage, CrowdStrike's shares were trading between $390 and $350. However, the stock plummeted to approximately $232 following the incident. The lawsuit claims that the company's stock traded at artificially inflated values due to materially false and misleading statements . This significant drop in stock value has prompted shareholders to seek restitution for their losses.

Reputational Damage

The outage has caused substantial reputational damage to CrowdStrike. The company's failure to properly test the Falcon update before its release has led to questions about its quality control measures. The lawsuit criticizes CrowdStrike for not revealing the "inadequate controls" it employed to evaluate software updates prior to their release . This has resulted in significant legal exposure for the company.

Response from CrowdStrike

In response to the lawsuit, CrowdStrike stated, "We believe this case is without merit and we will vigorously defend the company". The company has emphasized that it had previously informed about the risks associated with improper deployment configuration and service interruptions. Despite this, the lawsuit highlights that the company's reassurances were misleading.

Broader Implications

The fallout from the outage extends beyond the shareholder lawsuit. Delta Air Lines has also engaged legal counsel to seek damages from CrowdStrike due to the outage, which led to the postponement and cancellation of thousands of flights . This indicates that CrowdStrike may face further legal challenges in the future.

Technical Details of the Outage

CrowdStrike has provided detailed guidance on how to remediate the issue caused by the faulty update. The company identified the problematic channel file and provided steps for customers to delete it and restore normal operations. This issue primarily affected Windows hosts, while Mac and Linux hosts remained unaffected.

Industry Reaction

The cybersecurity industry has closely monitored the developments surrounding CrowdStrike's outage. Experts have pointed out that this incident underscores the importance of rigorous software testing and quality control measures. The outage has also led to discussions about potential changes in how cybersecurity and antivirus software are integrated within operating systems like Windows.

Future Outlook

CrowdStrike's ability to recover from this incident will depend on its handling of the legal challenges and its efforts to restore customer trust. The company has stated that it has successfully restored over 99% of the computers affected by the outage . However, the long-term impact on its reputation and stock price remains to be seen.

According to Michael Kan from PCMag, "The lawsuit criticizes CrowdStrike for not revealing the 'inadequate controls' it employed to evaluate the software updates prior to their release to customers". This sentiment is echoed by other industry experts who have highlighted the need for better quality control in software updates.

CrowdStrike's recent software outage has led to significant legal and reputational challenges for the company. The shareholder lawsuit and potential further legal actions underscore the importance of transparency and rigorous testing in the cybersecurity industry. As CrowdStrike navigates these challenges, its ability to restore customer trust and stabilize its stock price will be crucial for its future success.