The Uptime report

Research report · Incident anatomy · Updated October 2026

CrowdStrike Outage Anatomy: a 78-Minute Bad Update, 11 Days to 99%, and What SEC Filers Said It Cost

The CrowdStrike outage began at 04:09 UTC on July 19, 2024, when a faulty Channel File 291 update crashed an estimated 8.5 million Windows devices. CrowdStrike reverted it 78 minutes later, but recovery took far longer: about 99% of Windows sensors were back online by July 29, and Delta alone reported a $380 million revenue impact plus $170 million in extra costs.

78 minthe faulty file was live, 04:09 to 05:27 UTCCrowdStrike PIR
8.5MWindows devices affected, under 1% of all Windows machinesMicrosoft, July 20, 2024
10.8 daysfrom release to ~99% of Windows sensors back onlineCrowdStrike hub and RCA
5,737Delta mainline flights cancelled July 19 to 23, 38% of its scheduleOur count, BTS flight data
$550MDelta’s filed revenue impact ($380M) plus extra expense ($170M)Delta 8-K, August 8, 2024
$181.4MCrowdStrike incident expenses, net of insurance, through July 2026Our sum of 9 quarterly filings
$97.4Mcut to CrowdStrike’s fiscal 2025 revenue guidance midpointJune vs August 2024 8-Ks
7 of 37other SEC filers that discussed the outage put any number on itOur EDGAR full-text census

This page rebuilds the event at three zoom levels from primary sources only: CrowdStrike’s Preliminary Post Incident Review (PIR), its Root Cause Analysis (RCA) and remediation hub, Microsoft’s own posts, the Bureau of Transportation Statistics record of all 634,613 US flights scheduled in July 2024, and every 10-K, 10-Q and 8-K on SEC EDGAR from July 2024 to October 2026 that mentions CrowdStrike alongside the outage. We read and coded all 153 filings from 50 companies. Times are UTC unless marked.

Zoom 1 · The 78 minutes

What happened on July 19, 2024, minute by minute?

Friday, July 19, 2024, 04:00 to 06:00 UTC

04:0004:09 release05:27 revert06:00

Red = the 78 minutes during which Windows hosts with Falcon sensor 7.11 or later could download the bad version of Channel File 291. In US time the release came at 00:09 EDT, or 21:09 PDT on Thursday, July 18, which is why Microsoft’s post dates it “July 18”.

  1. CrowdStrike releases a Rapid Response Content update for the Windows sensor through Channel File 291. The update that occurred at 04:09 UTC was designed to target newly observed, malicious named pipes being used by common C2 frameworks in cyberattacks. CrowdStrike technical details

  2. On sensors that load the file, the next named pipe notification from Windows triggers the new template instances. Therefore, the attempt to access the 21st value produced an out-of-bounds memory read beyond the end of the input data array and resulted in a system crash. RCA, August 6, 2024

  3. The content is reverted. Channel File 291 was identified and fixed 78 minutes after it was released, at 1:27 a.m. EDT on July 19. Hosts that came online after 05:27, or never connected during the window, were not affected. CrowdStrike hub FAQ

  4. CEO George Kurtz’s statement goes out: The outage was caused by a defect found in a Falcon content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a cyberattack. CrowdStrike, July 19, 2024

  5. 16 hours after the release, CrowdStrike publishes its first intelligence note that the incident is Likely Used to Target CrowdStrike Customers. It published 6 such notes on fake fixes and lures by July 30. CrowdStrike hub, additional resources

  6. US reporting airlines cancel 3,548 of 21,468 scheduled domestic flights (16.5%); Delta mainline cancels 1,325. Our count, BTS

  7. CrowdStrike publishes “Technical Details: Falcon Content Update for Windows Hosts”, naming Channel File 291 and the file name pattern C-00000291*.sys. CrowdStrike hub

  8. We currently estimate that CrowdStrike’s update affected 8.5 million Windows devices, or less than one percent of all Windows machines. Microsoft, David Weston

What caused the CrowdStrike outage?

CrowdStrike’s sensor gets new detection logic in two ways: Sensor Content shipped with sensor releases, which customers can hold back to N-1 or N-2 versions, and Rapid Response Content pushed from the cloud as “channel files” several times a day. The July 19 file was Rapid Response Content for a template type added in sensor 7.11 in February 2024 to watch Windows named pipes. The RCA puts the root cause in one sentence:

“The new IPC Template Type defined 21 input parameter fields, but the integration code that invoked the Content Interpreter with Channel File 291’s Template Instances supplied only 20 input values to match against.”CrowdStrike, External Technical Root Cause Analysis: Channel File 291, August 6, 2024
What Channel File 291 told the sensor to compare: 21 fieldsTemplate Instance field 11Template Instance field 22Template Instance field 33Template Instance field 44Template Instance field 55Template Instance field 66Template Instance field 77Template Instance field 88Template Instance field 99Template Instance field 1010Template Instance field 1111Template Instance field 1212Template Instance field 1313Template Instance field 1414Template Instance field 1515Template Instance field 1616Template Instance field 1717Template Instance field 1818Template Instance field 1919Template Instance field 2020Template Instance field 21: the new July 19 instances used a non-wildcard match here21What the sensor code actually supplied: 20 inputsInput 1 supplied by the IPC Template Type1Input 2 supplied by the IPC Template Type2Input 3 supplied by the IPC Template Type3Input 4 supplied by the IPC Template Type4Input 5 supplied by the IPC Template Type5Input 6 supplied by the IPC Template Type6Input 7 supplied by the IPC Template Type7Input 8 supplied by the IPC Template Type8Input 9 supplied by the IPC Template Type9Input 10 supplied by the IPC Template Type10Input 11 supplied by the IPC Template Type11Input 12 supplied by the IPC Template Type12Input 13 supplied by the IPC Template Type13Input 14 supplied by the IPC Template Type14Input 15 supplied by the IPC Template Type15Input 16 supplied by the IPC Template Type16Input 17 supplied by the IPC Template Type17Input 18 supplied by the IPC Template Type18Input 19 supplied by the IPC Template Type19Input 20 supplied by the IPC Template Type20No 21st input: reading it was an out-of-bounds memory read?Field 21 points past the end of the array: out-of-bounds read, kernel crash (BSOD)

The mismatch, drawn from the RCA. Earlier IPC template instances (March 5 and April 8 to 24, 2024) used a wildcard in field 21, so the sensor never had to read it. One of the two instances deployed on July 19 introduced a non-wildcard criterion for field 21.

Three safeguards missed it. Testing used wildcards: “In part, this was due to the use of wildcard matching criteria for the 21st input during testing and in the initial IPC Template Instances.” The automated tests were narrow: “For automated testing, a static set of 12 test cases was selected to be representative of broader operational expectations.” And the checker was wrong in the same direction as the template: “The Content Validator evaluated the new Template Instances, but based its assessment on the expectation that the IPC Template Type would be provided with 21 inputs.” CrowdStrike says this exact scenario “is now incapable of recurring”. Its validator now allows only wildcard matching in field 21, and the sensor now checks array bounds at run time.

Zoom 2 · The 11 days

How long did recovery from the CrowdStrike outage take?

CrowdStrike published two recovery measurements, both as a week-over-week comparison of Windows sensors connecting to its cloud. First: “Using a week-over-week comparison, greater than 97% of Windows sensors are online as of July 24 at 5pm PT, compared to before the content update.” That was 140 hours (5.8 days) after the release. Then, in what the hub labels its “Final Post-Incident Measurement Report”: “Using a week-over-week comparison, ~99% of Windows sensors are online as of July 29 at 5pm PT, compared to before the content update. We typically see a variance of ~1% week-over-week in sensor connections.” That was 260 hours, or 10.8 days, after the release. Its testimony to Congress used looser words: “As of July 29, virtually all of our customers’ systems were back up and running.” CrowdStrike never published a 100% figure; its FAQ, last updated October 28, 2024, says “We can confirm that almost all systems have restored operations and are back online.”

Two points matter for reading those numbers. The ~99% figure sits inside the ~1% weekly variance CrowdStrike says is normal, so it is the point where the measurement stops showing a gap, not proof that every machine was fixed. And a sensor that reconnects is not the same as a business that is back: airline schedules, crews and customers took longer to untangle, which the flight data below shows.

0%10%20%30%40%50%2024-07-15: Delta mainline cancelled 0 of 3,162 scheduled flights (0.0%)152024-07-16: Delta mainline cancelled 0 of 2,979 scheduled flights (0.0%)162024-07-17: Delta mainline cancelled 24 of 3,010 scheduled flights (0.8%)172024-07-18: Delta mainline cancelled 138 of 3,162 scheduled flights (4.4%)182024-07-19: Delta mainline cancelled 1,325 of 3,167 scheduled flights (41.8%)42%192024-07-20: Delta mainline cancelled 1,212 of 2,724 scheduled flights (44.5%)44%202024-07-21: Delta mainline cancelled 1,494 of 3,154 scheduled flights (47.4%)47%212024-07-22: Delta mainline cancelled 1,209 of 3,161 scheduled flights (38.2%)38%222024-07-23: Delta mainline cancelled 497 of 2,979 scheduled flights (16.7%)17%232024-07-24: Delta mainline cancelled 45 of 3,010 scheduled flights (1.5%)242024-07-25: Delta mainline cancelled 1 of 3,162 scheduled flights (0.0%)252024-07-26: Delta mainline cancelled 0 of 3,166 scheduled flights (0.0%)262024-07-27: Delta mainline cancelled 0 of 2,723 scheduled flights (0.0%)272024-07-28: Delta mainline cancelled 0 of 3,154 scheduled flights (0.0%)282024-07-29: Delta mainline cancelled 1 of 3,159 scheduled flights (0.0%)292024-07-30: Delta mainline cancelled 1 of 2,978 scheduled flights (0.0%)302024-07-31: Delta mainline cancelled 15 of 3,009 scheduled flights (0.5%)312024-07-15: all other reporting carriers cancelled 454 of 17,645 (2.6%)2024-07-16: all other reporting carriers cancelled 326 of 16,683 (2.0%)2024-07-17: all other reporting carriers cancelled 773 of 16,891 (4.6%)2024-07-18: all other reporting carriers cancelled 776 of 17,672 (4.4%)2024-07-19: all other reporting carriers cancelled 1,929 of 17,701 (10.9%)2024-07-20: all other reporting carriers cancelled 630 of 16,017 (3.9%)2024-07-21: all other reporting carriers cancelled 492 of 17,391 (2.8%)2024-07-22: all other reporting carriers cancelled 448 of 17,669 (2.5%)2024-07-23: all other reporting carriers cancelled 475 of 16,681 (2.8%)2024-07-24: all other reporting carriers cancelled 324 of 16,895 (1.9%)2024-07-25: all other reporting carriers cancelled 124 of 17,661 (0.7%)2024-07-26: all other reporting carriers cancelled 56 of 17,699 (0.3%)2024-07-27: all other reporting carriers cancelled 56 of 16,031 (0.3%)2024-07-28: all other reporting carriers cancelled 70 of 17,351 (0.4%)2024-07-29: all other reporting carriers cancelled 75 of 17,606 (0.4%)2024-07-30: all other reporting carriers cancelled 171 of 16,622 (1.0%)2024-07-31: all other reporting carriers cancelled 137 of 16,807 (0.8%)04:09 UTC Jul 19: bad update>97% of sensors online~99% onlineJuly 2024 (flight date)Delta mainline, share of scheduled flights cancelled (July 19 to 23 in red)All other reporting carriers

Bars: share of Delta mainline scheduled flights cancelled each day. Line: all other carriers that report to BTS, excluding Delta and its wholly owned regional Endeavor Air. Dashed lines mark the release and CrowdStrike’s two sensor recovery measurements (5 p.m. PT on July 24 and July 29). Hover for counts. Source: our count of BTS Reporting Carrier On-Time Performance records, July 2024.

Every other airline was close to normal within days; Delta was not. Across all other reporting carriers the cancellation rate peaked on July 19 and fell back quickly. The highest one-day rate in the data belongs to Allegiant, which cancelled 58.8% of its flights on July 19 and was back under 1% the next day. Delta’s mainline operation got worse before it got better: its worst day was Sunday, July 21, day three, when it cancelled 1,494 flights (47.4% of its schedule). Over July 19 to 23 Delta mainline cancelled 5,737 flights, and Endeavor Air, its wholly owned regional, cancelled 774 more. Of the mainline cancellations, 5,729 were coded as carrier-caused rather than weather or air traffic control. Mainline plus Endeavor comes to 6,511; Delta’s filing counts “approximately 7,000 flight cancellations over five days”, and BTS records Delta Connection flights flown by SkyWest and Republic under those carriers, so the two counts are not directly comparable. Delta mainline fell to 45 cancellations on July 24 and 1 on July 25.

Deltanormal by day 6Delta (mainline), 2024-07-15: 0.0% cancelledDelta (mainline), 2024-07-16: 0.0% cancelledDelta (mainline), 2024-07-17: 0.8% cancelledDelta (mainline), 2024-07-18: 4.4% cancelledDelta (mainline), 2024-07-19: 41.8% cancelledDelta (mainline), 2024-07-20: 44.5% cancelledDelta (mainline), 2024-07-21: 47.4% cancelledDelta (mainline), 2024-07-22: 38.2% cancelledDelta (mainline), 2024-07-23: 16.7% cancelledDelta (mainline), 2024-07-24: 1.5% cancelledDelta (mainline), 2024-07-25: 0.0% cancelledDelta (mainline), 2024-07-26: 0.0% cancelledDelta (mainline), 2024-07-27: 0.0% cancelledDelta (mainline), 2024-07-28: 0.0% cancelledpeak 47%Jul 15Jul 28Endeavornormal by day 4Endeavor Air (Delta Connection), 2024-07-15: 2.3% cancelledEndeavor Air (Delta Connection), 2024-07-16: 1.9% cancelledEndeavor Air (Delta Connection), 2024-07-17: 23.2% cancelledEndeavor Air (Delta Connection), 2024-07-18: 16.5% cancelledEndeavor Air (Delta Connection), 2024-07-19: 49.0% cancelledEndeavor Air (Delta Connection), 2024-07-20: 48.1% cancelledEndeavor Air (Delta Connection), 2024-07-21: 25.5% cancelledEndeavor Air (Delta Connection), 2024-07-22: 17.3% cancelledEndeavor Air (Delta Connection), 2024-07-23: 4.2% cancelledEndeavor Air (Delta Connection), 2024-07-24: 7.0% cancelledEndeavor Air (Delta Connection), 2024-07-25: 0.0% cancelledEndeavor Air (Delta Connection), 2024-07-26: 0.0% cancelledEndeavor Air (Delta Connection), 2024-07-27: 0.0% cancelledEndeavor Air (Delta Connection), 2024-07-28: 0.0% cancelledpeak 49%Jul 15Jul 28Unitednormal by day 3United, 2024-07-15: 3.8% cancelledUnited, 2024-07-16: 2.2% cancelledUnited, 2024-07-17: 3.5% cancelledUnited, 2024-07-18: 4.4% cancelledUnited, 2024-07-19: 25.9% cancelledUnited, 2024-07-20: 19.3% cancelledUnited, 2024-07-21: 11.6% cancelledUnited, 2024-07-22: 2.6% cancelledUnited, 2024-07-23: 2.6% cancelledUnited, 2024-07-24: 1.6% cancelledUnited, 2024-07-25: 0.7% cancelledUnited, 2024-07-26: 0.2% cancelledUnited, 2024-07-27: 1.0% cancelledUnited, 2024-07-28: 0.5% cancelledpeak 26%Jul 15Jul 28Spiritnormal by day 3Spirit, 2024-07-15: 6.2% cancelledSpirit, 2024-07-16: 3.7% cancelledSpirit, 2024-07-17: 7.5% cancelledSpirit, 2024-07-18: 13.4% cancelledSpirit, 2024-07-19: 30.7% cancelledSpirit, 2024-07-20: 16.2% cancelledSpirit, 2024-07-21: 7.8% cancelledSpirit, 2024-07-22: 5.8% cancelledSpirit, 2024-07-23: 3.7% cancelledSpirit, 2024-07-24: 5.5% cancelledSpirit, 2024-07-25: 3.9% cancelledSpirit, 2024-07-26: 1.6% cancelledSpirit, 2024-07-27: 0.0% cancelledSpirit, 2024-07-28: 0.5% cancelledpeak 31%Jul 15Jul 28Allegiantnormal by day 1Allegiant, 2024-07-15: 0.2% cancelledAllegiant, 2024-07-16: 0.7% cancelledAllegiant, 2024-07-17: 1.5% cancelledAllegiant, 2024-07-18: 5.6% cancelledAllegiant, 2024-07-19: 58.8% cancelledAllegiant, 2024-07-20: 0.9% cancelledAllegiant, 2024-07-21: 0.2% cancelledAllegiant, 2024-07-22: 0.0% cancelledAllegiant, 2024-07-23: 0.0% cancelledAllegiant, 2024-07-24: 0.0% cancelledAllegiant, 2024-07-25: 0.4% cancelledAllegiant, 2024-07-26: 0.0% cancelledAllegiant, 2024-07-27: 2.4% cancelledAllegiant, 2024-07-28: 0.0% cancelledpeak 59%Jul 15Jul 28Americannormal by day 1American, 2024-07-15: 2.9% cancelledAmerican, 2024-07-16: 4.2% cancelledAmerican, 2024-07-17: 7.7% cancelledAmerican, 2024-07-18: 6.9% cancelledAmerican, 2024-07-19: 14.0% cancelledAmerican, 2024-07-20: 1.7% cancelledAmerican, 2024-07-21: 3.3% cancelledAmerican, 2024-07-22: 3.5% cancelledAmerican, 2024-07-23: 5.5% cancelledAmerican, 2024-07-24: 4.1% cancelledAmerican, 2024-07-25: 1.2% cancelledAmerican, 2024-07-26: 0.3% cancelledAmerican, 2024-07-27: 0.3% cancelledAmerican, 2024-07-28: 0.3% cancelledpeak 14%Jul 15Jul 28Southwestno outage spikeSouthwest, 2024-07-15: 1.9% cancelledSouthwest, 2024-07-16: 0.5% cancelledSouthwest, 2024-07-17: 0.7% cancelledSouthwest, 2024-07-18: 0.4% cancelledSouthwest, 2024-07-19: 0.1% cancelledSouthwest, 2024-07-20: 0.1% cancelledSouthwest, 2024-07-21: 0.1% cancelledSouthwest, 2024-07-22: 0.4% cancelledSouthwest, 2024-07-23: 0.6% cancelledSouthwest, 2024-07-24: 0.2% cancelledSouthwest, 2024-07-25: 0.2% cancelledSouthwest, 2024-07-26: 0.3% cancelledSouthwest, 2024-07-27: 0.1% cancelledSouthwest, 2024-07-28: 0.2% cancelledpeak 2%Jul 15Jul 28All carriersAll reporting carriers, 2024-07-15: 2.2% cancelledAll reporting carriers, 2024-07-16: 1.7% cancelledAll reporting carriers, 2024-07-17: 4.6% cancelledAll reporting carriers, 2024-07-18: 4.7% cancelledAll reporting carriers, 2024-07-19: 16.5% cancelledAll reporting carriers, 2024-07-20: 10.7% cancelledAll reporting carriers, 2024-07-21: 10.1% cancelledAll reporting carriers, 2024-07-22: 8.2% cancelledAll reporting carriers, 2024-07-23: 4.9% cancelledAll reporting carriers, 2024-07-24: 2.0% cancelledAll reporting carriers, 2024-07-25: 0.6% cancelledAll reporting carriers, 2024-07-26: 0.3% cancelledAll reporting carriers, 2024-07-27: 0.3% cancelledAll reporting carriers, 2024-07-28: 0.3% cancelledpeak 17%Jul 15Jul 28

Daily cancellation rate, July 15 to 28, 2024, each carrier on its own scale; July 19 to 23 in red. “Back to normal” = first day from July 20 on when the carrier’s cancellation rate fell to no more than twice its own July 1 to 16 rate. Several carriers (Endeavor, PSA, Frontier) had elevated cancellations on July 17 and 18, before the outage began, so not every spike in the window is the outage. Southwest’s rate stayed at or below 0.6% from July 19 to 28. Later spikes for American (July 21 to 23) were mostly coded as weather.

Flight date Delta Endeavor Air United American Spirit Allegiant Frontier Southwest All reporting carriers
Wed Jul 17 240.8% 13523.2% 763.5% 2237.7% 607.5% 41.5% 406.6% 290.7% 9324.6%
Thu Jul 18 1384.4% 9916.5% 954.4% 2016.9% 11013.4% 305.6% 20331.7% 160.4% 1,0134.7%
Fri Jul 19 1,32541.8% 29449.0% 56225.9% 40814.0% 25130.7% 31758.8% 8512.9% 50.1% 3,54816.5%
Sat Jul 20 1,21244.5% 20648.1% 38119.3% 481.7% 12916.2% 40.9% 81.3% 20.1% 2,04810.7%
Sun Jul 21 1,49447.4% 14625.5% 24211.6% 953.3% 647.8% 10.2% 345.3% 30.1% 2,13210.1%
Mon Jul 22 1,20938.2% 10417.3% 562.6% 1013.5% 475.8% 00.0% 142.1% 170.4% 1,7618.2%
Tue Jul 23 49716.7% 244.2% 552.6% 1595.5% 303.7% 00.0% 254.1% 230.6% 9964.9%
Wed Jul 24 451.5% 417.0% 351.6% 1204.1% 445.5% 00.0% 376.0% 80.2% 4102.0%
Thu Jul 25 10.0% 00.0% 150.7% 341.2% 323.9% 20.4% 142.2% 80.2% 1250.6%
Fri Jul 26 00.0% 00.0% 40.2% 100.3% 131.6% 00.0% 91.4% 120.3% 560.3%
July 1 to 16 rate 0.20% 3.46% 2.54% 1.62% 3.54% 0.70% 3.37% 1.04% 1.48%

Cancelled flights and share of scheduled flights by operating carrier. Shaded rows are July 19 to 23. Our totals for the month (634,613 flights, 18,372 cancellations) match the DOT Air Travel Consumer Report’s Table 6A for July 2024 exactly. In that report, Delta Air Lines had the highest cancellation rate of any marketing carrier network for the month, 5.6%.

The remediation steps, as CrowdStrike logged them

  1. “On July 22, 2024, CrowdStrike introduced automated techniques to accelerate remediation.” CrowdStrike also filed an 8-K that day confirming the update “was reverted at 5:27 UTC”. Hub FAQ; CrowdStrike 8-K

  2. The bad channel file version is added to Falcon’s known-bad list in the cloud. “For impacted systems with strong network connectivity, this action could also result in the automatic recovery of systems in a boot loop.” “This was configured in US-1, US-2, and EU on July 23, 2024 UTC.” Hub

  3. CrowdStrike publishes its Preliminary Post Incident Review, promising staggered, canary-first deployment of Rapid Response Content and customer control over when updates land. PIR

  4. More than 97% of Windows sensors online, week over week. Hub

  5. Bounds checking added to the Content Interpreter on July 25; a compiler check on template input counts goes into production on July 27. RCA

  6. About 99% of Windows sensors online, week over week. Hub; RCA

  7. CrowdStrike releases the full Root Cause Analysis; the sensor hotfix with the bounds check is due for general availability by August 9. RCA

Zoom 3 · The 27 months since

How much did the CrowdStrike outage cost, according to SEC filings?

Only filed figures here. Widely quoted totals for the whole economy are model estimates. The best known, from insurer Parametrix on July 24, 2024, “estimates that the total direct financial loss facing the US Fortune 500 companies (excluding Microsoft) from the CrowdStrike outage on 19 July is $5.4 billion”. That is an insurer’s estimate, not a reported loss, and its own figure for the six Fortune 500 airlines (about $860 million) is a model output; Delta’s filings alone report $550 million of revenue impact and extra expense.

Delta Air Lines

“For the September quarter, the direct revenue impact of the incident is estimated to be $380 million, primarily driven by refunding customers for cancelled flights and providing customer compensation in the form of cash and SkyMiles.” “Non-fuel expense associated with the technology-driven outage and subsequent operational recovery is estimated at $170 million”, partly offset by $50 million of lower fuel expense. The outage cost 45 cents of earnings per share and 2.3 points of operating margin in the September 2024 quarter, and its 2024 10-K says the five days of cancellations hit “1.4 million customers”. It also said: “We are pursuing legal claims against CrowdStrike and Microsoft to recover damages caused by the outage, which total at least $500 million.” 8-K, Aug 8, 2024; 8-K Ex. 99.1, Oct 10, 2024; 10-K 2024

CrowdStrike

Before the outage, on June 4, 2024, CrowdStrike guided to fiscal 2025 revenue of $3,976.3 million to $4,010.7 million. On August 28 it cut that to $3,890.0 million to $3,902.2 million, a $97.4 million (2.4%) drop at the midpoint, and said: “CrowdStrike’s revenue guidance for the fiscal year 2025 includes an estimated $30 million subscription revenue impact in each of the remaining fiscal quarters, as a result of incentives related to our customer commitment package.” It reported actual fiscal 2025 revenue of $3,953.6 million. Separately, it has booked $181.4 million of incident expenses net of insurance from May 2024 to July 2026. 8-K Ex. 99.1, Jun 4, 2024; 8-K Ex. 99.1, Aug 28, 2024; 10-K FY2025

CrowdStrike fiscal 2025 revenue guidance Range Midpoint Outage-related item disclosed
June 4, 2024 (before the outage) $3,976.3M to $4,010.7M $3,993.5M None
August 28, 2024 (first report after) $3,890.0M to $3,902.2M $3,896.1M Includes about $30M a quarter of subscription revenue impact from customer commitment packages, plus high single digit millions of services revenue
November 26, 2024 $3,923.8M to $3,930.5M $3,927.15M
Actual fiscal 2025 revenue (10-K) $3,953.6M $39.9M below the June midpoint

CrowdStrike’s incident costs did not peak in the quarter of the outage. Adding up the “expenses incurred, net of insurance receivable recorded” rollforward in each 10-Q and 10-K (and taking differences of the year-to-date figures), the largest quarter was Q1 FY26 (Feb to Apr 2025), at $39.7 million, nine months after the outage; that quarter’s 10-Q attributes $38.7 million of general and administrative expense to “the July 19 Incident and related matters”. The net figure turned negative in the latest quarter, May to July 2026, meaning insurance receivables recorded exceeded new costs. CrowdStrike adds: “In addition to customer commitment packages, the Company has made an immaterial amount of settlement offers to certain customers in response to the July 19 Incident. These amounts are, or will be, entirely offset by recoveries under the Company’s insurance policies.”

-$20M-$10M$0M$10M$20M$30M$40MQ2 FY25 (May to Jul 2024): $5.1M expenses net of insurance receivable$5.1MQ2 FY25May toJul 2024Q3 FY25 (Aug to Oct 2024): $33.9M expenses net of insurance receivable$33.9MQ3 FY25Aug toOct 2024Q4 FY25 (Nov 2024 to Jan 2025): $21.0M expenses net of insurance receivable$21.0MQ4 FY25Nov 2024 toJan 2025Q1 FY26 (Feb to Apr 2025): $39.7M expenses net of insurance receivable$39.7MQ1 FY26Feb toApr 2025Q2 FY26 (May to Jul 2025): $35.7M expenses net of insurance receivable$35.7MQ2 FY26May toJul 2025Q3 FY26 (Aug to Oct 2025): $26.2M expenses net of insurance receivable$26.2MQ3 FY26Aug toOct 2025Q4 FY26 (Nov 2025 to Jan 2026): $16.2M expenses net of insurance receivable$16.2MQ4 FY26Nov 2025 toJan 2026Q1 FY27 (Feb to Apr 2026): $18.1M expenses net of insurance receivable$18.1MQ1 FY27Feb toApr 2026Q2 FY27 (May to Jul 2026): $-14.5M expenses net of insurance receivable-$14.5MQ2 FY27May toJul 2026

CrowdStrike expenses relating to the July 19 Incident (and, from fiscal 2026, “related matters”), net of insurance receivable recorded, by fiscal quarter. Quarterly values are differences of year-to-date rollforward figures in each filing. Total $181.4 million. Peak quarter in red. These are operating expenses only; revenue effects of the customer commitment packages are separate.

Who else told investors what the outage cost?

We ran four EDGAR full-text searches (“CrowdStrike” with outage, “July 19”, “CrowdStrike incident” and “IT outage”) across 10-K, 10-Q and 8-K filings from July 19, 2024 to October 28, 2026, downloaded all 153 matching filings from 50 companies, and read every passage. Leaving out CrowdStrike itself, 37 of the 49 companies discussed the outage, 22 said it touched their own operations, and only 7 put any number on it. Just two, Delta and Spirit, isolated a dollar figure for the outage alone; three others folded it into a combined weather and outage number, and one, Southwest, reported a gain from rebooking other airlines’ stranded passengers.

7
15
15
12
Put a number on it (7)Said it was hit, no figure (15)Not affected or risk example only (15)Unrelated mention (12)
Filer What it disclosed Figure Quote from the filing Filing
Delta Air Lines (DAL) Put a number on it $380M revenue impact, $170M extra expense, $50M lower fuel; claims of at least $500M “the direct revenue impact of the incident is estimated to be $380 million” 8-K
2024-08-08
Spirit Airlines (SAVE) Put a number on it 470 flights cancelled July 19; $7.2M hit to Q3 operating income “The Company estimates the negative impact to third quarter operating income related to this operational disruption was $7.2 million, primarily due to lost revenue” 8-K
2024-08-01
Allegiant Travel (ALGT) Put a number on it $3.2M rise in Q3 passenger compensation, partly from the outage “a $3.2 million increase in passenger compensation partially as the result of the CrowdStrike outage in July” 10-Q
2024-11-05
Frontier Group (ULCC) Put a number on it 4 point Q3 pre-tax margin hit, weather and outage combined “including an estimated 4 percentage point impact related to weather, including Hurricane Debby, and the July Microsoft/CrowdStrike outage” 8-K
2024-08-08
Genuine Parts (GPC) Put a number on it 0.7% of Q3 comparable sales, hurricanes and outage combined “We also estimate the disruption from hurricanes and the CrowdStrike technology outage in the U.S negatively impacted comparable sales in both segments by a total of 0.7%” 10-Q
2024-10-22
Advance Auto Parts (AAP) Put a number on it About 125 bp of Q3 operating margin from atypical items incl. the outage “approximately 125 basis points of atypical items and headwinds in the period (such as lost revenue from Hurricane Helene and downtime from the CrowdStrike outage)” 8-K
2024-11-14
Southwest Airlines (LUV) Put a number on it About 1 point RASM tailwind from rebooking other airlines’ passengers (a gain) “an approximate one point tailwind from the reaccommodation of Customers affected by other airlines’ cancellations following the CrowdStrike incident in July” 8-K
2024-09-26
American Airlines (AAL) Said it was hit, no figure Operations impacted; no figure “the CrowdStrike-caused systems outage in July 2024 significantly impacted airline operations, including our own” 10-Q
2024-10-24
Sun Country Airlines (SNCY) Said it was hit, no figure Cited as a Q3 headwind; no figure “Despite the impact of the Crowdstrike outage and the hurricanes during the quarter” 8-K
2024-10-30
Veradigm (MDRX) Said it was hit, no figure Most customer systems restored within 24 hours, all in under 3 days “The majority of client facing systems were restored within 24 hours and all affected systems were fully restored in fewer than three calendar days” 10-K
2025-03-18
Blackbaud (BLKB) Said it was hit, no figure Customers could not reach some services incl. payments; deemed immaterial “deemed it to be immaterial” 10-K
2025-02-21
Valvoline (VVV) Said it was hit, no figure Manual processes, slowed service; not material “This incident required temporary manual processes to maintain operations” 10-K
2024-11-22
Hilton Worldwide (HLT) Said it was hit, no figure Temporarily impacted; not material “Although the outage did not have a material impact to our business, we were temporarily impacted by the outage” 10-K
2025-02-06
Intercontinental Exchange (ICE) Said it was hit, no figure Impacted; limited and not material “our business was impacted by the CrowdStrike outage in July 2024, and although impact to us from the outage was limited in scope and not material” 10-K
2025-02-06
Enovix (ENVX) Said it was hit, no figure Temporary disruptions at US, Malaysia and India sites “caused temporary disruptions to our systems and servers at our U.S., Malaysia and India locations” 10-Q
2024-08-05
Primo Brands (PRMB) Said it was hit, no figure Interruptions to Microsoft applications “resulted in interruptions to the availability and functionality of Microsoft applications” 10-Q
2024-12-17
Concentra Group (CON) Said it was hit, no figure Mitigated impacts; no figure “mitigated impacts of major storms (Beryl and Helene) and the CrowdStrike-related IT outage” 8-K
2024-10-31
Light & Wonder (LNW) Said it was hit, no figure Disruptions; no figure “resulting in disruptions and exposure to cybersecurity threats and/or disruptions for us and many others” 10-K
2025-02-25
Redwood Trust (RWT) Said it was hit, no figure Limited impact “This particular outage had a limited impact on us” 10-K
2025-03-03
Marsh McLennan (MMC) Said it was hit, no figure Third-party update affected availability; no figure “which occurred with the CrowdStrike event in July 2024” 10-K
2025-02-10
Peoples Bancorp (PEBO) Said it was hit, no figure Nominal impact, resolved “the CrowdStrike outage from last week had nominal impact on our systems” 8-K
2024-07-26
PROS Holdings (PRO) Said it was hit, no figure Excluded the outage from its 99.97% uptime figure “Excludes impact from the CrowdStrike outage” 8-K
2025-02-06

Not affected or used only as a risk example (15): Bank of New York Mellon, DocuSign, Genasys, NXP Semiconductors, Navan, Guidewire Software, JFrog, Clear Secure, Intel, Molina Healthcare, Phoenix Education Partners, Resideo Technologies, S&P Global, Sera Prognostics, Tenable Holdings. Unrelated mentions such as competitor or partner lists (12): CSP Inc, Lantronix, ePlus, Elastic, Fortinet, Palo Alto Networks, Qualys, Okta, Insight Enterprises, Joby Aviation, Oculus Inc, XWELL. Filers that described the event without naming CrowdStrike are not captured. For how filed outage costs compare with revenue per hour across all public companies, see our cost of downtime analysis of SEC revenue data.

What happened to the lawsuits and investigations?

Most of the litigation against CrowdStrike is over, and the biggest case is not. The status below is as CrowdStrike reported it to the SEC in its 10-Q for the quarter ended July 31, 2026 (filed August 27, 2026) and its 10-K for fiscal 2026.

Matter Court or agency Filed Status
Delta v. CrowdStrike, Inc. Superior Court for Fulton County, Georgia (Metro Atlanta Business Case Division) Filed October 25, 2024 Motion to dismiss granted in part and denied in part on May 16, 2025. Discovery is ongoing.
Airline passenger class actions (consolidated) US District Court, Western District of Texas; appeal to the Fifth Circuit Filed August 5 and August 19, 2024 Dismissed June 18, 2025. Fifth Circuit affirmed May 20, 2026 and denied rehearing June 15, 2026.
Securities class action against CrowdStrike and officers US District Court, Western District of Texas Filed July 30, 2024 Motion to dismiss granted January 12, 2026; final judgment January 28, 2026; no appeal filed.
Shareholder derivative suits (three consolidated groups) W.D. Texas and Delaware Court of Chancery Filed September 2024 to July 2025 Ordered dismissed March 18, April 7 and April 16, 2026.
US Department of Justice and SEC requests Information requests, no proceeding disclosed Disclosed in CrowdStrike filings Requests cover revenue recognition and ARR reporting for some customer deals, the July 19 Incident and related matters; CrowdStrike says it is cooperating.

In Congress, on September 24, 2024, Adam Meyers, CrowdStrike’s senior vice president for counter adversary operations, testified to the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, apologized and said: “Our threat detection configuration information, known as Rapid Response Content, is now released gradually across increasing rings of deployment”. On July 30, 2024 the Transportation Secretary wrote to all airline CEOs about refund duties “as we emerge from the air travel disruptions caused by the global technology outage earlier this month”. We could not retrieve a primary DOT record of its separate investigation of Delta, so we do not report its outcome here.

What changed after the CrowdStrike outage?

CrowdStrike: staged rings and customer controls

The RCA says new template instances now pass canary testing and successive deployment rings with bake-in time, and “Customers can choose where and when Rapid Response Content updates are deployed.” CrowdStrike’s own API documentation for content update policies shows what that means in practice. Each content category (system critical, sensor operations, Rapid Response, vulnerability management) is assigned a ring_assignment of ea (early access), ga (general availability) or pause. On the ga ring, delay_hours can be set to 0, 1, 2, 4, 8, 12, 24, 48 or 72 hours. A pinned_content_version stops a category from updating: when it is set, “the content category will not automatically update to newer versions.” The system critical category cannot be paused. RCA; CrowdStrike developer docs

Microsoft: Windows Resiliency Initiative

After a September 10, 2024 summit where “Both our customers and ecosystem partners have called on Microsoft to provide additional security capabilities outside of kernel mode”, Microsoft announced quick machine recovery in November 2024: “This feature will enable IT administrators to execute targeted fixes from Windows Update on PCs, even when machines are unable to boot, without needing physical access to the PC.” It also said it was building a platform so security tools can work outside the kernel: “This means security products, like anti-virus solutions, can run in user mode just as apps do.” In June 2025 it wrote: “Next month, we will deliver a private preview of the Windows endpoint security platform to a set of MVI partners.” Its MVI 3.0 partner program sets new rules for security vendors: “Requirements include testing incident response processes and following safe deployment practices (SDP) for updates to Windows endpoints.” On quick machine recovery defaults, Microsoft’s documentation says: “Cloud remediation is disabled by default on enterprise-managed systems, allowing organizations to choose the configuration that best meets their needs”. Sept 2024; Nov 2024; June 2025; Microsoft Learn

What this means for MSPs

Treat security agents as change you deploy, not weather. The July 19 file was not rolled out in stages: CrowdStrike’s RCA lists “Template Instances should have staged deployment” among its findings. Today you can put a pilot group on the early access ring and the rest of the fleet on general availability with a delay of up to 72 hours for most content categories, and pin versions for systems that cannot crash. Decide the policy per client, write it down, and review it when you onboard. Our post-mortem studies point the same way: in every Cloudflare outage post-mortem, 27 of 40 began with Cloudflare’s own change, and in our AWS outage history, 13 of 18 major events were software, not power.

Plan for hands-on recovery. Affected machines sat in a boot loop. CrowdStrike’s own guidance was to reboot on a wired network so the host could fetch the fixed file, use bootable recovery images or manual steps if it kept crashing, and “Note: Bitlocker-encrypted hosts may require a recovery key.” Keep BitLocker recovery keys retrievable from somewhere that does not depend on the Windows estate being up, and count how many machines per technician per hour your team can rebuild. On managed Windows 11 devices, quick machine recovery’s cloud remediation is off by default, so turning it on is a decision you have to make.

Expect attackers within hours. CrowdStrike’s first warning about criminals exploiting the outage came 16 hours after the release, followed by notes on fake recovery manuals, fake updates and fake crash reporters. Tell clients the only fix instructions they should follow will come from you.

Do the uptime math honestly. A 78-minute release window turned into multi-day outages for some customers; at 99.9% uptime a month only allows 43.8 minutes of downtime. Vendor SLAs and limitation of liability clauses decide who pays: two and a quarter years on, Delta’s case against CrowdStrike is still in discovery, and the passenger class action was dismissed.

Frequently asked questions

How much did the CrowdStrike outage cost?

Only filed numbers are firm. Delta reported a $380 million direct revenue hit and $170 million of extra non-fuel expense, partly offset by $50 million of lower fuel cost. CrowdStrike booked $181.4 million of incident expenses net of insurance through July 2026 and cut its fiscal 2025 revenue guidance midpoint by $97.4 million. Insurer Parametrix modeled $5.4 billion of losses for the Fortune 500, an estimate, not a filed figure.

What caused the CrowdStrike outage?

A Rapid Response Content update in Channel File 291, released at 04:09 UTC on July 19, 2024. Its new template instances asked the Falcon sensor to match a 21st input field, but the sensor code supplied only 20 inputs, so the Windows kernel driver read memory out of bounds and crashed. CrowdStrike’s Content Validator had checked the content against 21 expected inputs.

How long did the CrowdStrike outage last?

The faulty file was live for 78 minutes, from 04:09 to 05:27 UTC. Recovery took much longer: CrowdStrike reported more than 97% of Windows sensors back online by July 24 and about 99% by July 29 at 5 p.m. PT, 10.8 days after the release. Delta’s mainline cancellations returned to normal on July 25.

How many computers did the CrowdStrike outage affect?

Microsoft estimated on July 20, 2024 that the update affected 8.5 million Windows devices, or less than one percent of all Windows machines. Only Windows hosts running Falcon sensor 7.11 or later that were online between 04:09 and 05:27 UTC and received the update were in scope; Mac and Linux hosts were not affected.

What happens if CrowdStrike goes down?

In July 2024 the cloud platform kept running; the damage came from a content file the sensor loaded on each Windows host, which crashed into a boot loop. Hosts that stayed online long enough picked up the reverted file, others needed manual recovery, and BitLocker-encrypted machines could need a recovery key. CrowdStrike now lets customers stage, delay (up to 72 hours) or pause most content categories.

Is Delta still suing CrowdStrike?

Yes. Delta filed suit in the Superior Court for Fulton County, Georgia on October 25, 2024. On May 16, 2025 the court granted CrowdStrike’s motion to dismiss in part and denied it in part, and CrowdStrike’s 10-Q for the quarter ended July 31, 2026 says discovery is ongoing.

Download the data. crowdstrike-outage-bts-daily-cancellations-july-2024.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Timeline. Every timestamp comes from a primary document saved in October 2026: CrowdStrike’s PIR (July 24, 2024, updated July 25), RCA (August 6, 2024), remediation and guidance hub (statements, FAQ and “Published” or “Updated” UTC stamps), technical details post and July 22, 2024 Form 8-K; Microsoft’s July 20, 2024 blog and later Windows posts; and the House hearing record. Eastern and Pacific times are converted from UTC (EDT is UTC minus 4, PDT is UTC minus 7). Recovery durations are measured from 04:09 UTC on July 19 to the times CrowdStrike gives for its sensor measurements (July 24 and July 29 at 5 p.m. PT).

Flight data. Bureau of Transportation Statistics, Reporting Carrier On-Time Performance (1987 to present), July 2024 file, downloaded October 2026: 634,613 scheduled domestic flights by the 15 reporting carriers, aggregated by flight date and operating carrier. Cancellation rate = cancelled / scheduled. Baseline = July 1 to 16, 2024. “Back to normal” = the first day from July 20 on with a cancellation rate no higher than twice the carrier’s baseline; carriers whose July 19 to 21 peak stayed under three times baseline (or under 3%) are marked as having no outage spike. Flights are counted by operating carrier, so Delta Connection flights flown by SkyWest or Republic sit under those carriers, while Endeavor Air (wholly owned by Delta) is shown separately. BTS does not record why a flight was cancelled beyond four broad cause codes, so July 19 to 23 cancellations are not all attributable to the outage.

SEC filings. EDGAR full-text search (efts.sec.gov) for four queries across 10-K, 10-Q and 8-K forms (including exhibits) filed July 19, 2024 to October 28, 2026; 153 filings from 50 companies. We read each passage mentioning CrowdStrike and coded each company by its most specific disclosure: a number, an impact without a number, no impact or a risk example only, or an unrelated mention. CrowdStrike’s incident expenses are taken from the rollforward tables in its 10-Qs and 10-Ks; quarterly amounts are differences of year-to-date figures. Every quote on this page was checked by our code against the saved filing text.

Limitations. Full-text search misses companies that described the event without naming CrowdStrike, and filings that quantified it only on earnings calls. Delta’s and others’ figures are company estimates. CrowdStrike’s sensor recovery figures are its own measurement. Parametrix’s figure is an insurer’s model estimate and is shown only for context. The flight data covers US domestic flights only.

Licensing. BTS data and SEC filings are US government public records. CrowdStrike, Microsoft and Parametrix material is quoted for reporting and commentary. The downloadable CSV (daily flights, cancellations and cause codes by carrier for July 2024) is our aggregation of BTS data, licensed CC BY 4.0.

Cite as: The Uptime Report. “CrowdStrike Outage Anatomy: a 78-Minute Bad Update, 11 Days to 99%, and What SEC Filers Said It Cost.” October 2026. https://theuptimereport.com/crowdstrike-outage/

References

  1. CrowdStrike, Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD), July 24, 2024. Accessed October 2026.
  2. CrowdStrike, External Technical Root Cause Analysis: Channel File 291, August 6, 2024 (PDF). Accessed October 2026.
  3. CrowdStrike, Falcon Content Update Remediation and Guidance Hub. Accessed October 2026.
  4. CrowdStrike, Technical Details: Falcon Update for Windows Hosts. Accessed October 2026.
  5. CrowdStrike, To Our Customers and Partners, July 19, 2024. Accessed October 2026.
  6. CrowdStrike developer documentation, crowdstrike_content_update_policy resource. Accessed October 2026.
  7. Microsoft, Helping our customers through the CrowdStrike outage, July 20, 2024. Accessed October 2026.
  8. Microsoft, Taking steps that drive resiliency and security for Windows customers, September 12, 2024. Accessed October 2026.
  9. Microsoft, Windows security and resiliency: Protecting your business, November 19, 2024. Accessed October 2026.
  10. Microsoft, The Windows Resiliency Initiative: Building resilience for a future-ready enterprise, June 26, 2025. Accessed October 2026.
  11. Microsoft Learn, Quick machine recovery. Accessed October 2026.
  12. House Committee on Homeland Security, An Outage Strikes: Assessing the Global Impact of CrowdStrike’s Faulty Software Update, September 24, 2024. Accessed October 2026.
  13. Testimony of Adam Meyers, CrowdStrike, September 24, 2024 (PDF). Accessed October 2026.
  14. Bureau of Transportation Statistics, Reporting Carrier On-Time Performance, July 2024. Accessed October 2026.
  15. US DOT, Air Travel Consumer Report, September 2024 (July 2024 data). Accessed October 2026.
  16. US DOT, Letter from Secretary Buttigieg to airline CEOs, July 30, 2024. Accessed October 2026.
  17. CrowdStrike Holdings, Form 8-K, July 22, 2024. Accessed October 2026.
  18. CrowdStrike Holdings, Form 8-K Exhibit 99.1, June 4, 2024. Accessed October 2026.
  19. CrowdStrike Holdings, Form 8-K Exhibit 99.1, August 28, 2024. Accessed October 2026.
  20. CrowdStrike Holdings, Form 8-K Exhibit 99.1, November 26, 2024. Accessed October 2026.
  21. CrowdStrike Holdings, Form 10-Q, quarter ended October 31, 2024. Accessed October 2026.
  22. CrowdStrike Holdings, Form 10-K, fiscal year ended January 31, 2025. Accessed October 2026.
  23. CrowdStrike Holdings, Form 10-Q, quarter ended April 30, 2025. Accessed October 2026.
  24. CrowdStrike Holdings, Form 10-Q, quarter ended July 31, 2025. Accessed October 2026.
  25. CrowdStrike Holdings, Form 10-Q, quarter ended October 31, 2025. Accessed October 2026.
  26. CrowdStrike Holdings, Form 10-K, fiscal year ended January 31, 2026. Accessed October 2026.
  27. CrowdStrike Holdings, Form 10-Q, quarter ended April 30, 2026. Accessed October 2026.
  28. CrowdStrike Holdings, Form 10-Q, quarter ended July 31, 2026. Accessed October 2026.
  29. Delta Air Lines, Form 8-K, August 8, 2024. Accessed October 2026.
  30. Delta Air Lines, Form 8-K Exhibit 99.1, October 10, 2024. Accessed October 2026.
  31. Delta Air Lines, Form 10-K for 2024. Accessed October 2026.
  32. SEC EDGAR full-text search and the 153 filings it returned (each linked in the filer table). Accessed October 2026.
  33. Parametrix, CrowdStrike to Cost Fortune 500 $5.4b; Insured Loss Range of $0.54b to $1.08b, July 24, 2024. Accessed October 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

One response to “CrowdStrike Outage Anatomy: a 78-Minute Bad Update, 11 Days to 99%, and What SEC Filers Said It Cost”

  1. Hypervisor Vulnerabilities 2026: ESXi, vCenter, Hyper-V

    […] CrowdStrike OutageJuly 19, 2024 outage, minute by minute […]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts