INCIDENT REPORT · CP-2024-008

CrowdStrike Falcon faulty update global IT outage

L3 · ELEVATEDCONFIRMEDNOT AN ATTACK

On 19 July 2024 at 04:09 UTC, CrowdStrike released a faulty Falcon sensor configuration update (Channel File 291) that crashed Windows systems worldwide. CrowdStrike stated it was not a cyberattack.

Incident ID: CP-2024-008
Incident date: 19 JUL 2024
Detection date: 19 JUL 2024
Affected countries: United States
Plotted location: Austin, United States (Headquarters of the company whose faulty update caused the outage; affected systems were worldwide)
Threat classification: Level 3 — ELEVATED
Classification rationale: Large-scale global IT disruption (airlines, hospitals, banks). Classified on impact; it was a faulty software update, not a cyberattack.
Attack type: Non-Malicious IT Failure
Nature: Non-malicious failure — not a cyberattack
Attack vector: Not publicly documented
Sectors: Transportation, Healthcare, Finance, Media, Government, Retail
Critical infrastructure: Yes
Organizations affected: CrowdStrike, Organizations running CrowdStrike Falcon sensor for Windows
Operational consequences: Microsoft estimated about 8.5 million Windows devices were affected, under 1% of all Windows machines. Airlines, hospitals, banks and broadcasters were disrupted; a corrected file was issued at 05:27 UTC, but many systems needed manual recovery.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

CrowdStrike Falcon faulty update global IT outage

L3 · ELEVATEDCONFIRMEDNOT AN ATTACK

On 19 July 2024 at 04:09 UTC, CrowdStrike released a faulty Falcon sensor configuration update (Channel File 291) that crashed Windows systems worldwide. CrowdStrike stated it was not a cyberattack.

Incident ID

CP-2024-008

Incident date

19 JUL 2024

Detection date

19 JUL 2024

Affected countries

United States

Plotted location

Austin, United States (Headquarters of the company whose faulty update caused the outage; affected systems were worldwide)

Threat classification

Level 3 — ELEVATED

Classification rationale

Large-scale global IT disruption (airlines, hospitals, banks). Classified on impact; it was a faulty software update, not a cyberattack.

Attack type

Non-Malicious IT Failure

Nature

Non-malicious failure — not a cyberattack

Attack vector

Not publicly documented

Sectors

Transportation, Healthcare, Finance, Media, Government, Retail

Critical infrastructure

Yes

Organizations affected

CrowdStrike, Organizations running CrowdStrike Falcon sensor for Windows

Operational consequences

Microsoft estimated about 8.5 million Windows devices were affected, under 1% of all Windows machines. Airlines, hospitals, banks and broadcasters were disrupted; a corrected file was issued at 05:27 UTC, but many systems needed manual recovery.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded