Delta sues cybersecurity firm CrowdStrike over tech outage that canceled flights

ATLANTA — Delta Air Lines sued CrowdStrike on Friday, claiming the cybersecurity business had cut corners and caused a worldwide technology outage that led to thousands of canceled flight in July.

The airline is asking for compensation and punitive damages from the outage, which started with a faulty update sent to several million Microsoft computers. Delta said the outage crippled its operations for several days, costing more than $500 million in lost profits and extra costs.

CrowdStrike said Delta is giving “misinformation,” does not comprehend cybersecurity and is trying to shift blame for its leisurely recovery from the outage.

The U.S. Department of Transportation is investigating why Delta took longer to recover than other carriers. Transportation Secretary Pete Buttigieg said the department also would look into complaints about Delta customer service during the outage, including long waits for assist and reports that unaccompanied minors were stranded at airports.

In its lawsuit, Delta claims that the outage occurred because CrowdStrike failed to test the update before rolling it out worldwide.

Delta canceled about 7,000 flights over a five-day period during the peak summer vacation period. The outage also affected banks, hospitals and other businesses.

“CrowdStrike caused a global catastrophe because it cut corners, took shortcuts, and circumvented the very testing and certification processes it advertised, for its own advantage and profits,” Delta said in the lawsuit, which was filed in Fulton County Superior Court in Georgia, near the business’s headquarters.

A CrowdStrike spokesperson said the business tried to resolve the dispute — one of its lawyers said in August that CrowdStrike’s obligation to Delta was less than $10 million.

The spokesperson said Delta’s claims are based on “misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its leisurely recovery away from its setback to modernize its antiquated IT infrastructure.”