Delta sues cybersecurity firm CrowdStrike over tech outage that canceled flights

ATLANTA — Delta Air Lines sued CrowdStrike on Friday, claiming the cybersecurity company had cut corners and caused a worldwide technology outage that led to thousands of canceled flight in July.

The airline is asking for compensation and punitive damages from the outage, which started with a faulty update sent to several million Microsoft computers. Delta said the outage crippled its operations for several days, costing more than $500 million in lost revenue and extra expenses.

CrowdStrike said Delta is giving “misinformation,” does not understand cybersecurity and is trying to shift blame for its slow recovery from the outage.

The U.S. Department of Transportation is investigating why Delta took longer to recover than other carriers. Transportation Secretary Pete Buttigieg said the department also would look into complaints about Delta customer service during the outage, including long waits for help and reports that unaccompanied minors were stranded at airports.

In its lawsuit, Delta claims that the outage occurred because CrowdStrike failed to test the update before rolling it out worldwide.

Delta canceled about 7,000 flights over a five-day period during the peak summer vacation season. The outage also affected banks, hospitals and other businesses.

“CrowdStrike caused a global catastrophe because it cut corners, took shortcuts, and circumvented the very testing and certification processes it advertised, for its own benefit and profit,” Delta said in the lawsuit, which was filed in Fulton County Superior Court in Georgia, near the company's headquarters.

A CrowdStrike spokesperson said the company tried to resolve the dispute — one of its lawyers said in August that CrowdStrike's liability to Delta was less than $10 million.

The spokesperson said Delta's claims are based on "misinformation, demonstrate a lack of understanding of how modern cybersecurity works, and reflect a desperate attempt to shift blame for its slow recovery away from its failure to modernize its antiquated IT infrastructure.”