IT outage compensation talk inevitable: CrowdStrike

The company at fault for a global IT outage that hobbled banks, airlines, supermarkets and media organisations, admits compensation for impacted businesses will have to be discussed.

Friday’s outage, which hit an estimated 8.5 million Windows devices worldwide, was caused by a logic flaw in a software update sent by cybersecurity provider CrowdStrike to its customers, the company’s Australian president Michael Sentonas told Sky News.

Mr Sentonas “deeply” apologised and said CrowdStrike’s focus was on remediating the issue to ensure customers were back up and running.

But he conceded it would be hard to avoid affected businesses seeking compensation or litigation.

“Those conversations have to happen and will happen,” Mr Sentonas said on Tuesday.

“That phase will come after we get our customers remediated.”

While the full cost of the outage is difficult to quantify, some experts have estimated the impact to businesses globally at over $1 billion, with Business NSW estimating the bill to top $200 million in that state alone.

Jetstar was particularly hard hit, with hundreds of cancelled flights leaving thousands of customers stranded.

“I personally apologise for what happened,” Mr Sentonas said.

“We understand the disruption and the distress that we caused a lot of people. We put out an update, which we do regularly and we’ve been doing for over a decade, and we got this very wrong.”

Australian Industry Group chief executive Innes Willox said it remains to be seen whether businesses would be able to seek compensation, either from CrowdStrike directly or via some form of government redress scheme.

“It’s impacted different businesses and different sectors of the economy in wildly different ways, and the reality is we’re going to be seeing the tailpipe of this for weeks to come,” Mr Willox told ABC News.

Regardless, the fallout for CrowdStrike itself is likely to be lengthy and costly.

The company’s share price has plummeted by more than 30 per cent since the outage, erasing billions of dollars from CrowdStrike’s market value.

US House leaders are calling on US CEO George Kurtz to testify to Congress about the cybersecurity company’s role in sparking the widespread tech outage that grounded flights, knocked banks and hospital systems offline and affected services around the world.

Republicans who lead the House Homeland Security committee said they want those answers soon.

“While we appreciate CrowdStrike’s response and coordination with stakeholders, we cannot ignore the magnitude of this incident, which some have claimed is the largest IT outage in history,” said a letter to Kurtz from Rep. Mark E. Green of Tennessee and Rep. Andrew Garbarino of New York.

They added that Americans “deserve to know in detail how this incident happened and the mitigation steps CrowdStrike is taking”.

The painstaking work of fixing it has often required a company’s IT crew to manually delete files on affected machines.

CrowdStrike on Sunday said in a blog post that it was starting to implement a new technique to accelerate remediation of the problem. It also said in a brief statement Monday that it is actively in contact with congressional committees.

The scope of the disruptions has also caught the attention of government regulators, including antitrust enforcers, though it remains to be seen if they take action against the company.