Outages hit Microsoft clients globally, but CrowdStrike says no cyberattack as many flights grounded
Banks, airlines, TV stations and health systems in countries around the world that rely on Microsoft's 365 apps reported widespread outages Friday. Thousands of flights and train services were cancelled in the U.S. and Europe, and there were disruptions to many other public and retail services.
The issue was cause by a technical problem that global cybersecurity firm CrowdStrike said it had identified in its systems and was working to resolve.
Microsoft 365 said on social media that it was "investigating an issue impacting users ability to access various Microsoft 365 apps and services" and that things were improving as the company worked to "reroute the affected traffic to healthy infrastructure."
When CBS News called CrowdStrike's technical support line on Friday, a pre-recorded message said the company was aware of reports of crashes on Microsoft systems related to its Falcon sensor.
In a statement initially shared on social media Friday, CrowdStrike CEO George Kurtz said the issue had been identified and a solution was being implemented.
"CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted," Kurtz said. "This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed."
American Airlines, Delta, United Airlines and Spirit Airlines grounded all pending flight departures, though American Airlines and United lifted their ground stops later on Friday.
"We are resuming some flights but expect schedule disruptions to continue throughout Friday," United Airlines said in a statement.
Over 600 flights had been cancelled in the U.S. by early Friday morning and over 1,200 had been delayed. Globally, over 15,000 flights had been delayed by early Friday, with that number expected to rise.
American Airlines said the problem had been caused by "a technical issue with CrowdStrike" that it said was impacting multiple airlines.
Some of the problems caused by the defect will likely take time to fix, Chief Information Officer at identity security firm CyberArk, Omer Grossman, told Reuters. He said that the issue had to do with Endpoint Detection and Response (EDR) products that run on individual client computers.
"It turns out that because the endpoints have crashed - the Blue Screen of Death - they cannot be updated remotely and the problem must be solved manually, endpoint by endpoint. This is expected to be a process that will take days," Grossman said.
In Europe, Lufthansa, KLM and SAS Airlines reported disruptions. Switzerland's largest airport, in Zurich, said planes were not being allowed to land, according to CBS News partner network BBC News.
In India, at the country's primary airport in Delhi, everything was being done manually. No electric check-in terminals were functioning and gate information was being updated by hand on a white board, the BBC reported.
Hospitals in Germany said they were cancelling elective surgeries Friday and doctors in the U.K. said they were having issues accessing their online booking system. Pharmacists in the U.K. said there were disruptions with medicine deliveries and accessing prescriptions.
Britain's Sky News and the BBC's TV network aimed at children both went off the air on Friday, though Sky came back up — with presenters reading from printed notes rather than off of teleprompters as they normally would.
New Zealand's acting prime minister David Seymour said on social media that officials were working hard to understand the impacts of the outages.
"I have not currently received any reporting to indicate these issues are related to malicious cyber security activity," Seymour said.
A spokesman for Germany's interior ministry also said there was no indication that the outages were due to a cyberattack, Reuters reported.
This is a developing news story and will be updated.
