What Caused the Global Microsoft Outages?

Early Friday, a widespread outage linked to the cybersecurity firm CrowdStrike affected banks, airlines, television networks, and health systems around the world that rely on Microsoft 365 applications. The outage led to the cancellation of thousands of flights and train services globally, including over 1,800 in the U.S., and disrupted numerous public and retail services.

The Root Cause

The outages were caused by a technical glitch in CrowdStrike’s software, which the global cybersecurity firm identified and is actively working to resolve. CrowdStrike provides antivirus software to Microsoft for its Windows devices.

"Earlier today, a CrowdStrike update was responsible for bringing down a number of IT systems globally," Microsoft said in a statement to CBS News.

Later on Friday, Microsoft announced via social media that they had "completed our mitigation actions and our telemetry indicates all previously impacted Microsoft 365 apps and services have recovered. We're entering a period of monitoring to ensure impact is fully resolved."

CrowdStrike CEO George Kurtz also released a statement confirming that the issue had been identified and a solution was being implemented. He emphasized that "this is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed."

Impact of the Microsoft Outages

As of Friday night, over 3,000 flights within, into, or out of the U.S. were canceled, and more than 11,400 were delayed, according to FlightAware. Globally, over 42,000 flights faced delays on Friday.

American Airlines, Delta Air Lines, and United Airlines resumed some flight departures later in the day after initially pausing operations.

"We have recovered our operation today and expect to deliver a reliable operation for our customers tomorrow," American Airlines stated. United Airlines mentioned that they were "carefully" ramping up their "recovery over the course of the day."

A timelapse shared by the Federal Aviation Administration showed flights resuming on Friday afternoon.

Healthcare Systems Affected

In Boston, Brigham and Women's Hospital canceled all non-urgent surgeries and medical visits due to computer system outages, which prevented access to vital digital records.

"We do everything on our computers now," neuro ICU nurse Meghan Mahoney told CBS News. "…People's medical history, their allergies. So when that goes down, we have to revert back to paper charting."

Memorial Sloan Kettering Cancer Center in New York City postponed all procedures requiring anesthesia, and Emory Healthcare in Atlanta delayed certain surgeries. Seattle Children's Hospital closed its outpatient clinic.

The Department of Health and Human Services stated on Friday afternoon that it was "working to assess the impact of the CrowdStrike outage on patient care and HHS systems, services, and operations."

Government and Public Services Disrupted

A Department of Homeland Security memo to staff confirmed that "DHS systems are currently impacted by a global outage of the cybersecurity software CrowdStrike. This is impacting many businesses globally, as you may be seeing in the news. This was not a cyberattack."

In Portland, Oregon, Mayor Ted Wheeler issued an Emergency Declaration to enable "immediate response and resources to get city systems back to fully operational levels." In New York City, Mayor Eric Adams noted that the outage did not significantly impact city operations due to previous drills and preparations for IT issues.

International Impact

In Europe, Lufthansa, KLM, and SAS Airlines reported disruptions. Switzerland's largest airport indicated that planes were not allowed to land. In Delhi, India’s main airport operated manually, with no functioning electronic check-in terminals and gate information updated by hand on a whiteboard.

Hospitals in Germany canceled elective surgeries, and doctors in the U.K. faced issues with their online booking system. U.K. pharmacists experienced disruptions in medicine deliveries and accessing prescriptions.

Additional Effects

The Federal Bureau of Investigation reported no operational problems despite some system impacts. The London Stock Exchange experienced disruptions in its regulatory news service, but trading was not affected. The New York Stock Exchange operated normally with a planned opening.

Starbucks reported that the outage prevented customers from using mobile ordering features. Delivery companies like FedEx warned of possible delays for packages due to the outage.

"FedEx has activated contingency plans to mitigate impacts from a global IT outage experienced by a third-party software vendor. However, potential delays are possible for package deliveries with a commitment of July 19, 2024," the company said in a statement.

When Will the Microsoft Outages Be Fixed?

Despite CrowdStrike implementing a fix, some issues may take time to resolve, according to Omer Grossman, Chief Information Officer at CyberArk. The problem involves Endpoint Detection and Response (EDR) products on individual client computers.

"Because the endpoints have crashed — the Blue Screen of Death — they cannot be updated remotely and the problem must be solved manually, endpoint by endpoint. This process is expected to take days," Grossman explained.

In an interview with CNBC, CrowdStrike’s Kurtz said many affected systems were beginning to recover, and some clients might need only to reboot their computers or servers. However, he acknowledged that "some systems may not fully recover, and we're working individually with each and every customer to ensure they are operational."

No specific timeframe for full recovery was provided, and it appeared that many companies and organizations would rely on their own IT departments to restore systems.