Class Action Suit on CrowdStrike Over '24 Outage Dismissed

A federal court in Texas has dismissed a class-action lawsuit against cybersecurity giant CrowdStrike after a software outage in July 2024 caused tens of thousands of flight delays and cancellations throughout the country.

The plaintiffs in the lawsuit claimed that CrowdStrike made false and misleading statements to investors about the possibility of a major information technology outage, which it said led to more than 46,000 flight delays and 5,100 cancellations in the U.S. on July 19, 2024.

But the U.S. District Court for the Western District of Texas in Austin granted the company’s motion to dismiss the lawsuit Wednesday, Bloomberg Law reported, by ruling that travelers seeking compensation for expenses incurred by the delays, such as booking hotel rooms and new flights, are preempted by the federal Airline Deregulation Act of 1978, as they would be if travelers had sued the airlines directly.

"The Court concludes that the airlines would experience significant effects from the enforcement of state tort law in this manner on CrowdStrike, akin to federal regulation, because cybersecurity vendors would have an incentive to change their practices and services for airlines specifically," U.S. District Judge Robert Pitman, a Barack Obama appointee, wrote in an 11-page ruling.

"The vendors would, if their potential liability in case of errors in the context of airlines extended to disruptions of airline services, also likely have a strong incentive to charge more for their services to offset that risk of liability."

CrowdStrike, which is based in Austin, reportedly blamed a bug in an update that allowed its cybersecurity systems to push bad data out to 8.5 million devices globally that rely on the Microsoft Windows operating system. It set off a global tech outage that grounded thousands of flights, took TV broadcasts off air and disrupted banks, hospitals and retailers.

"We are grateful for the Court’s thoughtful consideration and decision to dismiss this case," Cathleen Anderson, CrowdStrike’s chief legal officer, said in a statement.

CrowdStrike is facing litigation elsewhere regarding the outage. Atlanta-based Delta Air Lines filed a lawsuit in Georgia state court, claiming $550 million in losses resulting from the cancellation of approximately 7,000 flights. A Georgia judge ruled May 16 that Delta can proceed with claims of gross negligence and computer trespass, though some fraud claims were dismissed.

And Pitman is overseeing a class-action lawsuit filed by investors, led by the Plymouth County Retirement Association of Massachusetts and the New York State Common Retirement Fund, in August 2024. It alleged that CrowdStrike misled investors about the adequacy of its Falcon software testing, leading to a 32% drop in share price following the outage. CrowdStrike sought to dismiss this case in April, and the plaintiffs responded in May, but no action has since been taken.