78 minutes of error, five days of outage: what CrowdStrike and Delta teach about recovering

The error lasted 78 minutes and belonged to another company. The recovery lasted from one to five days, and that part belonged to each company. On July 19, 2024, the same failure hit several airlines in the United States. By the following Monday, most of them were operating almost normally. Delta Air Lines canceled about 7,000 flights in five days.

Why did the same failure cost some a weekend and another one five days? That question is still open, and Delta and CrowdStrike are fighting over it in court. Delta says it depended on the affected technology more than anyone; CrowdStrike says that what dragged out the recovery was Delta's own response and infrastructure. This article does not settle that lawsuit. What the case does teach any company, whoever wins, is that how long it takes to come back is decided largely before the failure, by what was left prepared.

This is the documented story, hour by hour, with what each party says: Delta and CrowdStrike, which sued each other, and Microsoft, which answered by letter. At the end, what it teaches any company that depends on its systems, which today is almost all of them.

Thursday, 10:09 at night in Mexico City

CrowdStrike sells a security program called Falcon. Its sensor is installed on the computers and servers the client company wants to protect, and it watches what happens inside the operating system to detect attacks. To recognize new techniques, it frequently receives small content updates: they do not change the program, they only teach it what to look for.

On Friday, July 19, 2024, at 04:09 Coordinated Universal Time (UTC), CrowdStrike published one of those updates for Windows machines [1]. On the East Coast of the United States it was 12:09 in the morning [8]. In Mexico City, it was 10:09 on Thursday night.

The update carried two new templates for watching how programs communicate with each other inside Windows. One of them asked to check a piece of data nobody had checked before. The root cause analysis CrowdStrike published on August 6 explains it this way: that type of template, created in February 2024, defined 21 input fields, but the code that ran it only handed it 20 [2]. For months nothing happened, because the tests and the earlier templates used a wildcard in field 21: "any value will do." The July 19 template was the first that actually compared against that field [2].

The program tried to read data item number 21 outside the memory set aside for the 20 it received, and Windows stopped [1][2]. The tool that was supposed to validate the content before sending it had its own error and let it through [1]. What followed was seen by millions of people: the blue screen.

At 05:27 UTC, 78 minutes later, CrowdStrike pulled the update [1]. Machines that connected afterward no longer received it. But the ones that had received it could not download the corrected version, because they crashed before they finished booting.

Friday: 8.5 million blue screens

The next day, Microsoft estimated the reach: 8.5 million Windows devices, "less than one percent of all Windows machines" [3]. It was small as a percentage and enormous in consequences. Microsoft explained it this way: the economic and societal impact reflected that CrowdStrike is used by enterprises that run many critical services [3]. Airlines were among them.

The fix had existed since the early morning. The hard part was applying it. Microsoft's instructions called for, machine by machine, booting into safe mode from the recovery screen, going into the CrowdStrike folder, deleting the C-00000291*.sys files and restarting [4]. And there was a detail that turned minutes into hours: on machines whose disk was encrypted with BitLocker, Windows' encryption tool, that boot could ask for the recovery key [4][5]. A long key, different for each machine, that someone had to have stored somewhere reachable while everything else was down.

In other words, on many machines the repair required someone to be physically in front of it. Microsoft later published a USB-stick tool to automate part of the fix, but it also had to be plugged in machine by machine [4]. Delta would allege in its lawsuit that, in its case, the machines "had to be remediated manually one at a time and could not be fixed remotely" [9]. Its CEO, Ed Bastian, told CNBC that the airline had to manually reset 40,000 servers [10].

CrowdStrike reported a fast recovery across its customer base: more than 97% of Windows sensors were back online on July 24 and around 99% on July 29, compared with the previous week [5][2]. The overall figures looked good. But the average hid whoever was not getting back up.

Saturday and Sunday: some get back up, one does not

Airlines live off a puzzle that is put together every day: which plane goes on which route, which pilot and which crew fly each flight, and whether each person meets the rest hours the law requires. If the system that puts that puzzle together stops, the planes can be ready and still not take off, because nobody knows for sure who is where.

Several of the affected airlines canceled flights on Friday. What matters is what happened next. According to the Associated Press (AP) tally of Monday, July 22, United, the second hardest hit, had canceled nearly 1,500 flights since Friday, but that Monday, by mid-morning, it had canceled only 17. American, Spirit, Frontier and Allegiant were almost back to normal. Southwest and Alaska, which do not use CrowdStrike, had few cancellations [11].

Delta, by contrast, had more than 5,500 flights canceled since Friday, and on Monday it canceled at least 700 more. That day, Delta and its regional airlines accounted for about two-thirds of all cancellations worldwide, "including nearly all the ones in the United States" [11].

Monday: the system that could not catch up

What was failing, if the computers were already being repaired? Delta explained it in those days in its own words.

Bastian wrote to customers that one of its crew-tracking tools had been affected and could not process the enormous volume of changes the outage triggered. With full planes in the middle of summer, loads above 90%, that was "limiting our re-accommodation capabilities" [11]. He told employees it would take "another couple of days" before "the worst is clearly behind us" [11].

Delta's chief information officer, Rahul Samant, was more precise. According to AP, he said the two hardest applications to bring back were the one that manages traffic at the Atlanta airport, its main hub, and the one that assigns pilots and flight attendants to flights. The latter was already running, "but we have a catch-up to do"; and, according to AP, Samant said new issues kept arising [11].

That is the heart of the case. Computers can be repaired one by one. But a system that coordinates thousands of people does not return to normal just by being switched on: it has to absorb all the changes that piled up while it was down, and every canceled flight generates more changes. It is a line that grows while you are trying to empty it.

Tuesday: the regulator arrives

On Tuesday, July 23, the United States Department of Transportation (DOT) opened an investigation into Delta. According to AP, the department said it launched the investigation after seeing Delta's continued widespread flight disruptions "and reports of concerning customer service failures" [12]. Transportation Secretary Pete Buttigieg had already spoken with Bastian and said his agency had received "hundreds of complaints" [11].

On Wednesday the 24th, at 7:45 in the morning, Bastian published a new letter to customers: delays and cancellations on Tuesday were down 50% compared with Monday, he expected minimal cancellations on Wednesday and a normal Thursday. He offered miles and travel vouchers "as a further gesture of apology" [13].

By July 31, Bastian told CNBC that over the previous seven days Delta had had fewer than 100 cancellations out of more than 30,000 flights [10]. The operation was back. The cost was only beginning to be counted.

The bill

In its August 8 filing with the securities regulator, Delta put down the figures: about 7,000 cancellations in five days [6]. A direct revenue impact of 380 million dollars, mainly from refunds and compensation in cash and miles, and 170 million in additional expense, mainly reimbursements of customer expenses and crew costs. On the other hand, because of the flights that did not fly, it spent about 50 million less on fuel [6]. Net, about 500 million dollars.

"An operational disruption of this length and magnitude is unacceptable, and our customers and employees deserve better," Bastian said in that same filing [6]. The people affected numbered more than a million, according to Delta's lawsuit [9]; 1.3 million, according to Reuters [7].

Three versions of the same crash

From here on, the story becomes a dispute. It is worth reading it for what it is: three parties with lawyers, each telling its own version, but a single lawsuit between two parties. Delta and CrowdStrike sued each other on the same day, each in a different court. Microsoft answered by letter, and it is not a party to those lawsuits. What follows is taken from their own letters and lawsuits.

Delta's version. On July 29, its lawyer, David Boies, sent CrowdStrike a letter raising complaints about the incident and threatening it with legal claims [14]. Two days later, on July 31, Bastian told CNBC: "You can't come into a mission-critical 24/7 operation and tell us we have a bug" [10]. He explained why Delta suffered more: "We're by far the heaviest in the industry with both [Microsoft and CrowdStrike], and so we got hit the hardest in terms of the recovery capability" [10]. Months later, in its lawsuit, filed on October 25, 2024 in the state court of Fulton County, Georgia, Delta maintains that it did not have automatic updates enabled and that the update reached it anyway, and that "If CrowdStrike had tested the Faulty Update on even one computer before deployment, the computer would have crashed" [9]. It claims more than 500 million dollars for computer trespass, breach of contract and gross negligence, among other counts [9].

CrowdStrike's version. Its lawyer, Michael Carlinsky, replied to that letter on August 4. According to his letter, hours after the incident CrowdStrike offered Delta help; its CEO offered on-site staff to Delta's CEO and "received no response"; on following up, it was told that "the onsite resources were not needed" [14]. He asked Delta to explain "Why Delta's competitors, facing similar challenges, all restored operations much faster," and warned that its liability is "contractually capped at an amount in the single-digit millions" [14]. In its own lawsuit, filed that same October 25 in federal court, CrowdStrike alleges that other major airlines returned to near-normal operations on July 20, and that it was "Delta's own response and IT infrastructure" that dragged out its recovery [8].

Microsoft's version. Delta had announced that it would also pursue claims against Microsoft [6], and Microsoft did not stay quiet. Its lawyer, Mark Cheffo, wrote on August 6, as reported by CNBC and NBC News. The letter says that Microsoft offered help free of charge every day from July 19 to 23 and that Delta declined it; that a Delta employee replied on July 22 "All good…"; that Microsoft's CEO, Satya Nadella, wrote to Bastian on July 24 and got no answer; and that the crew-tracking system did not run on Windows or Azure, but was serviced by "other technology providers, such as IBM." It concluded: "Delta, unlike its competitors, apparently has not modernized its IT infrastructure" [15].

Delta's rebuttal. The airline replied that since 2016 it has invested "billions of dollars" in systems [15]. Boies wrote again on August 8: "There is no basis — none — to suggest that Delta was in any way responsible for the faulty software" [16]. According to the trade publication Skift, Delta also maintains that the offer of on-site help came when it had already restored most of its critical systems [16].

Where it all stands

More than two years after the outage, the lawsuit between Delta and CrowdStrike is still open.

In May 2025, Judge Kelly Lee Ellerbe, of the Fulton County court, dismissed Delta's claims of intentional misrepresentation and fraud by omission, but let the negligence claims proceed, including the gross negligence theory, along with the computer trespass claim [17]. CrowdStrike's lawyer said at the time that the worst-case scenario for his client would be a payment in the "single-digit millions" [17]. In its quarterly report to the securities regulator in August 2026, CrowdStrike reported that Delta's lawsuit in Fulton County was still in the discovery stage, in which the parties request and exchange evidence before trial [18]. In other words, there was still no trial and no ruling.

The regulator has already closed its part. According to Reuters, which picked up a Politico story, the DOT closed the investigation without a fine. The decision was made in November of the previous year and became known in June 2026. A spokesperson said the review found that Delta's passengers received "prompt refunds, adequate baggage assistance" and appropriate assistance for passengers with disabilities [7].

Who should pay how much will be decided by a court. This article takes no side on that. What we can do is look at what is not in dispute and ask what it teaches.

What this case teaches

1. The error was someone else's; the recovery was your own

None of the three versions disputes the basics: the failure was introduced by a vendor, and it reached many companies at once. What varied was how long each one took to come back. CrowdStrike can answer for its error in court. But the days the operation took were paid for by the passengers and by the airline itself, and nobody gives that time back. Delta claims 500 million; CrowdStrike says its contract limits what it would pay to less than ten. Whatever the outcome, the contract with the vendor is no substitute for the ability to get back up.

The question for a committee is not "what if our vendor fails?" It is: when it fails, how long do we take?

2. You cannot repair what you have not inventoried

To repair by hand, one by one, the 40,000 servers Bastian said Delta had to reset [9][10], you first need to know which ones they are, where they are, who can get into each one and in what order it makes sense to bring them up. And for those with an encrypted disk, where each one's key is [4][5]. If those keys live in a system that also went down, the recovery stops before it starts.

An inventory that is useful in an emergency is not a sheet with server names. It says what each machine does, what it depends on, who looks after it, how you get in when the network or the user directory is not responding, and what comes up first. It is written in calm and kept where it can be consulted with everything else switched off.

3. What you recover last is not the computers

The case shows it clearly: Delta's computers were gradually repaired, and it still kept canceling flights. According to Delta itself, the system that assigns crews had to absorb a mountain of accumulated changes [11]. In its version, the bottleneck was a business system, not a machine.

That is why a recovery plan does not end at "the server turns on now." It has to answer which business systems come back first, how long they take to catch up with what piled up, what is done by hand in the meantime and who decides which operations are suspended so the line stops growing.

4. A procedure that was never rehearsed is a hypothesis

In the August 4 letter, CrowdStrike asked Delta to preserve, among other things, its backup, recovery and continuity plans, "and any related testing of those plans" [14]. We do not know what Delta had written down or what it had rehearsed; that is exactly what the trial may reveal. But the lawyer's question is the right one for any company: having the plan is not enough; what matters is when it was last tested and how long it took.

A rehearsal uncovers what the paper does not say: the recovery key nobody can find, the access that depends on the same system that is down, the step only one person knows how to do.

5. A team that already knows the procedure

Repairing thousands of machines by hand takes many hands that know exactly what to do, with clear instructions and no improvising. In an emergency, every person who has to learn the procedure that day is lost time. The teams that recover fast are not necessarily the biggest, but the ones that already know who does what.

6. Decide in advance who comes in to help

CrowdStrike and Microsoft say they offered help and that Delta declined it; Delta says the help came late [14][15][16]. Whoever is right, the episode leaves a practical lesson: in the middle of a crisis, accepting outside help means granting access, explaining the environment and coordinating new people, and that takes time. That decision is best made in advance: who can come in, with what access, who coordinates it and when it is activated.

Five questions for your next committee

1. If tomorrow a vendor knocks out half of our computers, how long do we take to come back? Do we know because we measured it or because we assume it?
2. Do we have an inventory that works with everything switched off? Which machines, what they depend on, how you get in and in what order they come up.
3. Where are the recovery keys for the encrypted disks, and can they be consulted if the user directory is down?
4. Which business system would be our "crew system"? The one that, even when the machines come back, takes days to catch up.
5. When did we last rehearse the recovery, who took part and what failed?

If two or more answers are "I don't know," the risk is not in the vendor: it is in what is still left to prepare.

Where to start this week

It does not take a big project. Choose one critical system, the one it would hurt most to have stopped for a day, and ask your team for three things in writing: the list of machines it depends on, the steps to bring it up from scratch if nothing else works, and the name of who carries them out. Then ask them to follow those steps in a test environment, with a stopwatch. However long it takes, and whatever is missing from the paper, is your starting point.

What Hábil does: how we can help you

Hábil did not take part in the CrowdStrike incident or in Delta's recovery. What follows is what we do, in general, for two moments: the day of the outage and the months before.

When something critical goes down, our SWAT Team comes in with a method: first it contains the damage and stabilizes what is down, then it finds out what happened and since when, fixes the root cause and restores the operation step by step, so as not to create another problem. When it is done, it hands you a technical report with the evidence: what was found, what was done, how it was verified and what remains on your side. We work with your team, not in its place, in the cloud or in your data center.

And before the emergency, with Infrastructure provisioning we help you leave a solid, documented foundation, so that the day something fails your team knows what to bring up first and how.

The first conversation is at no cost: its goal is to pinpoint which system it would hurt you most to lose, what you have today to bring it back up and what is missing. Write to us on WhatsApp.

Frequently asked questions

Was it a cyberattack?

No. Delta, CrowdStrike and Microsoft treat it as a faulty update. CrowdStrike's analysis describes a programming and validation error in its own content, not an intrusion [1][2].

Why was it not fixed remotely, if the error was corrected in 78 minutes?

Because the affected machines crashed before they finished booting and could not download the fix in time. On many, the repair required being in front of the machine: booting into safe mode, deleting a file and, on encrypted disks, entering a recovery key [4][5]. Delta alleges that in its case there was no way to do it remotely [9].

Why did Delta take longer than other airlines?

That is exactly what is in dispute. Delta says it depended on the affected technology more than anyone and that its crew system could not handle the volume of changes [10][11]. CrowdStrike and Microsoft attribute the slowness to Delta's infrastructure and response [8][15]. A court will decide.

Is my company at risk if it does not use CrowdStrike?

Any company that receives automatic updates from a vendor, whether for security, the operating system or an application, depends on that update going out right. The useful question is not which vendor you use, but how long it would take you to recover if an update fails.

Doesn't the contract with the vendor protect me?

It can give you a right to claim, but it does not give you back your operation. In this case, CrowdStrike maintains that its liability is contractually limited to an amount in the single-digit millions of dollars, against the more than 500 million Delta is claiming [9][14].

What is the first thing worth preparing?

An inventory of one critical system that can be consulted with everything switched off, a recovery procedure written down and rehearsed with a stopwatch, and the names of who carries it out.

Quotes are given in their original English. The versions of Delta, CrowdStrike and Microsoft are what each party states in its letters and lawsuits, not proven facts. Status of the proceedings according to CrowdStrike's latest quarterly report (August 2026), reviewed on October 21, 2026.