A failed update from CrowdStrike has led to massive IT outages at numerous companies and institutions, which now wish to take legal action against the cybersecurity provider. Particularly affected was the University Medical Center Schleswig-Holstein (UKSH), where significant IT outages severely disrupted hospital operations. Patients could neither check in nor out, information boards and signs failed, and around 70 surgeries had to be canceled at the Kiel campus. UKSH CEO Jens Scholz stated according to Golem.de: "We have had to cancel more surgeries than we feared." Additionally, emergency rooms were non-operational for several hours, requiring emergency patients to be treated in surrounding clinics. The hospital management now plans to seek compensation to offset the financial losses and non-material damages.
The Zurich Airport was also affected by the faulty update, which led to delays and flight cancellations on July 19. The Swiss air traffic control service, Skyguide, was particularly impacted, and according to Matthias Stürmer, Professor for Digitalization at the Bern University of Applied Sciences, it was poorly prepared for such incidents. However, Stürmer is skeptical about Skyguide filing a lawsuit, as CrowdStrike's general terms and conditions state that the software should not be used for critical applications such as air traffic control. Skyguide had to agree to these terms to use the software, which weakens its legal position.
The IT glitch at CrowdStrike had far-reaching consequences and highlights the risks associated with using cybersecurity software. Companies and institutions now face the challenge of addressing the damages incurred and rethinking their IT security strategies.