Delta Air Lines is taking decisive legal steps to seek compensation from CrowdStrike and Microsoft after a significant software outage on July 19, 2024, which led to the cancellation of around 6,000 flights. The incident has potentially cost Delta between $350 million and $500 million due to lost earnings, reputational damage, and the need to refund tickets.
In response to the crisis, Delta has enlisted the services of prominent attorney David Boies. Boies is known for representing high-profile clients, including Elizabeth Holmes, Al Gore during the 2000 presidential election, and the U.S. government in a landmark antitrust case against Microsoft in 1998. His involvement underscores Delta’s serious intent to recover damages from both CrowdStrike and Microsoft.
The fallout from the outage had immediate effects on the stock market. While Delta’s stock remained relatively stable, CrowdStrike’s stock fell by 5.5% in after-hours trading. This decline came in the wake of revelations that a defective software update from CrowdStrike had caused widespread disruption, resulting in the shutdown of numerous Microsoft computer systems globally.
Despite the severity of the incident, legal experts suggest that Delta may face significant hurdles in securing substantial compensation from CrowdStrike. The terms and conditions of CrowdStrike’s services limit their liability to the cost of the software, potentially restricting their financial responsibility to issuing refunds rather than covering the broader damages or lost revenue experienced by Delta. Elizabeth Burgin Waller, chair of the Cybersecurity & Data Privacy practice at Woods Rogers, explained that CrowdStrike’s Falcon security software terms cap liability to “fees paid,” making it unlikely that Delta could claim extensive compensation.
Additionally, the possibility of class action lawsuits from individuals affected by the outage looms on the horizon. However, Mauricio Sanchez, a senior director at tech market research firm Dell’Oro Group, predicts that CrowdStrike may not face significant financial penalties. Sanchez cited a recent case involving SolarWinds, where a U.S. judge dismissed most of a Securities and Exchange Commission lawsuit related to a major hacking incident. This precedent suggests that large customers like Delta might struggle to win substantial compensation in court.
Moreover, Andrew Selbst, an assistant professor at UCLA School of Law, noted that negligence lawsuits, though common in such scenarios, are challenging to win. Selbst also pointed out the potential for regulatory action from the Federal Trade Commission (FTC). The FTC’s involvement typically results in fines payable to the federal government rather than compensation for individual customers. “The FTC has a pattern of settling with these companies and keeping them under a consent decree for 20 years or so,” Selbst said. “But with the FTC, you don’t get individual customers receiving damages or compensation. This is just a regulatory regime, and they receive fines payable to the federal government.”
Delta’s decision to pursue legal action highlights the broader challenges companies face in dealing with significant software outages and the limitations of liability agreements in securing financial redress. As the situation unfolds, it will be crucial to observe how the legal proceedings impact both Delta and the implicated tech firms, potentially setting precedents for future cases of this nature.
The Delta incident underscores the critical importance of robust cybersecurity measures and the complexities of navigating legal and financial responsibilities when things go awry. It also serves as a reminder of the intricate and often contentious relationship between large corporations and their technology providers, especially in an era where digital infrastructure is paramount to business operations.