CrowdStrike’s 78-minute file crashed 8.5 million PCs; RBI counted 10 lenders hit

01One field short: how a content file became a boot loop

Falcon receives two kinds of update. Sensor code changes slowly and customers can hold it at an older version. “Rapid Response Content” changes daily, describes behaviour to watch for, and in July 2024 reached every sensor at once. With sensor 7.11 in February 2024, CrowdStrike added a template for watching Windows named pipes. The template definition declared 21 input fields; the sensor code supplied 20. Earlier content used a wildcard for the 21st field, so nothing ever read it.²

On 19 July two new template instances shipped as Channel File 291. One used a real value in the 21st field. The sensor read past the end of its input array and the machine crashed to a blue screen; machines that could not stay up long enough to receive the corrected file kept crashing until someone removed it.²⁴ Linux and macOS sensors do not use Channel File 291 and were unaffected.¹

Why did content skip the staging that code went through? Because speed is what the customer pays for. Rapid Response Content exists so that a technique seen at one customer in the morning is detected at every customer by the afternoon, without waiting for a sensor release. Staging content in rings slows exactly that. Before July 2024 the trade-off was made by the vendor, for everyone, and the report’s sixth finding is a plain admission that it was made the wrong way: “Each Template Instance should be deployed in a staged rollout.”²

The last step is where the hours went. CERT-In’s critical advisory the same day gave the manual workaround,⁴ and Microsoft’s support note warned that the machine may ask for its BitLocker recovery key.⁵ A company whose recovery keys sat on a server that had itself crashed had a second outage inside the first.

02What it cost: US$5.4 billion for 125 companies alone

Microsoft estimated 8.5 million Windows devices were affected, under 1% of all Windows machines.³ Small as a share, the machines were concentrated where Windows fleets are large and run around the clock: hospitals, banks, airlines. Parametrix, which sells cloud-outage insurance, modelled the direct loss to the US Fortune 500 excluding Microsoft at US$5.4 billion, spread over a quarter of the list, 125 companies. Every one of the six airlines on the list was hit.⁶

The shape of the loss matters more than the total. Parametrix found that healthcare and banking took 57% of the loss while earning 20% of Fortune 500 revenue, and that the average airline lost US$143 million against a US$44 million average across all affected companies and US$6 million in manufacturing.⁶ The pattern is not about who ran CrowdStrike. It is about who runs customer-facing Windows terminals that must be up at a fixed hour: a ward, a branch counter, a check-in desk. That is our reading of the numbers, not Parametrix’s, but manufacturing at US$6 million a company is hard to explain any other way.

The insurance figure is the one to take to a board. An outage caused by a supplier’s bug, with no attacker, sits awkwardly in most cyber policies. If your continuity plan assumes the policy pays for a day of lost trading, read the system-failure clause before the next renewal.

03India: ten lenders and hand-written boarding passes

The Reserve Bank’s assessment, published the same day, found that most banks keep critical systems off the cloud and that few use the CrowdStrike tool. Ten banks and NBFCs had minor disruption, resolved or being resolved; the RBI told its regulated entities to stay alert to operational resilience.⁷ The National Informatics Centre was not affected. The visible damage was at airports: Akasa moved to manual check-in and boarding, and IndiGo issued hand-written boarding passes.⁸

04What changed: rings for content, and a dial for the customer

CrowdStrike’s root-cause report committed to fixes with dates: a compile-time check on input counts in production from 27 July 2024, a runtime bounds check backported to every Windows sensor from 7.11 by 9 August, new content-validator checks by 19 August, two independent code reviews, and staged deployment for content, promoted ring by ring after canary testing.² The change that matters to a buyer is the last item on its list: customers can now choose where and when Rapid Response Content is deployed.

Microsoft moved too. In June 2025 it said it would give antivirus partners a private preview of a Windows endpoint security platform the following month, so that security products could run in user mode “just as apps do”, and that Quick Machine Recovery, which pushes fixes to PCs that cannot boot, would reach general availability that summer.⁹ Those are announcements, and we have not seen a date for kernel-free Falcon.

The customer control cuts both ways, and this is the part most buyers skip. Put every machine on the earliest content ring and you have the pre-2024 risk back. Put every machine on the latest and you receive new detections hours after your peers, which is a real cost during an active campaign. The sensible answer is a small canary group of ordinary office PCs on the earliest ring, the bulk of the fleet behind it, and the systems that must not stop (branch terminals, check-in desks, servers that hold recovery keys) last. That is a decision for the customer’s change board, written down, not a default left in a console.

Customers did not leave. The company reported US$5.25 billion of ending annual recurring revenue for the year to 31 January 2026, with more than US$1 billion of it added in that year.¹⁰ Whatever the outage did to CrowdStrike’s reputation, it did not move most buyers to a competitor, which is itself an argument for asking every vendor the same questions rather than switching away from one.