---
title: "CrowdStrike’s 78-minute file crashed 8.5 million PCs; RBI counted 10 lenders hit"
summary: "The 19 July 2024 outage from CrowdStrike’s root-cause report, Microsoft, Parametrix, the RBI and CERT-In: what broke, what it cost, what changed, as of September 2026."
url: https://www.thetechbag.com/blog/crowdstrike-update-triggers-global-it-meltdown-happened
format: Analysis
desk: "SaaS & business software"
published: 2026-04-07
facts_checked: 2026-09-30
author: TechBag (The TechBag Journal)
tags: ["CrowdStrike","Falcon","outage","Channel File 291","Microsoft","Windows","RBI","CERT-In","Parametrix","business continuity","SEBI CSCRF","DPDP"]
cover: https://www.thetechbag.com/blog/covers/crowdstrike-update-triggers-global-it-meltdown-happened.png
---

# CrowdStrike’s 78-minute file crashed 8.5 million PCs; RBI counted 10 lenders hit

*The 19 July 2024 outage from CrowdStrike’s root-cause report, Microsoft, Parametrix, the RBI and CERT-In: what broke, what it cost, what changed, as of September 2026.*

Analysis · SaaS & business software · By TechBag · Published 2026-04-07 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/crowdstrike-update-triggers-global-it-meltdown-happened

The short version

- A CrowdStrike content file, live for 78 minutes on 19 July 2024, crashed about 8.5 million Windows machines because the sensor handed its interpreter 20 inputs where the file expected 21.[2][3]
- It was a bug, not a breach. Parametrix put the direct loss to the US Fortune 500 alone at US$5.4 billion; India’s regulator counted 10 banks and NBFCs with minor disruption.[6][7]
- What changed is the release process: staged rings for content, and customer control over when it lands. That control is now a setting every Falcon buyer should own, not leave on default.

The original post asked what happened. Two years on, the better question for an Indian IT team is narrower: what exactly failed, how much of it was CrowdStrike’s alone, and what should a buyer of any endpoint agent now ask for in writing? Every security agent that runs in the Windows kernel can, in principle, do what Falcon did that Friday. The documents published since tell you which controls stop it.

## One field short: how a content file became a boot loop

Falcon receives two kinds of update. Sensor code changes slowly and customers can hold it at an older version. “Rapid Response Content” changes daily, describes behaviour to watch for, and in July 2024 reached every sensor at once. With sensor 7.11 in February 2024, CrowdStrike added a template for watching Windows named pipes. The template definition declared 21 input fields; the sensor code supplied 20. Earlier content used a wildcard for the 21st field, so nothing ever read it.[2]

On 19 July two new template instances shipped as Channel File 291. One used a real value in the 21st field. The sensor read past the end of its input array and the machine crashed to a blue screen; machines that could not stay up long enough to receive the corrected file kept crashing until someone removed it.[2][4] Linux and macOS sensors do not use Channel File 291 and were unaffected.[1]

Why did content skip the staging that code went through? Because speed is what the customer pays for. Rapid Response Content exists so that a technique seen at one customer in the morning is detected at every customer by the afternoon, without waiting for a sensor release. Staging content in rings slows exactly that. Before July 2024 the trade-off was made by the vendor, for everyone, and the report’s sixth finding is a plain admission that it was made the wrong way: “Each Template Instance should be deployed in a staged rollout.”[2]

**Figure: The faulty file was live for 78 minutes; undoing it took a person at every machine**

*Channel File 291 incident, 19 July 2024, times in UTC with IST*

1. 0104:09 UTC (09:39 IST)Channel File 291 ships to Windows sensors 7.11 and later that are online.
2. 0221 expected, 20 suppliedThe content interpreter reads a 21st input that does not exist: an out-of-bounds read, then a crash at boot.
3. 0305:27 UTC (10:57 IST)CrowdStrike reverts the file. Machines that crashed cannot stay up long enough to receive the fix.
4. 04By hand, per machineSafe Mode or Recovery Environment, delete C-00000291*.sys, reboot; a BitLocker key may be asked for.

Source: CrowdStrike technical details and root-cause analysis; CERT-In CIAD-2024-0035; Microsoft KB5042421 · as of 6 August 2024

ReportedCrowdStrike’s own count, 6 August 2024

By 29 July, comparing week on week, about 99% of Windows sensors were back online. The root-cause report lists six findings, from the unvalidated field count to the absence of staged deployment for content.[2]

The last step is where the hours went. CERT-In’s critical advisory the same day gave the manual workaround,[4] and Microsoft’s support note warned that the machine may ask for its BitLocker recovery key.[5] A company whose recovery keys sat on a server that had itself crashed had a second outage inside the first.

## What it cost: US$5.4 billion for 125 companies alone

Microsoft estimated 8.5 million Windows devices were affected, under 1% of all Windows machines.[3] Small as a share, the machines were concentrated where Windows fleets are large and run around the clock: hospitals, banks, airlines. Parametrix, which sells cloud-outage insurance, modelled the direct loss to the US Fortune 500 excluding Microsoft at US$5.4 billion, spread over a quarter of the list, 125 companies. Every one of the six airlines on the list was hit.[6]

**Figure: Healthcare and banking carried more than half of the Fortune 500’s US$5.4 billion loss**

*Estimated direct financial loss to US Fortune 500 companies (excluding Microsoft) by sector, US$ million, 19 July 2024 outage*

- Healthcare1,938 US$ m 36%
- Banking1,149 US$ m 21%
- Airlines (six companies)860 US$ m 16%
- All other sectors1,453 US$ m 27%

|  | Value (US$ m) | Share |
| --- | --- | --- |
| Healthcare | 1,938 | 36% |
| Banking | 1,149 | 21% |
| Airlines (six companies) | 860 | 16% |
| All other sectors | 1,453 | 27% |

Source: Parametrix estimate; Other is TechBag's subtraction · as of 24 July 2024 · A model estimate, not reported losses

TechBag countHow the last slice was counted

Parametrix publishes the total and three sector figures. TechBag subtracted the three (US$3,947 million) from US$5,400 million to get the US$1,453 million shown as all other sectors. Parametrix also estimated that cyber insurance would cover only 10% to 20% of the loss.[6]

The shape of the loss matters more than the total. Parametrix found that healthcare and banking took 57% of the loss while earning 20% of Fortune 500 revenue, and that the average airline lost US$143 million against a US$44 million average across all affected companies and US$6 million in manufacturing.[6] The pattern is not about who ran CrowdStrike. It is about who runs customer-facing Windows terminals that must be up at a fixed hour: a ward, a branch counter, a check-in desk. That is our reading of the numbers, not Parametrix’s, but manufacturing at US$6 million a company is hard to explain any other way.

The insurance figure is the one to take to a board. An outage caused by a supplier’s bug, with no attacker, sits awkwardly in most cyber policies. If your continuity plan assumes the policy pays for a day of lost trading, read the system-failure clause before the next renewal.

## India: ten lenders and hand-written boarding passes

The Reserve Bank’s assessment, published the same day, found that most banks keep critical systems off the cloud and that few use the CrowdStrike tool. Ten banks and NBFCs had minor disruption, resolved or being resolved; the RBI told its regulated entities to stay alert to operational resilience.[7] The National Informatics Centre was not affected. The visible damage was at airports: Akasa moved to manual check-in and boarding, and IndiGo issued hand-written boarding passes.[8]

**Figure: India’s count was small because few critical Indian systems ran the agent**

*Indian regulator and CERT-In figures on the 19 July 2024 outage*

10

Banks and NBFCs with minor disruption

RBI, 19 July 2024

78 min

Window in which the bad file reached sensors, 09:39 to 10:57 IST

CERT-In CIAD-2024-0035

Critical

CERT-In’s severity rating for the advisory

CERT-In, 19 July 2024

Source: RBI press release 2024-2025/739; CERT-In CIAD-2024-0035; ThePrint · as of 19 July 2024

Our view

Our view: India’s small number is a fact about adoption in 2024, not a fact about resilience. A bank that standardises on any one kernel-level agent across every branch PC carries the same exposure the American hospitals did. The protection was diversity, and diversity is disappearing as Indian buyers consolidate on fewer platforms.

## What changed: rings for content, and a dial for the customer

CrowdStrike’s root-cause report committed to fixes with dates: a compile-time check on input counts in production from 27 July 2024, a runtime bounds check backported to every Windows sensor from 7.11 by 9 August, new content-validator checks by 19 August, two independent code reviews, and staged deployment for content, promoted ring by ring after canary testing.[2] The change that matters to a buyer is the last item on its list: customers can now choose where and when Rapid Response Content is deployed.

Microsoft moved too. In June 2025 it said it would give antivirus partners a private preview of a Windows endpoint security platform the following month, so that security products could run in user mode “just as apps do”, and that Quick Machine Recovery, which pushes fixes to PCs that cannot boot, would reach general availability that summer.[9] Those are announcements, and we have not seen a date for kernel-free Falcon.

The customer control cuts both ways, and this is the part most buyers skip. Put every machine on the earliest content ring and you have the pre-2024 risk back. Put every machine on the latest and you receive new detections hours after your peers, which is a real cost during an active campaign. The sensible answer is a small canary group of ordinary office PCs on the earliest ring, the bulk of the fleet behind it, and the systems that must not stop (branch terminals, check-in desks, servers that hold recovery keys) last. That is a decision for the customer’s change board, written down, not a default left in a console.

**Figure: The fixes moved control from the vendor’s release desk to the customer’s policy**

*How Falcon content and Windows recovery worked before 19 July 2024 and what was committed after, to June 2025*

Before 19 July 2024

- Rapid Response Content went to every sensor at once
- Customers could hold sensor versions, not content
- Input counts checked by tests that used wildcards
- A PC that could not boot needed a person in front of it

Committed since

- Canary, then rings with bake-in time, for every template instance
- Customers choose where and when content deploys
- Compile-time and runtime checks on input counts
- Windows Quick Machine Recovery; security agents in user mode, in preview

Source: CrowdStrike root-cause analysis; Microsoft Windows Resiliency Initiative · as of 26 June 2025

Customers did not leave. The company reported US$5.25 billion of ending annual recurring revenue for the year to 31 January 2026, with more than US$1 billion of it added in that year.[10] Whatever the outage did to CrowdStrike’s reputation, it did not move most buyers to a competitor, which is itself an argument for asking every vendor the same questions rather than switching away from one.

If you are buying this in India

Falcon lists in US dollars: Falcon Go at US$59.99, Pro at US$99.99 and Enterprise at US$184.99 a device a year.[11] In India you buy through a reseller in rupees, with 18% GST on the invoice. TechBag is an authorised CrowdStrike partner and earns a margin on Falcon; weigh this piece with that in mind. Whichever agent you buy, put three things in the order: the content-deployment policy (which machines get new content first, and how long the rest wait), the sensor version policy (we would hold servers one version behind), and where your BitLocker or other disk-encryption recovery keys live, on a system that does not run the same agent.

The rules that bite are dated. CERT-In’s Directions of 28 April 2022 require reportable cyber incidents to reach CERT-In within six hours.[12] SEBI’s Cybersecurity and Cyber Resilience Framework, in force for regulated entities since 31 August 2025, makes recovery planning and drills an obligation for those entities, not a choice.[13] The DPDP Rules were notified on 13 November 2025, with the security-safeguard duties applying from 13 May 2027.[14] An availability failure that stops you serving customers’ data is a resilience question under all three.

How we did this

Figures as of 30 September 2026

The mechanism, times and remediation dates come from CrowdStrike’s technical post of 20 July 2024 and its root-cause analysis dated 6 August 2024, cross-checked against CERT-In advisory CIAD-2024-0035. IST times are the UTC times plus five and a half hours. The device count is Microsoft’s estimate. The loss chart is Parametrix’s model, not reported losses; the “all other sectors” slice is TechBag’s subtraction. Indian figures are the RBI’s own release; no count of affected flights is given because we could not read a primary source for one. Our earlier version could not be retrieved, so this piece answers its title, not its text.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CrowdStrike, Technical Details: Falcon Content Update for Windows Hosts](https://www.crowdstrike.com/en-us/blog/falcon-update-for-windows-hosts-technical-details/) — 20 July 2024
2. [CrowdStrike, External Technical Root Cause Analysis: Channel File 291](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf) — 6 August 2024
3. [Microsoft, Helping our customers through the CrowdStrike outage (about 8.5 million devices, under 1% of Windows machines)](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/) — 20 July 2024
4. [CERT-In, CIAD-2024-0035: Outage of Microsoft Windows due to CrowdStrike agent Falcon Sensor update (Critical)](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0035) — 19 July 2024
5. [Microsoft Support, KB5042421: CrowdStrike issue impacting Windows endpoints (BitLocker recovery key, USB recovery tool)](https://support.microsoft.com/en-us/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f) — undated page
6. [Parametrix, CrowdStrike to cost Fortune 500 US$5.4 billion; insured loss US$0.54 to 1.08 billion](https://www.parametrixinsurance.com/in-the-news/crowdstrike-to-cost-fortune-500-5-4-billion-insured-loss-range-of-540-million-to-1-08-billion) — 24 July 2024
7. [Reserve Bank of India, press release 2024-2025/739 on the impact of the Microsoft services outage on regulated entities](https://rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=58336) — 19 July 2024
8. [ThePrint, As Microsoft outage disrupts flights, banking, business, Indian airlines switch to manual check-in](https://theprint.in/india/as-microsoft-outage-disrupts-flights-banking-business-indian-airlines-switch-to-manual-check-in/2181897) — 19 July 2024
9. [Microsoft Windows Experience Blog, The Windows Resiliency Initiative: building resilience for a future-ready enterprise](https://blogs.windows.com/windowsexperience/2025/06/26/the-windows-resiliency-initiative-building-resilience-for-a-future-ready-enterprise/) — 26 June 2025
10. [TechBag, CrowdStrike intel hub (ending ARR US$5.25 billion and net new ARR US$1.01 billion, fiscal 2026, from company reporting)](https://www.thetechbag.com/crowdstrike) — fiscal year ended 31 January 2026
11. [CrowdStrike, Falcon bundles and pricing (Go US$59.99, Pro US$99.99, Enterprise US$184.99 per device per year)](https://www.crowdstrike.com/en-us/products/bundles/) — undated page
12. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
13. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025
14. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — Rules notified 13 November 2025

Related on TechBag: the [CrowdStrike intel hub](https://www.thetechbag.com/crowdstrike) covers Falcon’s modules and pricing; the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) compares the agents you could run instead; [our note on recovery after the outage](https://www.thetechbag.com/blog/protecting-data-wake-crowdstrike-incident) covers the disaster-recovery side; and [our note on EDR rollout](https://www.thetechbag.com/blog/cybersecurity-effective-edr-implementation) covers the content-ring settings.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [CrowdStrike intel hub](https://www.thetechbag.com/crowdstrike) — Falcon modules, pricing and the July 2024 outage, addressed
- [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the agents you could run instead, by SKU