The July 19, 2024 CrowdStrike outage produced three significant lawsuits, and as of mid-2026 only one is still alive. A passenger class action was dismissed and that dismissal was affirmed on appeal. A shareholder securities fraud case brought by the New York State Comptroller was dismissed, with a narrow window to refile. Delta Air Lines’ suit for more than $500 million is the one still moving toward trial, after a Georgia state court judge let most of the airline’s claims survive CrowdStrike’s motion to dismiss.
What the Lawsuits Are About
On July 19, 2024, CrowdStrike pushed a configuration update to its Falcon platform that crashed roughly 8.5 million Windows machines worldwide and sent them into a continuous boot loop. CEO George Kurtz called it “a defect found in a single content update.”1IBM. Recent CrowdStrike Outage: What You Should Know
CrowdStrike’s own root cause analysis, published in August 2024, traced the crash to a parameter count mismatch: the update’s template defined 21 input fields, but the sensor code supplied only 20. Reading the nonexistent 21st value triggered an out-of-bounds memory read. The company’s test suite had used wildcard entries for that field, masking the defect, and a separate logic error in the content validator failed to flag it.2CrowdStrike. Channel File 291 Incident Root Cause Analysis
Airlines canceled more than 3,300 flights that first day. Hospitals postponed surgeries, banks lost ATM and call center access, and some 911 dispatch systems went offline. Because affected machines could not reboot on their own to accept a fix, IT staff had to boot each device manually into safe mode and delete the offending file.1IBM. Recent CrowdStrike Outage: What You Should Know Parametrix, a risk analytics firm, estimated that Fortune 500 companies alone suffered at least $5.4 billion in direct losses.3Cybersecurity Dive. CrowdStrike Cost Fortune 500 Losses, Cyber Insurance Most cyber insurance policies require a malicious attack to trigger coverage, so insured losses were expected to run only between $300 million and $1.5 billion.4Fortune. CrowdStrike Outage Fortune 500 Companies $5.4 Billion Damages Uninsured Losses
Out of that damage came the three lawsuits below.
Passenger Class Action: Del Rio v. CrowdStrike
Stranded travelers filed a putative class action in the U.S. District Court for the Western District of Texas, claiming negligence and seeking damages for missed connections, hotel costs, and lost wages.5Courthouse News Service. Stranded Airline Passengers Ask Fifth Circuit to Restore Damage Claims Against CrowdStrike
U.S. District Judge Robert Pitman dismissed the case on June 19, 2025, ruling that the claims were preempted by the Airline Deregulation Act of 1978. That statute bars states from enforcing laws “related to a price, route or service of an air carrier.” Judge Pitman held that suing a technology vendor instead of an airline “does not prevent ADA preemption.”6CrowdStrike. US District Court Dismisses Class Action Lawsuit Against CrowdStrike
The passengers appealed. On May 20, 2026, the Fifth Circuit affirmed the dismissal in an unpublished per curiam opinion.7CaseMine. Del Rio v. CrowdStrike, No. 25-50518 They then petitioned the full Fifth Circuit for rehearing en banc, and that petition was pending as of early June 2026.8Law360. Flyers Ask Full 5th Circ. to Rehear CrowdStrike IT Outage Suit Absent a successful rehearing petition, the consumer case is effectively over.
Shareholder Securities Fraud Suit
CrowdStrike’s stock fell roughly 45% in the 18 days after the outage, erasing more than $30 billion in market capitalization from a pre-outage price of about $343 per share.9CIO.com. Case in Point: Taking Stock of the CrowdStrike Outages Investors filed a securities fraud class action in federal court in Austin, Texas, covering a class period from September 20, 2022, through July 30, 2024.10New York State Comptroller. DiNapoli Named Lead Plaintiff in CrowdStrike Shareholder Lawsuit
New York State Comptroller Thomas DiNapoli, overseeing the New York State Common Retirement Fund, was appointed lead plaintiff. The case, In re CrowdStrike Holdings, Inc. Securities Litigation, No. 24-cv-00857-RP, named CEO George Kurtz and President Michael Sentonas as individual defendants.11CNBC. CrowdStrike Defeats Shareholder Lawsuit Over Huge Software Outage
The complaint alleged that CrowdStrike defrauded investors by touting “robust testing and quality assurance processes” that did not exist. Executives had said the company maintained a dedicated quality assurance team, released updates in slow, phased rollouts, met stringent federal security requirements including FedRAMP standards, and that the Falcon platform “doesn’t blue screen endpoints with failed updates.” Shareholders argued those statements were false because the company had prioritized speed over careful testing and pushed the faulty update to all customers at once.11CNBC. CrowdStrike Defeats Shareholder Lawsuit Over Huge Software Outage
Judge Robert Pitman dismissed the suit on January 12, 2026. He found most of the challenged statements were either immaterial puffery, taken out of context, or covered by the company’s own risk disclosures. Two statements about compliance with federal security requirements he called “questionable,” but the court held the complaint still failed to establish a “strong inference” that the executives intended to defraud anyone, the scienter standard required under the Private Securities Litigation Reform Act.11CNBC. CrowdStrike Defeats Shareholder Lawsuit Over Huge Software Outage12A&O Shearman. WDOT Dismisses Putative Securities Class Action Against Cybersecurity Company
The dismissal was without prejudice. Judge Pitman gave the plaintiffs until January 26, 2026, to petition to file an amended complaint. A spokesperson for Comptroller DiNapoli said the decision was “under review,” but as of early 2026 no amended complaint had been publicly reported.13Reuters. CrowdStrike Defeats Shareholder Lawsuit Over Huge Software Outage
Delta Air Lines v. CrowdStrike
Delta reported canceling more than 7,000 flights and losses exceeding $500 million from the outage.14Techzine. CrowdStrike Wins in Lawsuit With Shareholders Over Outage The airline sued in Georgia state court on October 25, 2024, alleging gross negligence, breach of contract, intentional misrepresentation or fraud by omission, and computer trespass. Delta’s core claim was that CrowdStrike deployed the update without testing, staging, or customer consent.15Bank Info Security. Judge Lets Delta’s Cyber Failure Suit vs. CrowdStrike Proceed
The same day Delta sued, CrowdStrike filed its own federal case in the Northern District of Georgia seeking a declaratory judgment that the parties’ services agreement governed and that its contractual liability caps applied.16CrowdStrike. US District Court Dismisses Class Action Lawsuit Against CrowdStrike CrowdStrike voluntarily dismissed that federal case in November 2024, consolidating the dispute in Georgia state court.17CourtListener. CrowdStrike, Inc. v. Delta Air Lines, Inc.
CrowdStrike’s Defenses
CrowdStrike has argued its contract with Delta limits liability and bars recovery for indirect, incidental, punitive, or consequential damages. Its counsel described the contractual cap as being “in the single-digit-millions of dollars.”15Bank Info Security. Judge Lets Delta’s Cyber Failure Suit vs. CrowdStrike Proceed The company has also argued that Delta’s own practices and outdated internal systems made the airline an “outlier” in its slow recovery compared with peers, and that Delta “repeatedly rebuffed” offers of assistance during the crisis.18CNBC. CrowdStrike Moves to Dismiss Delta Suit Citing Contract Terms
On the legal front, CrowdStrike invoked Georgia’s economic loss rule, arguing state law prevents Delta from converting what is essentially a contract dispute into tort claims for negligence and fraud.18CNBC. CrowdStrike Moves to Dismiss Delta Suit Citing Contract Terms
What the Judge Allowed to Proceed
Fulton County Superior Court Judge Kelly Lee Ellerbe issued a 45-page order in May 2025 that largely sided with Delta at this early stage. The judge allowed claims of gross negligence, computer trespass, and trespass to personalty to proceed. She also permitted fraud claims tied to the subscription services agreement and claims based on an alleged false intent to perform. She dismissed only a narrow set of fraud claims based on representations made before June 2022.15Bank Info Security. Judge Lets Delta’s Cyber Failure Suit vs. CrowdStrike Proceed
Judge Ellerbe also ruled that whether a “confidential relationship” existed between the two companies is a factual question to be resolved at trial rather than on a motion to dismiss. CrowdStrike said it was “pleased several Delta claims have been rejected” and expressed confidence remaining claims would be capped or found meritless. Delta called the ruling a validation of the merits of its case.15Bank Info Security. Judge Lets Delta’s Cyber Failure Suit vs. CrowdStrike Proceed As of mid-2026 the case remains ongoing with no trial date publicly reported.14Techzine. CrowdStrike Wins in Lawsuit With Shareholders Over Outage
The Contract Cap Fight at the Center of It All
The single legal question with the most money at stake is whether CrowdStrike’s standard contractual liability caps will hold. Those caps typically limit exposure to the total fees a customer paid for services, which for even a large client sits orders of magnitude below the losses the outage caused. Standard SaaS agreements often cap liability at the subscription fees paid over the preceding twelve months, and many large enterprises accept those vendor-favorable terms without negotiating.19CIO Dive. CrowdStrike Delta Negligence Claims Lawsuit
Delta’s strategy is to escape those caps by framing the case as gross negligence and fraud rather than simple breach of contract. If a court finds gross negligence or willful misconduct, contractual limitations of liability may not apply. That is exactly the issue Judge Ellerbe has allowed to go to trial. Legal analysts have noted the damages from the outage likely run into the billions, and that any payouts, if they come, could amount to “fractions of pennies” on the dollar of actual losses.20ChannelE2E. CrowdStrike Legal and Liability Implications as Recovery Progresses
That result will not directly revive the dismissed passenger or shareholder cases. It will, however, determine whether the largest customer harmed by the outage can recover anything close to what it lost, and it will set a marker for how similar vendor-outage disputes are litigated going forward.