- The faulty CrowdStrike update disrupted operations at Delta
- The airline sued the cybersecurity outfit, which then filed a motion to dismiss
- The judge denied the motion and gave the lawsuit the go-ahead
Delta’s lawsuit against cybersecurity outfit CrowdStrike got the judge’s green light and will proceed. Earlier this May, Judge Kelly Lee Ellerbe filed their decision with the Fulton County Superior Court, denying CrowdStrike’s motion to dismiss and allowing most of Delta’s claims to move forward.
Here is a little context: Last year, cybersecurity company CrowdStrike pushed a faulty update to users on Windows devices, causing widespread disruption. Banks, airlines, TV broadcasters, and many other companies, were unable to operate nominally due to the dreaded Blue Screen of Death popping up across their IT infrastructure.
US airline Delta was hit particularly hard. According to The Register, it took five days to recover, significantly more than rivals American Airlines and United Airlines. What’s more, the same source claims Delta was forced to ground a lot more airplanes compared to other organizations.
You may like
Motion to dismiss
This prompted Delta to sue CrowdStrike claiming the company deployed the update without permission, bypassed Microsoft’s certification process, and failed to properly test the update before release. CrowdStrike admitted the update was flawed but claims Delta’s delayed recovery was due to its own decisions. The lawsuit included multiple claims, such as breach of contract, trespass, negligence, and fraud.
CrowdStrike filed a motion to dismiss, arguing that Delta’s claims were invalid. The argument here is that the claims should be limited by the contract under Georgia’s economic loss rule, which generally prevents tort claims for purely financial losses arising from a contract. Delta says CrowdStrike violated independent duties, such as obligations under trespass laws and cybersecurity standards.
Now, the judge has partially denied CrowdStrike’s motion to dismiss. Namely, trespass and negligence claims are valid, while fraud claims were upheld in part.
The Register spoke to CrowdStrike’s outside counsel, Michael Carlinsky of law firm Quinn Emanuel, who says that the worst-case scenario is the company having to pay “single-digit millions” to Delta. The airline, on the other hand, is “pleased by the ruling”.
Via The Register
