A faulty software update from a cybersecurity firm triggered a global meltdown for many users of Microsoft systems on Friday, causing one of the biggest technology blackouts in history, stranding untold numbers of airline passengers and disrupting railways, banks, stock exchanges, hospitals and other organizations.
Microsoft and the vendor, global cybersecurity provider CrowdStrike, said Friday morning that the issue had been identified and fixes were in progress. But the outages triggered cascading problems that will take some time to fully rectify.
Many airlines, including Atlanta-based Delta, grounded flights for hours, and airports across the planet were mobbed with stranded passengers. More than 4,000 flights were canceled worldwide as of about 3:30 p.m. Eastern on Friday, including more than 2,500 in the U.S., according to Flightaware.
By late morning, airlines started to report that they were beginning to resume operations.
“We are working to resolve the issue as quickly as possible to resume operations,” Delta said on X, the social media site formerly known as Twitter, and said it was working to issue travel waivers.
The breadth of the outage was extensive. In metro Atlanta, some hospitals delayed procedures and medical practices canceled visits. MARTA, the Georgia Department of Revenue and several other state agencies, Home Depot, UPS, the Georgia Aquarium and other organizations reported computer issues of varying severity.
‘Stranded here’
At Hartsfield-Jackson International Airport, Kelly Lane waited in a long line at the Delta check-in counter. She said she was supposed to get home to Jacksonville at midnight Thursday night, but her flight was delayed.
“And then finally at 4 o’clock this morning, they said it was canceled,” Lane said. “I can’t get home. I can’t get a rental car to drive home. I can’t get a hotel to take a rest today. ... It’s not just the airlines.”
Credit: John Spink
Credit: John Spink
She said she expected to get on a flight late Friday night, “if everything’s back up and running.”
Until then, “I’m just stranded here,” Lane said.
The source of the outage involves security updates related to Microsoft 365 apps and services from cybersecurity firm CrowdStrike. George Kurtz, CEO of CrowdStrike posted on X, the social media platform formerly known as Twitter, that the incident is not the result of hacking or other nefarious action.
“The issue has been identified, isolated and a fix has been deployed,” Kurtz wrote. “… Our team is fully mobilized to ensure the security and stability of CrowdStrike customers.”
Companies need digital gatekeepers to protect their systems, so they depend on software supplied by companies like CrowdStrike, an Austin-based firm that has become a world leader in protecting company servers from cyberthieves and other disruption. But the gatekeeper can goof, too.
Which means, a glitch at CrowdStrike can be a global problem, which is what happened in the early hours of Friday at servers around the world.
“What I believe happened, is that CrowdStrike deployed a software update, which is typical,” said Jon Powell, cybersecurity expert and partner at Atlanta-based accounting firm Moore Colson. “But this one was found to have some, umm, undesirable effects.”
The cause, exact nature and scale of the outage was unclear. In Europe, Asia and Australia, retailers, transit systems, television networks, airlines and other critical businesses were disrupted.
Just before 7 a.m. Eastern, Microsoft posted on X that “the underlying cause has been fixed, however, residual impact is continuing to affect some Microsoft 365 apps and services.”
Staffers at the Atlanta airport were deployed for crowd control. Long lines stretched down the terminal from check-in counters for some airlines.
Credit: John Spink
Credit: John Spink
“We recommend that our passengers speak to their airlines, monitor their airlines’ social media channels, download their airlines’ apps, to make sure they get the latest information,” Hartsfield-Jackson spokesman Andrew Gobeil said.
Frontier Airlines passenger Chrystal York, who lives in Locust Grove, said she was supposed to be heading to Las Vegas this weekend, but learned her flight was canceled. “We’re assessing what our options are,” York said, while waiting in a line for Frontier check-in that stretched into baggage claim. “I’m just overall disappointed.”
But even as carriers begin to restore service, the reverberations of the IT outage could linger.
The outages also affected other modes of transportation. MARTA reported issues with its website, service information systems, Breeze app and online fare purchasing. But buses, rail and streetcars are operating normally.
Hospitals impacted
Some hospitals in Atlanta reported issues related to the outage, ranging from annoyances to the need to reschedule surgeries and other procedures.
All Emory Healthcare hospitals and clinics remained open through the outage. But spokeswoman Jennifer N. Phillips said Friday morning that procedures at ambulatory surgery centers and hospitals would be delayed until the systems are stabilized.
“We are working diligently to get systems operating to their full capacity. We apologize for the inconvenience to patients, families, and visitors,” Phillips said.
Emory patients are asked to use the MyChart online portal to manage their appointments.
Credit: Seeger Gray / AJC
Credit: Seeger Gray / AJC
Wellstar Health System, based in Marietta, was also affected by the outage. “Our systems are now coming back online,” according to spokeswoman Lauren Rigau. “We remain focused on the health and safety of every patient. Patients who have a procedure scheduled today should contact the facility where their procedure is scheduled to coordinate care.”
Northside Hospital suffered some computer issues, according to an operator who referred an AJC reporter to the system’s communications team. A spokeswoman later said the system was overcoming the issues and patient care was “relatively unaffected.”
Just before it opened at 9 a.m., the Georgia Aquarium posted advised on its website that tickets were unavailable because of the “tech outage.”
“We are working to resolve this issue,” the advisory said. The Aquarium said visitors who wanted tickets would be able to purchase them at the main entrance.
Vinings-based Home Depot, the largest company by sales in Georgia, was also affected, but a spokeswoman said its stores and website were operating. “ … We have had some systems impacted,” she said, adding that Home Depot teams are “working rapidly to work around the impacts.”
The Georgia Department of Revenue said that its online tax-filing system, as well as its vehicle registration and titling system, DRIVES, have been affected by the outage. The agency is asking customers to check back later.
The state’s Department of Driver Services also reported that its services are unavailable.
Georgia’s Department of Human Services reported it has also been affected, asking users to be patient while the agency worked to get services back online.
Additionally, the Georgia Crime Information Center (GCIC) appeared at midmorning to be down. The Fulton County Sheriff’s Office said its deputies have been unable to access the system, which provides access to statewide criminal justice information.
-Staff writers Michael Kanell, Shelia Poole, Savannah Sicurella and John Spink and the Associated Press contributed to this report.
Credit: John Spink
Credit: John Spink
DEVELOPMENTS
— Flights disrupted: U.S. airlines began restoring service Friday after at least five U.S. airlines — Allegiant Air, American, Delta, Spirit and United — had grounded all flights for a time, according to the Federal Aviation Administration. Travelers might not see immediate relief, however, even as flights take off because of cascading delays at airports. More than 2,000 flights across the country were canceled Friday, according to FlightAware, compared with about 900 on Thursday. But it was far from the country’s worst travel day of the year: Bad weather forced U.S. airlines to scrap more than 3,100 flights on Jan. 15.
— Global reach: The issues were also being felt at airports around the world, including in Hong Kong, Sydney, Berlin and Amsterdam. In Britain, check-in machines were not working. The United Parcel Service and FedEx both reported disruptions, which could delay deliveries in the U.S. and Europe. Customers with TD Bank, one of the biggest banks in the U.S., reported issues accessing their online accounts, and several state and municipal court systems closed for the day because of the outage.
— Emergency care: The outage crippled health care systems across the globe, leading hospitals to cancel noncritical surgeries and complicating emergency response systems in the U.S., where 911 lines were down in multiple states, the U.S. Emergency Alert System said on social media. Most if not all of the 911 problems appeared to be resolving themselves by midmorning. Kaiser Permanente, a medical system that provides care to 12.6 million members in the United States, said all of its hospitals had been effected. It was unclear how long it would take for hospitals to operate at full capacity again, as they activated backup systems to keep caring for patients.
— Federal response: President Joe Biden had been briefed on the CrowdStrike outage, White House officials said. Administration officials were “in touch with CrowdStrike and impacted entities” and “engaged across the interagency to get sector by sector updates.”
— Largely unaffected: Some basic services, including major grocery store chains and public transit systems, appeared largely unaffected by the outages, at least in the U.S. Amazon Web Services and Google Cloud, the other major cloud-computing platforms besides Microsoft Azure, said that by and large, their services were operating normally.
About CrowdStrike
Founded in 2011 and publicly traded since 2019, CrowdStrike describes itself in its annual report to financial regulators as having “reinvented cybersecurity for the cloud era and transformed the way cybersecurity is delivered and experienced by customers.” While not everyone is a client of CrowdStrike and its platform known as Falcon, it is one of the leading cybersecurity providers, particularly in transportation, healthcare, banking and other sectors that have a lot at stake in keeping their computer systems working.
The Austin, Texas-based firm is one of the more visible cybersecurity companies in the world and spends heavily on marketing, including Super Bowl ads. At cybersecurity conferences, it’s known for large booths displaying massive action-figure statues representing different state-sponsored hacking groups that CrowdStrike technology promises to defend against.
