Delta's CrowdStrike outage cancels 5,000+ flights and costs $500M

On July 19 2024, a faulty CrowdStrike Falcon security update blue-screened 8.5 million Windows PCs worldwide. Delta Air Lines was hit harder than any other US carrier: it canceled more than 5,000 flights through July 25, stranding hundreds of thousands of passengers and taking days to return to normal.

The reason Delta's pain outlasted every other airline's was the way it had built its IT. Crew scheduling, pilot tracking, gate assignments and flight planning all ran on a deeply integrated Microsoft Windows stack protected by CrowdStrike, with little cross-vendor redundancy. When the shared security layer crashed, the systems Delta depends on to run a single flight all failed together, and there was no fallback path.

Recovery was manual and slow. Delta had to reset roughly 40,000 servers one by one before its operations could come back online. CEO Ed Bastian put the direct cost at $500M, covering lost revenue, compensation paid to stranded customers and the restoration effort, and said the airline would seek damages from CrowdStrike and Microsoft. Delta hired high-profile litigator David Boies to pursue the claim.

Delta's bill dwarfed its rivals': American and United said the outage cost them only in the low hundreds of millions each. The gap was not luck but architecture — the difference between a fleet that could restart on alternate systems and one whose operations lived inside a single vendor's stack.