In July, a software upgrade gone wrong at CrowdStrike caused global chaos, and the legal repercussions were quick. Delta Air Lines has emerged as a crucial actor in this ongoing saga, filing a lawsuit seeking up to $500 million in damages. Delta has hired attorney David Boies, a high-stakes litigator with an enviable client list, to help it make its case.
Delta, however, is not alone in taking on CrowdStrike. Prior to Delta's complaint, shareholders filed a class action alleging that the firm failed to give accurate information about its software upgrade processes. The lawsuit alleges that CrowdStrike misled investors by failing to disclose serious flaws in its software testing methods.
CrowdStrike has hired Quinn Emanuel Urquhart & Sullivan to help prepare its defense. The firm's involvement highlights the gravity of the problem, as CrowdStrike prepares for a possibly costly court battle. Meanwhile, Microsoft has been drawn into the dispute, as the flawed update mostly affected Windows-based computers. Still, the majority of the legal consequences are focused on CrowdStrike itself.
Not just technical flaws
Delta claims that CrowdStrike's failures are more than just technical flaws, accusing the business of gross negligence or purposeful wrongdoing - allegations that, if proven, may render any contractual protections null and void. Delta's operations were reportedly disrupted for five days, which is substantially longer than United Airlines' three days of downtime. CrowdStrike, in its defense, contends that some of Delta's troubles were caused by internal systems rather than the incorrect update.
“It comes down to: Was CrowdStrike intentionally misrepresenting or failing to tell the investors that it was completely up to date with respect to all of its security procedures and control procedures with respect to its software platform?” said Rob Wilkins, Florida law firm Jones Foster.
There is speculation that the cases will eventually be merged into a class action to speed up the legal process. “Typically with class actions, people pile on, and I wouldn’t be surprised if that’s the case, and then you see everything being consolidated into a by the multidistrict litigation panel, assigning all the cases across the country to one particular federal district court for all discovery-related purposes — and that cuts down significantly on the process,” he added.
Once consolidated, a representative or "bellwether" case may be chosen to serve as a baseline for the other claims. A verdict in that lawsuit may prompt CrowdStrike to discuss settlements with the remaining claimants.
Insurance could further complicate issues, as many parties may demand compensation. According to Wilkins, insurance companies may try to recover payouts made on behalf of CrowdStrike or its affected consumers.
Although it has hired excellent legal talent, CrowdStrike must also focus on repairing trust with its consumers and stockholders. Wilkins believes that finding a mechanism to quickly resolve the conflicts will be critical to CrowdStrike's future.
