CrowdStrike posts preliminary post incident report on recent global IT outage

The cybersecurity firm CrowdStrike July 24 posted online a preliminary post incident report following a non-malicious global technology outage which began July 19 and affected many industries, including health care. The outage, which was caused by an undetected error in a rapid response content configuration update to CrowdStrike's Falcon platform, impacted millions of Microsoft computers and had varying effects on hospitals and health systems across the country. The CrowdStrike report includes an overview of the incident remediation actions and preliminary learnings. The company says it will issue a full root cause analysis report.

The AHA was in touch with leaders at Microsoft and CrowdStrike immediately following the outage to urgently relay clinical and operational disruptions occurring in hospitals across the country. On July 19, AHA shared a Cybersecurity Advisory with members with initial information about the outage, as well as another Advisory on July 21 with a recovery tool from Microsoft to aid in the recovery of systems.

"We are pleased and proud to report that through a massive and non-stop 'all hands-on deck' deployment of resources, hospitals and health systems rose to the occasion and have made tremendous progress in restoring mission critical systems and patient care services," said John Riggi, AHA's national advisor for cybersecurity and risk. "Through a combination of manual restoration of millions of computers by hospitals and special updates provided by Microsoft and CrowdStrike, the restoration process has greatly accelerated. Some effects, although diminished, still continue - and the true impact to hospitals and health systems may not be known for weeks. We continue to work closely with Microsoft and CrowdStrike leadership to assist in focused efforts for restoration. We also acknowledge and appreciate CrowdStrike's prioritization to assist hospitals for recovery, in the interest of public health and safety."