Paris, France — Airlines, banks, TV channels and financial institutions were thrown into turmoil on Friday by one of the biggest IT crashes in recent years, caused by an update to an antivirus program.
Air passengers crowded into airports to wait for news as dozens of flights were cancelled and operators struggled to keep services on track, after an update to a program operating on Microsoft Windows crashed the system.
Microsoft said the issue began at 1900 GMT on Thursday, affecting Windows users running cybersecurity software CrowdStrike Falcon.
CrowdStrike said it had rolled out a fix for the problem and the firm’s boss, George Kurtz, told US news channel CNBC he wanted to “personally apologize to every organization, every group and every person who has been impacted”.
US President Joe Biden’s team was talking to CrowdStrike and those affected by the glitch “and is standing by to provide assistance as needed”, the White House said in a statement.
Reports from the Netherlands and Britain suggested health services may have been affected by the disruption, meaning the full impact might not yet be known.
Media companies were also struggling, with Britain’s Sky News saying the glitch had ended its morning news broadcasts and Australia’s ABC similarly reporting major difficulties.
Banks in Kenya and Ukraine reported issues with their digital services, supermarkets in Australia had problems with payments, mobile phone carriers were disrupted and customer services in a number of companies went down.
“The scale of this outage is unprecedented, and will no doubt go down in history,” said Junade Ali of Britain’s Institution of Engineering and Technology, adding that the last incident approaching the same scale was in 2017.
Experts suggested it could take days or weeks for systems to be patched up.
Shares in CrowdStrike slumped by nine percent in early trading in New York.
Flight chaos –
From Amsterdam to Zurich, Singapore to Hong Kong, airport operators flagged technical issues that were disrupting their services.
While some airports halted all flights, in others airline staff had to check-in passengers manually.
The US Federal Aviation Administration (FAA) initially ordered all flights grounded “regardless of destination”, though airlines said they were re-establishing their services.
But AFP footage showed frustrated and stranded passengers in airports from Milwaukee Mitchell to New York LaGuardia.
“It’s stressful. I’ve got family events going on this weekend. I don’t know if I’m going to make it to them,” said Jake Buettner, 46, trying to get to Florida from New York.
In Europe, major airports including Berlin, which had suspended all flights earlier on Friday, said departures and arrivals were gradually resuming.
But dozens of European flights were cancelled — Turkish Airlines said it had pulled 84 flights and Italian officials confirmed around 80 departures had been cancelled.
Across Latin America, airports were asking passengers to arrive for flights hours earlier than usual.
Chinese state media, however, said Beijing’s airports had not been affected.
‘Common cause’ –
Companies were left patching up their systems and trying to assess the damage, even as officials tried to tamp down panic by ruling out foul play.
“There is no evidence to suggest that this outage is the result of a cyberattack,” France’s cybersecurity agency ANSSI said.
German interior ministry spokesman Mehmet Ata blamed it on CrowdStrike’s “faulty update”.
CrowdStrike’s Kurtz said in a statement his teams were “fully mobilized” to help affected customers and “a fix has been deployed”.
But Professor Oli Buckley of Britain’s Loughborough University was one of many experts who questioned the ease of rolling out a proper fix.
“While experienced users can implement the workaround, expecting millions to do so is impractical,” he said.
Other experts said the incident should prompt a widespread reconsideration of how reliant societies are on single tech companies for such an array of services.
“We need to be aware that such software can be a common cause of failure for multiple systems at the same time,” said Professor John McDermid from Britain’s York University.
He said infrastructure should be designed “to be resilient against such common cause problems”.