NEW YORK (AP) — A faulty software update wreaked technological havoc around the world Friday, grounding flights, bringing down some financial firms and news organizations and disrupting hospitals, small businesses and government offices.
The scale of the outages has highlighted the fragility of a digitalized world that depends on just a few vendors for essential IT services.
The issue was caused by an update released by cybersecurity firm CrowdStrike and only affected its customers using Microsoft Windows, the world's most popular operating system for personal computers. It was not the result of a hack or cyberattack, according to CrowdStrike, which apologized and said a patch was being released.
Businesses and governments around the world suffered hours-long outages, their computer screens lighting up blue with error messages, and they scrambled to manage the aftermath. CrowdStrike's CEO said some of their systems would require manual repairs that will take time.
Thousands of flights were canceled and tens of thousands more delayed, causing long lines at airports across the United States, Europe, Asia and Latin America. Airlines lost access to check-in and reservation services in the height of the summer season. By late afternoon Eastern time, the worst appeared to be over, although cancellations and delays continued due to the cascading effect of the disruptions.
Several local television stations in the United States were not allowed to broadcast news early Friday, and some state and local governments reported problems at courts, motor vehicle departments, unemployment agencies, emergency call centers and other offices, but as the day progressed, many systems returned to normal.
Affected hospitals have encountered problems with their appointment booking systems, forcing them to suspend patient visits and cancel some operations.
Alison Baulos said her 73-year-old father's heart surgery in Paducah, Kentucky, was canceled Friday morning because of the technical failure, leaving her family scared and worried.
“It really makes us realize how reliant we are on technology and how scary it is,” Baulos said in an interview. She said her father was waiting at Baptist Hospital to find out what would happen next. A phone message left at the hospital was not immediately returned.
American Express said it had temporarily experienced difficulties processing transactions, while TD Bank responded to online complaints by saying it was working to restore customers' ability to access their accounts.
Elsewhere, people encountered minor inconveniences, including difficulties ordering in advance at Starbucks, which led to long lines at some of the coffee chain's stores.
In New York's Times Square, shortly before midnight, the blue “recovery” screens that had been displayed on laptops appeared on several giant electronic billboards. Some were dark Friday afternoon.
A worrying reminder of vulnerability
Cybersecurity expert James Bore said that would cause real damage. “All these systems are running the same software,” he said. “We’ve spread all these tools so thinly that when things inevitably go wrong – and they will, as we’ve seen – they go wrong on a massive scale.”
“We can't expect a solution very quickly,” said Claudia Plattner, head of the German IT security agency. It is difficult to predict when exactly all systems will be operational, but “it won't take hours,” she added.
CrowdStrike said in a recording on its customer service line that the problem was related to the “Falcon sensor,” a reference to one of its products used to block online attacks. The company says it has 29,000 customers.
In an interview with NBC's “Today Show,” CrowdStrike CEO George Kurtz apologized, saying the company was “deeply sorry for the impact that we've caused to customers, to travelers, to anyone affected by this, including our businesses.”
“We know what the problem is” and are working to fix it, Kurtz said. He noted, however, that it could take “a while” for some customers, particularly those without in-house expertise.
Although the CrowdStrike update has been automated, the fix requires hands-on work such as removing corrupted files, which can take days or longer for some customers, said Forrester analyst Allie Mellen.
“Given that CrowdStrike has a lot of customers, including Fortune 500 companies, and they're probably managing millions of computers, this is a bigger problem,” Mellen said. “It's going to be a long, arduous process.”
Ann Johnson, Microsoft's corporate vice president and deputy chief information security officer, said Friday afternoon: “At this point, I would say that customers are receiving or have received the necessary information that they need and are getting the support that they need, knowing that this is a very significant issue.”
She said Microsoft's main goal was to get customers back online, but she couldn't estimate how long that might take.
In Alaska, the state court system was back up and running after repairs that took 12 hours, according to spokeswoman Rebecca Koford. In Iowa, Gov. Kim Reynolds said the state's critical technology systems were back up and running by mid-afternoon.
Shares of CrowdStrike, headquartered in Austin, Texas, ended Friday trading down more than 11%. Microsoft's stock fell less than 1%.
Although the impact of the outage could be felt far and wide, forecasting firm Capital Economics said it was likely to have little impact on the global economy.
Cybersecurity experts also said those affected by the outage should be wary of malicious actors claiming to be able to help them. “Attackers are definitely going to go after organizations because of this situation,” said Eric Grenier, an analyst at Gartner.
In a letter to customers posted on CrowdStrike's website, Kurtz said the outage did not affect its Falcon systems or security analytics.
Air travel delayed everywhere
Most airlines blamed the problems on their reservation systems. Thousands of flights were affected in the United States alone, though late in the morning, East Coast airlines said they were beginning to mitigate the problems and resume some service. It takes time to unblock the system, however.
At Minneapolis-Saint Paul International Airport, Sarah Schafer was delayed on her way to her cousin's 50th birthday party in Florida. She waited nearly three hours, not knowing when her flight would be rescheduled.
“I seem calm,” said Schafer, who used a cane because of an ankle injury. “But my angry side could come out.”
British airlines and rail companies have experienced long waiting times. And airports across Europe have suspended landings or halted takeoffs for several hours due to difficulties checking in passengers.
Saskia Oettinghaus, a member of the German Olympic diving team, was among those stranded at Berlin airport.
“We're on our way to Paris for the Olympics and now we're stuck here for the moment,” Oettinghaus said.
In Cancun, the main tourist destination on the Caribbean coast, the state government announced 24 cancellations and 100 flight delays. Some travelers tried to brighten up the long wait by singing the traditional Mexican song “Cielito Lindo,” while a band, also stranded, played at the Cancun airport.
Broadcasters go dark, surgeries are delayed, 'blue screens of death'
In Australia, national news channels including ABC and Sky News Australia were unable to broadcast for hours, with some presenters forced to work in darkened offices, with computers displaying blue error screens.
In the United States, KSHB-TV in Kansas City, Missouri, aired Scripps News instead of local news until about 5:35 a.m., the station said on its website. Other local stations owned by Scripps reported similar problems, though Scripps spokesman Michael Perry said Friday morning that 90 percent of stations were able to broadcast local news.
Hospitals in different countries have also reported problems.
The UK's National Health Service said the outage had caused problems at most GP surgeries as appointment booking and patient records systems were affected.
At Mass General Brigham, the largest health system in Massachusetts, all scheduled surgeries, procedures and non-urgent medical visits were canceled Friday due to the outage, according to a spokesperson.
Some international shipments have also been disrupted.
A major container hub in the Baltic port of Gdansk, Poland, said it was experiencing problems. And at the twin ports of Los Angeles and Long Beach, marine terminals were affected, although the outage did not cause significant disruption.
___
This version corrects the spelling of the last name of the Alaska Justice System spokesman to Koford.
___
Kurtenbach reported from Bangkok, McHugh from Frankfurt, Graham-McLay from Wellington, New Zealand, Hadero from New York and Ortutay from Oakland, Calif. Associated Press journalists from around the world contributed to this story.
