SA's Capitec hit - Botched update of cybersecurity program causes global Microsoft disruptions

19 Jul 2024

In what will go down as the most spectacular IT failure the world has ever seen, a botched software update from cybersecurity firm CrowdStrike Holdings Inc. crashed countless Microsoft Windows computer systems globally. In South Africa, it caused disruption at Capitec Bank with users being unable to perform banking transactions on Friday morning. 'This is not a security incident or cyberattack,' said Crowdstrike

Computer systems at businesses and public services around the globe were disrupted after a botched update of a widely used cybersecurity program took down Microsoft Corporation systems.

Microsoft Corp. and CrowdStrike have rolled out fixes and systems are being restored. But for several hours, bankers in Hong Kong, doctors in the UK and emergency responders in New Hampshire found themselves locked out of programs critical to keeping their operations afloat.

CrowdStrike Chief Executive Officer George Kurtz posted on X on Friday that the fault had been identified and “a fix has been deployed”, adding that it wasn’t a cyberattack. Compounding the issue, Microsoft also reported an apparently unrelated problem with its Azure cloud service.

Hitting airlines, banks and healthcare systems, there have been few outages of this scale. The cascading failures underscore vulnerabilities of the modern economy and the central role of security software, which has deep access to operating systems.

“This is unprecedented,” Alan Woodward, professor of cybersecurity at Surrey University, told Bloomberg News. “The economic impact is going to be huge.”

In South Africa, customers and citizens took to social media platforms to air their frustrations with Capitec Bank technicalities on Friday morning. The development saw bank users experiencing challenges from declined cards, to not being able to do cash send, to the banking app not working or not being able to receive funds.

Read more: France on high alert, races to head off terrorism threat to Paris Olympics

The hitches are related to the downtime at CrowdStrike, it was later confirmed.

X user Motebang Sephuhle said, “ Today it’s my payday and I filled my vehicle tank hoping to pay with my Capitec card, but the Capitec service was offline. We thought it was network but other bank cards are working. I turned out to be a laughing stock who is claiming to have money in the bank card.”

A user claimed that this has been a constant feature of the services they get from the bank. “Capitec is always having issues. You must find a permanent solution for this because it’s not the first time it’s happened.”

Another said: “Capitec will teach a lesson to always carry emergency cash or have another account from a different bank. Depending on Capitec services only is a huge risk.”

In response to its customer’s complaints, the bank announced that it was experiencing an unexpected issue with the international service provider.

“Due to an unexpected issue with an international service provider, we are currently experiencing nationwide service disruptions. Note: Card payments & Capitec ATMs are working and your account remains secure. We are resolving the matter asap. We apologize for the inconvenience.”

Up and running

By 2pm on Friday, Capitec Bank confirmed that their services were back and running.

Delta, United, and American Airlines have reportedly grounded flights worldwide due to the outage. CNN reported that the UK government has held an emergency meeting to discuss the global tech outage.

In a statement on its website, CrowdStrike said it is actively working with customers impacted by a defect found in a single content update for Windows hosts.

“This is not a security incident or cyberattack. The issue has been identified, and isolated, and a fix has been deployed. We refer customers to the support portal for the latest updates and will continue to provide complete and continuous updates on our website. We further recommend organisations ensure they are communicating with CrowdStrike representatives through official channels. Our team is fully mobilised to ensure the security and stability of CrowdStrike customers.”

On Friday afternoon, Microsoft reported that the underlying cause had been fixed, however, residual impact continued to affect some Microsoft 365 apps and services. “We are conducting additional mitigations to provide relief.”

The underlying cause has been fixed, however, residual impact is continuing to affect some Microsoft 365 apps and services. We're conducting additional mitigations to provide relief. More details can be found within the admin center under MO821132 and on https://t.co/uFnnN6T3jN

— Microsoft 365 Status (@MSFT365Status) July 19, 2024

Meanwhile, The scale of the disruption reflects the enduring ubiquity of Microsoft’s Windows, and the sizable adoption of CrowdStrike’s security software. Windows is installed on more than 70% of machines, according to StatCounter, and CrowdStrike is the global leader in modern corporate protection software, according to estimates by research firm IDC.

Although its software is designed to thwart threats, CrowdStrike customers posted blue error screens to social media as they were prevented from accessing laptops and corporate computers.

https://www.youtube.com/watch?v=B64n7hQ9W1Q

McDonald’s Corporation, United Airlines Holdings, and the LSE Group were among major companies to disclose issues from communications to customer service. Airports from Singapore to Zurich were impacted. The New York subway said arrival information is unavailable for most of its lines, but services are operating. Bloomberg terminals were operating as normal.

Microsoft said it was “aware of an issue affecting Windows devices due to an update from a third-party software platform”. The company said it fixed a separate glitch affecting Microsoft 365 apps.

The outages weighed on several sectors, including airlines, insurers and stock exchange operators. Shares in CrowdStrike sank 20%, while Microsoft fell 2.9%.

Previous disruptions

Past disruptions have been less severe. In 2017, a series of errors within Amazon.com’s cloud service affected the operation of tens of thousands of websites. In 2021, issues at content delivery network Fastly took out several media networks including Bloomberg News, and there were separate disruptions at Amazon’s AWS cloud service.

“I don’t think it’s too early to call it: this will be the largest IT outage in history,” said Troy Hunt, an Australian security consultant and creator of the hack-checking website Have I Been Pwned, in a post on X.

The first glitches emerged in the US late on Thursday, and were blamed on the failure of Microsoft services Azure and 365, the company’s internet-based office software suite.

Problems linked to CrowdStrike then surfaced hours later in Asia and rippled across systems in Europe. As the US commute got underway, the New York subway said arrival information was unavailable but trains and buses were still running. DM/Bloomberg

Daily Maverick’s journalism is funded by the contributions of our Maverick Insider members. If you appreciate our work, then join our membership community. Defending Democracy is an everyday effort. Be part of it. Become a Maverick Insider.

Categories:

Tags:

DM is much better if you are signed in...

Business Maverick

Up and running

Previous disruptions