CrowdStrike, the cybersecurity firm responsible for the massive computer outage in July around the world, has been hit with a lawsuit from investors accusing it of defrauding investors.
The class action lawsuit, filed in Texas by Plymouth County Retirement Association, a pension fund, alleges that CrowdStrike misled investors by claiming that the company’s technology was “validated, tested and certified.” In fact, investors say, CrowdStrike’s software was not.
“Defendants had failed to disclose that: (1) CrowdStrike had instituted deficient controls in its procedure for updating Falcon and was not adequately testing Falcon updates prior to deploying them to customers; (2) this inadequate software testing created a substantial risk that a Falcon update could cause major disruptions for a significant number of the Company’s customers; and (3) such disruptions could, and did, ultimately create substantial reputational harm and legal risk to CrowdStrike.” As a result, the lawsuit claims, “CrowdStrike traded at artificially high prices” until the massive disruption brought its stock price back down to earth.
A CrowdStrike spokesperson said: “We believe this case is without merit and will vigorously defend the company.”
Securities fraud lawsuits typically arise after almost any adverse corporate event: if the stock price fell for reasons that were not explicitly disclosed to investors in advance, investors may be successful in arguing that the lack of disclosure constituted a fraudulent sale of the associated shares.
CrowdStrike is also facing more conventional legal consequences for the service disruption. On Wednesday, Delta Air Lines chief executive Ed Bastian estimated the outage would cost his company $500m (£391m), after forcing the cancellation of more than 5,000 flights. He said the airline had “no choice” but to claim damages as a result.
“If you’re going to have priority access to the Delta ecosystem in terms of technology, you have to prove the stuff. You can’t come into a critical operation 24/7 and tell us we have a bug,” Bastian added. “We have to protect our shareholders. We have to protect our customers, our employees, from damage, not just in terms of costs, but also brand, reputational damage.”
The cost of the outage, which affected about 1% of all Windows PCs in the world, has been estimated at $5 billion across Fortune 500 companies alone. Despite that, the company’s most prominent reaction, beyond its efforts to restore service, was sending $10 UberEats gift vouchers to “teammates and partners” as a thank you for their work in helping fix the outage, which Uber quickly blocked for fear of potential fraud.