The bad release was published just after midnight Eastern time on July 19, and rolled back an hour and a half later, at 1:27 a.m. Eastern, CrowdStrike said. But by then millions of computers had already automatically downloaded the faulty update. The issue affected only Windows devices, not Mac or Linux machines, and only those that were switched on and able to receive updates during those early morning hours.
Thanks to the timing of the incident, organizations in Europe and Asia "had more of their work day affected by the outage, unlike the Americas," Fitch wrote in its blog post.
When Windows devices using CrowdStrike's cybersecurity tools tried to access the flawed file, it caused an "out-of-bounds memory read" that "could not be gracefully handled, resulting in a Windows operating system crash," CrowdStrike said.
That's the
Blue Screen of Death that many people reported seeing on their machines, and that only a manual intervention to delete the bad file could fix — a
slow, painstaking process when you consider that as many as
8.5 million individual devices will need to be reset this way.
That figure is small as a percentage of the wider Windows ecosystem, said Microsoft — a company that played no direct role in the outage. Still, Microsoft said in
a blog post, it "demonstrates the interconnected nature of our broad ecosystem."