Cybersecurity Policy Report, W.D. Tex.: CrowdStrike class action highlights software update vulnerabilities, (Apr 11, 2025)

By R. Jason Howard, J.D.

CrowdStrike seeks dismissal of the class action with prejudice.

Cybersecurity firm CrowdStrike Holdings Inc. has filed a motion to dismiss the class action brought against it in July 2024 following a failed update that caused “major worldwide technology outages for millions of devices running Microsoft Windows” which resulted in what was describedBy the U.S Government Accountability Office (GAO) as potentially the largest IT outage in history (Plymouth Cnty. Ret. Ass’n v. CrowdStrike Holdings, Inc., No. 1:24-cv-00857 (W.D. Tex. Jul. 30, 2024)).

CrowdStrike. CrowdStrike is an Austin Texas headquartered global cybersecurity company that provides software that helps prevent data breaches.

On July 19, 2024, investors learned about issues with CrowdStrike’s technology when a “single update pushed by CrowdStrike caused outages for millions of users of Microsoft Windows devices worldwide, including financial institutions, government entities, and corporations.” CrowdStrike disclosed that the outages left users vulnerable to potential hacking threats and its share price fell 11 percent.

On July 22, 2024, Congress called CrowdStrike’s then CEO to testify about the outages and the company’s stock rating was downgraded. This resulted in a further share decline of over 13 percent.

On July 29, 2024, news outlets reported that Delta Air Lines had hired a prominent attorney to seek damages from CrowdStrike following the outage. On that news, CrowdStrike’s share price fell a further 10 percent.

On July 30, 2024, the GAO issued a release titled “CrowdStrike Chaos Highlights Key Cyber Vulnerabilities with Software Updates,” which stated that the GAO had “long highlighted concerns for Congress about IT vulnerabilities, a lack of security awareness, poor cyber hygiene, and a need for more cyber preventative measures to combat disruptions like the CrowdStrike outage.” The class action was filed that day.

Class action. The class action complaint states that throughout the class period CrowdStrike “repeatedly touted the efficacy of the Falcon platform while assuring investors that CrowdStrike’s technology was validated, tested, and certified.”

The complaint alleges that the statements about CrowdStrike’s technology were false and misleading because CrowdStrike had failed to disclose that:

1. CrowdStrike had instituted deficient controls in its procedure for updating Falcon and was not properly testing updates to Falcon before rolling them out to customers;

2. this inadequate software testing created a substantial risk that an update to Falcon could cause major outages for a significant number of the Company’s customers; and

3. such outages could pose, and in fact ultimately created substantial reputational harm and legal risk to CrowdStrike.

As a result, the complaint asserts that during the class period the false and misleading statements and omissions caused CrowdStrike’s shares to trade at artificially inflated prices and caused substantial damages to CrowdStrike investors.

Motion to dismiss. The CrowdStrike motion to dismiss the class action calls the outages an unfortunate event but asserts that it did not reveal any securities fraud.

In the motion, CrowdStrike argues that the plaintiff: failed to plead any actionable misstatements or omissions; that certain statements were not properly alleged to be false; that statements about CrowdStrike product usage were not properly alleged to be false; that statements about CrowdStrike software testing were not properly alleged to be false; that regulatory compliance statements were not properly alleged to be false; and that the plaintiff’s theory of falsity contradicted CrowdStrike’s disclosures and was impermissibly based on hindsight.

CrowdStrike asserts that the plaintiff: failed to plead scienter; failed to allege a theory of motive which raised the scienter burden; failed to allege that the defendants knew or recklessly disregarded information that contradicted their statements; that the plaintiff cannot plead scienter as to CrowdStrike’s website statements; and that the more plausible inference is that the defendants thought their testing of CrowdStrike’s rapid response content was sufficient.

Section 20(a) claim. CrowdStrike further asserts that because the plaintiff failed to state a claim for a primary violation under Section 10(b), the plaintiff’s control person liability claim automatically fails as well.

Conclusion. CrowdStrike states that the complaint should be dismissed with prejudice.

The case is No. 1:24-cv-00857.

Attorneys: Eric J. Belfi (Labaton Keller Sucharow LLP) for Plymouth County Retirement Association. Jeffrey John Angelovich (Nix Patterson, LLP) for LS Value Equity DBI and LS Value Equity Global. Gerald Thomas Drought (Martin & Drought, P.C.) for Thomas P. DiNapoli. Robert Pierce Earle (Scott Douglass & McConnico LLP) for CrowdStrike Holdings, Inc., George Kurtz, Burt W. Podbere and Michael Sentonas.

Companies: Plymouth County Retirement Association; LS Value Equity DBI; LS Value Equity Global

LitigationEnforcement: CorporateGovernance CyberPrivacyFeed LitigationEnforcement DirectorsOfficers FormsFilings FraudManipulation InvestorEducation PublicCompanyReportingDisclosure ShareholderActivismNews TexasNews DataPrivacy DataSecurity