Widespread IT Outage Due to CrowdStrike Update

Note: CISA will update this Alert with more information as it becomes available.

Update 7:30 p.m., EDT, July 19, 2024: 

• The CrowdStrike guidance is updated with additional guidance regarding impacts to specific environments, e.g., Azure, AWS.
• For additional information:
  • Update from the United Kingdom’s National Cyber Security Centre (NCSC-UK)
  • Update from the Australian Cyber Security Centre (ACSC)
  • Update from the Canadian Centre for Cyber Security (CCCS)
• Threat actors continue to use the widespread IT outage for phishing and other malicious activity. CISA urges organizations to ensure they have robust cybersecurity measures to protect their users, assets, and data against this activity.

CISA continues to monitor the situation and will update this Alert to provide continued support.

Initial Alert (11:30 a.m., EDT, July 19, 2024):

CISA is aware of the widespread outage affecting Microsoft Windows hosts due to an issue with a recent CrowdStrike update and is working closely with CrowdStrike and federal, state, local, tribal and territorial (SLTT) partners, as well as critical infrastructure and international partners to assess impacts and support remediation efforts. CrowdStrike has confirmed the outage:

• Impacts Windows 10 and later systems.
• Does not impact Mac and Linux hosts.
• Is due to the CrowdStrike Falcon content update and not to malicious cyber activity.

According to CrowdStrike, the issue has been identified, isolated and a fix has been deployed. CrowdStrike customer organizations should reference CrowdStrike guidance and their customer portal to resolve the issue.

Of note, CISA has observed threat actors taking advantage of this incident for phishing and other malicious activity. CISA urges organizations and individuals to remain vigilant and only follow instructions from legitimate sources. CISA recommends organizations to remind their employees to avoid clicking on phishing emails or suspicious links.

Source link