Loading story…
A defective CrowdStrike Falcon sensor content update on 19 July 2024 caused Windows systems to enter crash loops globally, disrupting aviation, finance, healthcare, education, government services and other sectors, including multiple organizations in the Netherlands. The faulty channel file was identified as C-00000291*.sys stamped 0409 UTC; versions stamped 0527 UTC or later were valid. The incident prevented an estimated 8.5 million computers from booting and demonstrated how a failure in a widely deployed security product can create systemic disruption without a malicious attack.
Organizations were advised to restart affected hosts to obtain the corrected channel file, while crash-looping devices required recovery-mode or Safe Mode remediation to remove or rename the faulty CrowdStrike driver, with separate considerations for BitLocker-protected and RAID-configured systems. Cloud providers including AWS, Microsoft Azure and Google Cloud issued recovery guidance for affected Windows virtual machines. Dutch authorities cited the outage in the 2024 Cyber Security Assessment as evidence of digital-monoculture risk and the need to prepare for major disruptions caused by technical failures and human error as well as cyberattacks.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The NCSC identified the faulty channel file as C-00000291*.sys with a 0409 UTC timestamp and advised restarting affected hosts to obtain a corrected file. For systems in crash loops, it directed administrators to boot into Safe Mode and delete or rename the driver file, while cloud providers issued recovery guidance for affected virtual machines.
On July 19, a faulty CrowdStrike Windows sensor/agent update caused widespread outages across organizations worldwide, including Dutch organizations and sectors such as finance, healthcare, education, government services, and aviation. The outage caused affected systems to crash or fail to boot and led to major flight delays; CSBN 2024 later reported that 8.5 million computers were unable to boot.
The Dutch cabinet presented the National Cybersecurity Strategy (NLCS), intended to create a digitally secure and resilient Netherlands.
The Dutch government submitted an NLCS progress report to the House of Representatives alongside the Cyber Security Assessment Netherlands 2024 (CSBN 2024). The assessment warned that state actors were intensifying and broadening cyber operations and that digital monocultures could magnify the effects of technical failures or attacks.
The Netherlands conducted the public-private ISIDOOR IV exercise to strengthen preparedness for large-scale outages and digital incidents.
The Netherlands published information about advanced malware that China used to spy on computer networks at the Dutch Ministry of Defence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
oligo.security
Open sourcencsc.nl
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A defective **CrowdStrike Falcon** content update triggered widespread **Windows** system crashes, knocking PCs and servers offline across airlines, banks, hospitals, broadcasters, retailers, and government services. Organizations around the world reported machines stuck on the **Blue Screen of Death**, disrupting flight operations, payment processing, emergency care, call centers, and other frontline services. Reporting said the incident was not a cyberattack but a software failure in a security product deeply embedded in enterprise Windows environments, causing simultaneous outages at a global scale. CrowdStrike said the problem stemmed from a bad update to its sensor for Windows and moved to withdraw the faulty content, while Microsoft systems were heavily affected because the issue hit endpoints running the security tool. Airlines canceled and delayed flights, airports reverted to manual procedures, hospitals postponed appointments, and financial institutions faced service interruptions as IT teams worked machine by machine to restore affected devices. The outage drew comparisons to a supply-chain-style technology failure because a single vendor update cascaded across thousands of organizations, though unlike the **SolarWinds Orion** compromise, the disruption was attributed to an accidental software defect rather than malicious intrusion.
Jul 12, 2026
A faulty **CrowdStrike Falcon** content update caused a widespread IT outage that crashed Windows systems with blue screens and disrupted airlines, hospitals, banks, and other organizations worldwide. **CISA** said the incident was not linked to malicious cyber activity, and CrowdStrike said a fix had been deployed, while Microsoft estimated the outage affected about **8.5 million Windows devices**. Reporting also indicated the Falcon Sensor was tied to some **Linux** instability, widening concern over the operational risk of security-agent updates and the difficulty of safely testing near-real-time threat content at global scale. The disruption was quickly exploited by cybercriminals, who used the confusion to launch phishing campaigns and distribute **fake CrowdStrike fixes** carrying malware and even data wipers. Security agencies and researchers warned that attackers were impersonating CrowdStrike support and related recovery efforts to target affected companies, including organizations seeking urgent remediation. The fallout extended beyond immediate recovery, with the event prompting scrutiny of software update processes, resilience planning, and vendor concentration risk, and later contributing to legal disputes over responsibility for business losses.
Sep 5, 2026
A faulty update to **Dell SupportAssist Remediation** version `5.5.16.0` has caused repeated **Blue Screen of Death** crashes and reboot loops on some Dell and Alienware laptops, with affected systems reportedly failing about every 30 minutes and showing the `CRITICAL_PROCESS_DIED` stop error. User reports tied the issue to updates delivered through **Dell Command Update** or **SupportAssist**, and crash dump analysis identified `DellSupportAssistRemedationService.exe` as the process linked to bugcheck `0xEF`. Systems cited in reports include the **XPS 15 9530**, **Dell Pro Plus 14**, and **Dell Precision 3571`, and users said disabling or uninstalling SupportAssist Remediation and the **Dell SupportAssist OS Recovery Plugin** stopped the crashes. Dell Engineering later acknowledged that **SupportAssist Remediation 5.5.16.0** and **Alienware SupportAssist Remediation 5.5.16.0** can trigger the instability and said it is working on a fix, while advising customers to manually remove the remediation service as an interim measure even though that may temporarily remove Dell OS Recovery repair points. The incident surfaced as Microsoft announced **Cloud-Initiated Driver Recovery (CIDR)**, a new Windows Update capability that will let Microsoft remotely roll back faulty drivers to a known-good version without user or OEM action. CIDR is limited to drivers distributed through Windows Update and is being tested now, with broader automatic support in the Hardware Dev Center publishing workflow planned for **September 2026**.
Jun 29, 2026