Court Axes Investor Lawsuit Over CrowdStrike Software Update

A federal judge this week dismissed a securities fraud lawsuit accusing CrowdStrike of misleading the public about its product safety, testing rigor and regulatory compliance.

See Also: Webinar | Using the NIST Privacy Framework to Solve Common Data Privacy Problems

U.S. District for the Western District of Texas Judge Robert Pitman found most of Austin, Texas-based CrowdStrike’s statements before and after the July 2024 global IT outage were non-actionable puffery or were not materially misleading when viewed in context. Pittman acknowledged that two statements about federal compliance could plausibly be misleading, but said the plaintiffs failed to establish intent or recklessness.

“Allegations that ‘defendants were motivated to commit fraud by the need to raise capital, the desire for enhanced incentive compensation and the desire to sell stock at inflated prices’ are – without more – insufficient to support an inference of scienter,” Pitman wrote in an 49-page order Monday.

The class-action lawsuit was led by New York Comptroller Thomas DiNapoli, and said that CrowdStrike lacked a proper quality assurance team, did not conduct phased rollouts and failed to test updates in preproduction environments. Pitman ruled in June that a lawsuit against CrowdStrike by airline passengers was preempted by the Airline Deregulation Act since the harm was tied to airline services (see: Judge Axes Flight Disruption Suit Tied to CrowdStrike Outage).

Judge: CrowdStrike Execs Didn’t Knowingly Mislead Investors

While CrowdStrike’s post-outage corrections suggest mismanagement or operational flaws, Pitman said they do not definitively prove that the executives knowingly misled investors at the time the statements were made. Pitman considered the stronger inference to be that CrowdStrike’s executives believed their unique rapid-update strategy simply fell outside traditional testing frameworks rather than obfuscation.

“The plaintiffs’ complaint recites various episodes and acknowledgements of corporate mismanagement and failings of quality control,” Pitman wrote in the order. “However, corporate mismanagement does not, standing alone, give rise to a 10b-5 claim, and mea culpa does not sufficiently satisfy the scienter requirements of pleading in securities fraud cases.”

The plaintiffs said CrowdStrike assured investors that it adhered to sophisticated software development methodologies such as CI/CD, that software updates were tested in non-production environments and that it maintained a quality assurance team. But after the outage, it became clear CrowdStrike lacked pre-production testing for rapid updates, phased rollouts and an independent QA team, the plaintiffs said (see: CrowdStrike Faces Class Action Lawsuit Over Global IT Outage).

“When read in context, no reasonable investor would have assumed purely from a single sentence in the Accessibility section of CrowdStrike’s 2023 and 2024 Proxy Statements that CrowdStrike had a quality assurance team that tested software updates,” Pitman wrote in the order.

Judge: CrowdStrike FedRAMP Claims Could Be Misstatements

Following the outage, plaintiffs said CrowdStrike’s own Preliminary Post-Incident Review admitted the update would have been caught had it been tested under the conditions the company previously claimed it always used. And in August 2024, plaintiffs said President Michael Sentonas accepted the “Most Epic Fail” award at DEF CON in Las Vegas, stating that the company “got this wrong.”

“Industry standards were thought to be inapplicable to Rapid Response Content updates, as they were a novel type of update in the cybersecurity industry whose value was based on them being implemented automatically,” Pitman wrote in the order. “The fact that defendants determined – with hindsight – that less rigorous testing was a bad decision is not a basis for securities fraud.”

In the two years leading up to the outage, plaintiffs said CrowdStrike executives stressed the superiority of the Falcon platform, its unique real-time update capabilities and the company’s discipline in update testing. However, when the July 2024 outage revealed that Falcon’s rapid updates lacked even basic safeguards, plaintiffs alleged these assurances appeared hollow.

“Sentonas’s statement that ‘our agent cloud architecture . . . . doesn’t blue screen end points with failed updates, which happens a lot across the industry,’ (Dkt. 47-22, at 7), is arguably immaterial puffery,” Pitman wrote in the order. “It is a ‘generalized, positive statement [] about the company’s competitive strengths’ that is ‘not specific enough’ to support a securities fraud action.”

Plaintiffs said CrowdStrike falsely certified that it met the stringent cybersecurity compliance standards of the FedRAMP program and continued to represent its compliance even after it had abandoned these key practices in favor of speed. Pitman agreed these claims could plausibly be material misstatements, but because plaintiffs failed to prove intent, the claims were dismissed with leave to amend.

“Plaintiffs fail to offer specific facts alleging that Defendants Kurtz or Sentonas themselves signed the FedRAMP verifications,” Pitman wrote. “And, regardless, even if they had signed the FedRAMP verifications, plaintiffs have failed to plausibly allege that defendants Kurtz or Sentonas ‘knew or were severely reckless in not knowing that any statement in the certifications was false or misleading.'”