Judge Lets Delta’s Cyber Failure Suit vs CrowdStrike Proceed

A Georgia judge will allow Delta to proceed with most of its lawsuit regarding the faulty CrowdStrike software update that crippled the airline for days.

See Also: Stronger Security Through Context-aware Change Management: A Case Study

The Atlanta-based airline said CrowdStrike pushed the software update without Delta’s permission, bypassed Microsoft’s certification and introduced a programming error in kernel-level code that crashed its systems. CrowdStrike argues it had contractual authority to push the update and acted responsibly after the update caused issues, quickly rolling it back and offering remediation.

“Construing the pleadings in the light most favorable to Delta, it has alleged the existence of a confidential relationship that could create an independent duty sufficient to allow its gross negligence claim to proceed,” Fulton County Superior Court Judge Kelly Lee Ellerbe wrote Friday. She dismissed fraud claims based on representations made prior to June 2022, but allowed Delta’s remaining claims to proceed.

“We’re pleased several Delta claims have been rejected and are confident the rest will be contractually capped in the single-digit-millions of dollars or otherwise found to be without merit,” Michael Carlinsky, CrowdStrike’s outside counsel at Quinn Emanuel, said in a statement emailed to Information Security Media Group.

Delta contends the issue wasn’t just a product failure but a breakdown of professional software practice, with no pre-deployment testing, no staged rollout, no rollback capacity and an update that was pushed despite settings that should have blocked it. CrowdStrike asked the court to see this as a mistake, not malice since the update was retracted within 78 minutes and the company shared a root-cause analysis.

The court recognized Delta’s position as credible, noting that the delivery of kernel-level code without proper authorization or validation raised issues well-beyond ordinary service failure. Ellerbe permitted Delta to proceed on claims beyond mere breach of contract, acknowledging the severity and uniqueness of the alleged harm.

“We are pleased by the ruling and remain confident in the merits of our claims against CrowdStrike,” a Delta spokesperson said in a statement emailed to Information Security Media Group.

How the Judge Came Down on the Claims

Delta claimed that its system configuration explicitly prohibited automatic updates from CrowdStrike’s Falcon platform, a safeguard it deliberately implemented to ensure only vetted and authorized changes were made to mission-critical infrastructure. The airline asserts CrowdStrike had secretly embedded a “privileged kernel-level door” within its software that bypassed Microsoft’s certification process.

CrowdStrike responded that it was merely operating within the scope of its June 2022 subscription services agreement, which allowed it to access Delta’s systems as necessary to provide services. From CrowdStrike’s perspective, the July 2024 update was part of the ongoing, dynamic relationship established by the contract.

But Ellerbe noted that authorization must be exercised in accordance with the agreement. Since Delta opted out of automatic updates, any update delivered in spite of that preference may be considered unauthorized. This allowed Delta’s claims of computer trespass and trespass to personally to proceed, Ellerbe ruled.

“With each new ‘content update,’ Delta would receive unverified and unauthorized programming and data running in the kernel level of its Microsoft OS-enabled computers,” Ellerbe wrote in a 45-page order. “According to Delta, CrowdStrike hid these practices from it and other customers in order to avoid scrutiny.”

Delta alleged that CrowdStrike engaged in grossly negligent software design and development, choosing speed over safety and creating a kernel update pipeline that bypassed vetting. CrowdStrike allegedly failed to follow elementary principles of secure software release – no testing, no staging, no rollback – which Delta said reflected a conscious decision to ignore known risks for commercial convenience.

CrowdStrike argued that mistakes happen even in mature software environments, with the July 2024 issue evading internal validation protocols and multiple layers of testing. But the court ruled that Delta’s allegations – particularly the claim that CrowdStrike didn’t test the update even once, and intentionally circumvented Microsoft security procedures – were sufficient to support a gross negligence claim.

“Delta asserts CrowdStrike imprudently pushed the July update to most of its customers without staged deployment,” Ellerbe wrote. “With staged deployment, a new update is disseminated first to a small and then gradually increasing number of customers so errors can be detected before an update is widely deployed. Delta asserts staged deployments are a ‘basic and standard software development practice.'”

Where CrowdStrike Attempted to Gain Ground

One of CrowdStrike’s primary legal defenses rested on the economic loss rule, which prevents parties from suing for losses that are purely financial and arise from a failed contract. CrowdStrike argued that Delta’s claims were simply a reframing of its breach of contract grievances – that its damages were all economic, and the June 2022 subscription services agreement was the correct venue for remedy.

Delta countered that its claims were not solely about lost revenue, but also about unauthorized access, statutory violations and independent duties. Its relationship with CrowdStrike was so embedded and trust-based that a confidential relationship existed, Delta said, imposing duties that surpassed contract obligations.

The court ruled that statutory duties like computer trespass are independent of contract, while fraud and gross negligence are recognized tort exceptions. Whether a confidential relationship existed is a matter for trial, not dismissal, Ellerbe ruled.

“As a general matter, “[t]he economic loss rule] provides that a contracting party who suffers purely economic losses must seek his remedy in contract and not in tort,” Ellerbe wrote. “CrowdStrike argues any duty relating to its products or services provided to Delta arises from and is governed by the SSA, and, therefore, Delta has impermissibly transformed contract disputes into tort claims.”

Delta argued that CrowdStrike’s conduct wasn’t mere exaggeration or failure to perform but rather fraudulent inducement and misrepresentation by omission. CrowdStrike argued that Delta can’t sue for fraud while keeping the contract, and that Delta must rescind the contract to claim fraud in inducement.

The court ruled that fraud claims based on pre-contract statements were barred, but fraud claims within the subscription services agreement itself, or based on false intent to perform, are viable. Specifically, Delta’s claim that CrowdStrike never intended to comply with the “no backdoor” warranty can proceed. The court also allowed fraud by omission claims to move forward.

“The particular circumstances give rise to a duty to communicate because of the nature of ‘CrowdStrike’s cybersecurity services, which necessarily touch the most sensitive parts of Delta’s business,’ Ellerbe wrote. “For the same reasons addressed above, the court finds these allegations require factual inquiry and are not susceptible to disposition on the pleadings.”