CrowdStrike: What was the impact of the global IT outage

GPs couldn’t treat patients, people were stranded as planes couldn’t get off the ground, and small businesses lost much-needed sales.

Two months on from the global IT outage on 19 July, its full impact is only now becoming apparent.

A rogue software update by the US cybersecurity company CrowdStrike crippled up to eight and half million computers using Microsoft systems around the world.

Adam Meyers – a senior executive at CrowdStrike – will testify at the US Congress on Tuesday.

He will speak of being “deeply sorry” about what happened, and his company’s determination to “prevent it from happening again.”

But what was it like for those on the sharp end of the crisis?

Dr David Wrigley, a GP for the past 22 years, told the BBC about cancer referrals being delayed as the online systems doctors like him rely on went dark.

“It was a very difficult period of time with very little help and support,” he said.

For many GPs, they were unable to use the EMIS system – a digital way of managing appointment bookings and patient records, as well as sending prescriptions to pharmacies.

The British Medical Association – the trade union and professional body for doctors and medical students in the UK – said the CrowdStrike outage was “one of the toughest single days in recent times for GPs across England”, with doctors forced to return to pen and paper.

At Dr Wrigley’s practice in Carnforth, Lancashire, computer problems continued between Friday and Monday.

He said this created a backlog that delayed urgent tasks such as writing referral letters for patients with suspected cancers.

In some cases, this would have been delayed by “three or four days”.

“You have to prioritise those and send them as soon as possible,” he said.

“All the referrals we do are done electronically – that couldn’t happen.”

Elsewhere, the BMA said there were also major problems in Northern Ireland.

Around 75% of GPs in Northern Ireland use the EMIS system according to Dr Frances O’Hagan, the chair of BMA’s Northern Ireland GP committee.

“We couldn’t do anything for most people,” she said.

“We just had to take it on the chin and get on with it.”

She said GPs in Northern Ireland faced similar backlogs to colleagues in England, including a delay to suspected cancer referrals.

The Department of Health told the BBC it is in discussion with “external suppliers” to strengthen “continuity arrangements” following the CrowdStrike outage.

It says GPs had access to “local copies” of patient data from EMIS during the outage, and all other systems worked.

Professor Kamila Hawthorne, Chair of the Royal College of GPs, told the BBC it was “crucial” that there should be “safeguards in place” in the future.

In Surrey, 50 patients who were due to receive radiotherapy treatment on the day of the outage were forced to reschedule.

A spokesperson from NHS Royal Surrey Trust said all urgent cases were seen within 24 hours.

NHS England did not comment.

The UK government told BBC News contingency plans were quickly enacted, and said it is working with NHS England to help prevent similar incidents.

On the west coast of the United States, meanwhile, Providence healthcare operates 53 hospitals and over 1,000 clinics.

Adam Zoller is in charge of cyber security for the company.

He describes the first few hours as “a catastrophe” for hospital IT systems, but 80% were fixed in 48 hours.

The hospitals did cancel non-emergency procedures, but Adam said “in large parts patient care was unaffected”.

“CrowdStrike could have handled this in a lot of different ways, and I think they handled it as well as they could have.”

Melanie Cree and her husband Alan, from Bangor in Northern Ireland, were due to fly home from Corfu Airport on the day of the outage.

Travel operators were forced to cancel thousands of flights across the world – and Melanie and Alan’s flight was axed.

After being taken to and from the airport several times in the next few days, they managed to fly home on Monday.

Melanie said passengers were given no food, and some ran out of medication.

“It totally ruined what should have been our dream holiday,” she said.

“We have lovely memories, but we came back absolutely shattered. It was complete chaos.”

Their provider Tui gave them a £400 voucher.

As Melanie and Alan struggled in Corfu, another UK family were caught up in the delays just over 500 miles (804km) away.

Laura and Malcolm Jones were struggling to return home to Pontypool, in south Wales, after a holiday in Rhodes with their children.

When they were on the tarmac, the flight was cancelled. Laura told the BBC there was no information, no return of bags, and no plan.

They spent 16 hours at the airport before they were taken to a conference centre, where frustrated travellers used tablecloths as blankets.

The family paid £560 out of their own pockets to fly back to the UK a few days later.

Tui has given them a £600 voucher.

“I was looking forward to travelling abroad again after Covid, but I think I might just stick going to west Wales for a few years,” Laura joked.

In a statement, Tui apologised to its customers.

Back in the UK, small business owner Dawn Watts from Market Drayton, Staffordshire was caught up in the outages in a different way – her website, which provides supplies to cleaning companies and hotels, was out of action.

She estimates to have lost about £600 in sales.

“It is extremely worrying,” she said.

“I am a sole trader – I can’t have this happening again.”

Hannah Al-Khaldi, who runs a boutique fitness studio in London, faced similar issues with a non-functional website.

She estimates the outage cost her £1,000.

“It showed how many systems worldwide had put their eggs in one basket,” she said.

“When one link in the chain fails, everything else goes down.

“Is there enough choice out there for providers, or was CrowdStrike the only option?”