One Update, Many Outages: The CrowdStrike Failure of July 2024 and Concentration Risk in the Software Supply Chains of India's Critical Services

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2024 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

The global information technology outage of 19 July 2024 was not a cyber attack. At 04:09 UTC on 19 July, CrowdStrike pushed a sensor configuration update to Windows systems running its Falcon software; the file, known as Channel File 291, triggered a logic error that crashed machines into the blue screen, and although the update was reverted at 05:27 UTC, systems that downloaded it in that window were susceptible to the crash. Mac and Linux machines were not affected, and the company stated that the issue was "not the result of or related to a cyberattack" (CrowdStrike, 2024, Jul. 20). Microsoft later estimated that about 8.5 million Windows devices were hit, fewer than one per cent of the total (TechCrunch, 2024, Jul. 20).

One per cent was enough to disrupt airlines, banks and factories far from where the update was written. This paper looks back at how the outage reached India, what regulators and operators said about it, and why the event belongs in any serious account of critical infrastructure risk. The argument is that the episode was a demonstration of concentration risk in software supply chains: a single vendor's defect, delivered through an automatic update with deep system privileges, propagating at machine speed into services that the state counts as essential.

2. A Day of Handwritten Boarding Passes

Civil aviation was where the outage was most visible in India. IndiGo, Akasa Air, Vistara, Air India, SpiceJet and Air India Express all reported problems, check-in systems failed, and airlines moved bookings, check-in and boarding to manual processes, with passengers at some airports receiving handwritten boarding passes; IndiGo alone cancelled about 200 flights and Hyderabad airport reported 23 cancellations (The Tribune, 2024, Jul. 19). The Union Civil Aviation Minister said the next day that "since 3 am (Saturday), airline systems across airports have started working normally", while the backlog of rebookings and refunds was still being cleared (The Tribune, 2024, Jul. 20).

The Government's response was swift. The IT Ministry was in touch with Microsoft from the first hours and the National Informatics Centre network was not affected (Deccan Herald, 2024, Jul. 19); the IT Minister said that CERT-In was coordinating with the chief information security officers of critical infrastructure, and the Civil Aviation Ministry and the Airports Authority of India managed the situation through manual methods (The Tribune, 2024, Jul. 19). An aviation system that can fall back to pen and paper within hours is a resilient one, and Indian airports showed that capacity. The reform lesson is to make such fallbacks deliberate and tested, so that they hold even if a failure lasts days rather than hours.

3. The Financial Sector: Insulated by Design

India's financial regulators assessed the position within hours. The Reserve Bank of India said on the same day that its assessment found "only 10 banks and NBFCs had minor disruptions", that most banks' critical systems are not in the cloud and only a few use the CrowdStrike tool, and that the sector in its domain "remains insulated from the global outage" (RBI, 2024, Jul. 19). The stock exchanges issued a joint statement that exchanges and clearing corporations had operated without impact and that 11 of more than 1,400 trading members had reported disruptions (MSE, 2024, Jul. 20). Brokerages including Nuvama, 5Paisa and Motilal Oswal were reported to have faced technical issues (Business Standard, 2024, Jul. 19).

The Chairperson of the Securities and Exchange Board of India (SEBI), speaking at an industry event that day, pointed to the robustness of market infrastructure, using the example that if one exchange's clearing house fails, the other exchange's clearing house takes over its transactions, and noting that mutual fund registrars had created a separate third entity to process investments and redemptions if either failed (Outlook Money, 2024, Jul. 20). This is the right lesson, and it is a distinctly Indian strength. The RBI's account shows that the insulation rested on architectural choices, with critical banking systems largely kept off the cloud, and SEBI's account shows deliberate redundancy among market infrastructure institutions. The task now is to extend the same discipline to the choice of vendors, so that no single product becomes common to the critical systems of many institutions.

4. CERT-In's Two-Front Response

CERT-In moved on the day itself, issuing advisory CIAD-2024-0035, rated critical, describing the crashes and the workaround of booting affected machines into safe mode or the recovery environment and deleting the file matching C-00000291*.sys (The420.in, 2024, Jul. 19). Within days it was also warning of a second wave: phishing emails and calls impersonating CrowdStrike support, and malware disguised as recovery tools, with a list of malicious domains to be blocked (Business Standard, 2024, Jul. 30). This anticipation deserves credit. A non-malicious failure created confusion that malicious actors sought to exploit, and CERT-In treated the period of recovery as a period of heightened exposure, which is exactly the right instinct for a national incident response agency.

5. Concentration Risk in Software Supply Chains

What the outage revealed is a form of dependency that traditional infrastructure planning does not see. Endpoint security software runs with privileged access on very large numbers of machines and updates itself frequently and automatically, because that is how it keeps pace with threats. The same property that makes it protective makes it a single point of failure. When one vendor's product sits on the endpoints of many operators across aviation, banking, health and manufacturing, those operators share a common mode of failure regardless of how well each is run.

The United Kingdom's Financial Conduct Authority drew this out in its review. It noted that third-party issues were the leading cause of operational incidents reported to it in 2022 and 2023, that firms with detailed mapping of third and nth party relationships could assess their exposure quickly, and that some affected firms also supplied services to other regulated firms, which amplified the impact; it urged firms to identify single points of failure and to consider phased software releases and diversity of builds or operating systems (FCA, 2024, Oct. 31). SEBI's Cybersecurity and Cyber Resilience Framework, issued in August 2024 with compliance required from 1 January 2025 (SEBI, 2024, Dec. 31), shows Indian regulators already moving towards more structured resilience obligations. For so far as cross-sector dependency on common software vendors is concerned, the natural next step is a national map of that exposure, sector by sector and vendor by vendor.

6. Recommendation: Map the Common Dependencies Before the Next Update

What comes through from all of this is that India came through 19 July 2024 well, with its regulators, CERT-In and its airport operators responding within hours. The outage should nonetheless be treated as a rehearsal for a failure mode that will recur, whether through a faulty update, a compromised one, or a vendor's withdrawal from a market.

Three measures follow. First, CERT-In and the NCIIPC should build and maintain a national register of privileged software dependencies in critical sectors, so that the share of essential services running on any single endpoint, cloud or update platform is known in advance rather than discovered during an outage. Second, regulators in aviation, finance, health and power should require operators of essential services to stage third-party updates on critical systems, to maintain tested manual fallbacks, and to document recovery times for the loss of any single vendor. Third, concentration of this kind should be measured and reported as a component of national resilience, as the Bharat National Resilience Index proposes for systemic continuity (Dash, 2025, Oct. 28). India's institutions showed in July 2024 that they can respond fast. A dependency map would let them act before the next failure rather than after it.