Delta Air Lines (NYSE: DAL), one of the leading airline carriers in the U.S., has hired David Boies, chairman of the law firm Boies Schiller Flexner LLP, to seek compensation from CrowdStrike Holdings, Inc. (NASDAQ: CRWD) and Microsoft Corporation (MSFT) for the damages caused by the recent global IT outage. Widespread tech shortages involving computers running Windows, triggered by a faulty security update by CrowdStrike, forced Delta to cancel thousands of flights on July 19 and reschedule thousands more. According to Delta CEO Ed Bastian, the outages resulted in approximately $500 million in losses for the company as it was forced to issue refunds and other forms of financial compensation to affected customers. Delta may just be the first of many companies to seek compensation from CrowdStrike for the massive damages caused by its faulty security update.

What Happened?

On July 19, CrowdStrike, a leading cybersecurity solutions provider, shipped a faulty update that caused millions of computers running Windows products to malfunction. This disrupted the business operations of thousands of companies, including airlines such as Delta, major banks such as Bank of America Corporation (BAC), hospitals including Dana-Farber Cancer Institute, and retail giants such as The Home Depot (HD). According to Parametrix, a cloud risk firm, the outages cost a staggering $5.4 billion in direct losses. CrowdStrike CEO George Kurtz publicly apologized for the outages and in a blog post highlighted the actions affected customers can take to ensure a return to normalcy.

By The Numbers

CrowdStrike stock has declined more than 30% since July 18 with investors dumping the company’s shares in fear of adverse long-term effects of the global outages caused by a faulty update. The company is now facing the threat of a series of lawsuits from affected customers. However, due to the favorable licensing structures used by cybersecurity companies to prevent them from being the victim of large-scale litigation issues, CrowdStrike is likely to be required to cover somewhere between 10% to 20% of total losses even in the worst-case scenario, which comes to between $540 million to $1.08 billion based on Parametrix’s calculations. CrowdStrike, which reported cash and equivalents of $3.7 billion at the end of Q1, can afford to take this hit financially but the reputational damage on the company’s brand image cannot be estimated yet.

Jefferies analyst Joseph Gallo slashed his CrowdStrike price target from $300 to $200 earlier today after Delta reportedly hired a top law firm to seek compensation from the company. The analyst, however, believes that the company is well-positioned to recover from this incident in the long run. Needham analyst Alex Henderson also believes that CrowdStrike, which is a best-in-breed security company, will recover from this reputational and financial damage in the next few years. Although short-term damages are unavoidable, the risk of CrowdStrike going out of existence seems to be quite low.

Neither Dilantha DeSilva nor Stocks.News have positions in CrowdStrike. Stocks.News has positions in Microsoft.