At 04:09 UTC on Friday, July 19, 2024, CrowdStrike pushed a routine content update to its Falcon security sensor. Within roughly ninety minutes the file was withdrawn. It was already far too late. Approximately 8.5 million Windows machines — under one percent of all Windows systems in the world — crashed into the blue screen of death, and because the fault sat in a kernel-level driver, most could not simply be rebooted out of it. Each machine needed hands: boot into safe mode, delete a file, restart. Millions of machines, one at a time, many of them behind locked doors in server rooms, on aircraft, in hospitals.
The consequences were immediate and physical. Airlines grounded fleets and reverted to handwritten boarding passes; one US carrier took the better part of a week to recover, cancelling thousands of flights. Hospitals postponed procedures and lost access to records. Banks, broadcasters, retailers, and some emergency call centres went dark. It was the largest IT outage in history, and insurers would later estimate the cost to US Fortune 500 companies alone in the billions.
The technical cause was almost insultingly small. The update's template defined 21 input fields; the sensor code supplied 20. A missing bounds check and a validator that failed to catch the mismatch turned that off-by-one into an out-of-bounds read inside the kernel — and a kernel fault is not an error message, it is a dead machine. The deeper cause was structural, and it is the reason this edition leads with it. Security software earns its keep by running with the deepest privileges on a system and updating faster than any change-control board could approve. Both of those properties are necessary. Both of them mean that a defect in the defender propagates at the speed and scale of an attack — with none of the friction that would slow an actual adversary.
Nobody had attacked anyone. That is what made July 19 unforgettable: the industry looked directly at a self-inflicted global outage and had to accept that its own architecture of trust was the delivery mechanism.
AT&T and the records of nearly everyone
On July 12, AT&T disclosed that attackers had obtained call and text metadata covering nearly all its wireless customers — roughly 109 million accounts — for periods in 2022. The data was not content, but metadata is its own kind of intimacy: who called whom, how often, for how long, in what pattern. The theft came from the company's tenancy on the Snowflake cloud data platform, part of a campaign that swept up dozens of major brands through one repeated failure: credentials stolen by infostealer malware, reused on accounts without multi-factor authentication. Snowflake itself was never breached. Its customers were, one unprotected login at a time.
Concentration, quantified
July 19 also functioned as an unplanned census of concentration risk. A single vendor's sensor sat inside airlines, hospitals, ports, banks, and government departments across dozens of countries — a dependency nobody had mapped because each organisation had procured it independently and reasonably. Regulators in several jurisdictions opened reviews; boards discovered the phrase "single point of failure" applied to software they had bought for resilience. It is the same lesson the AWS, Azure, and Cloudflare outages would teach in late 2025, and the reason "multi-provider" stopped being an architectural luxury.
WazirX loses $235 million — and previews a bigger heist
On July 18, 2024, India's largest cryptocurrency exchange, WazirX, lost roughly $235 million in a single attack on a multi-signature wallet. The method is worth studying closely, because it would return: rather than stealing keys, the attackers manipulated what the wallet's authorised signers were approving, altering the underlying smart contract so that the signatures collected in good faith handed over control of the funds. Analysis linked the theft to the North Korea-associated Lazarus Group. WazirX froze withdrawals, and Indian users spent months in limbo over a restructuring process.
Seven months later, attackers using a strikingly similar playbook — deceive the signers, not the keys — took $1.5 billion from Bybit, as our February 2025 edition records. India's largest crypto loss was, in hindsight, the rehearsal.
⏳ Time capsule — July 2024
- Handwritten boarding passes at major international airports became the defining image of the year in technology.
- The Paris Olympics opened a week later, with organisers watching their own dependency lists rather nervously.
- "Have you tried booting into safe mode?" briefly became a phrase heard in hospital corridors and airline crew rooms.
- CrowdStrike's share price fell sharply; its competitors' rose — the market's crude verdict on concentration.
Staged rollouts, and a permanent lesson
July 19, 2024 changed how security software ships. Phased and canary deployment of content updates, customer-controlled update rings, and — following an industry summit with Microsoft — serious work on moving endpoint security out of the Windows kernel all trace to that morning. Regulators added software resilience to operational-risk frameworks, and "what happens if our security vendor breaks?" entered standard third-party questionnaires. The Snowflake campaign, meanwhile, made MFA-on-everything a board-level mandate and previewed the identity-first attacks that dominate this archive's later years. And WazirX's stolen $235 million remains, for Indian regulators, the case that made crypto custody a systemic question rather than a niche one.