Learning From the CrowdStrike Outage

Editors’ Note: MarketMinder doesn’t make individual security recommendations. The below merely represent a broader theme we wish to highlight.

In case you haven’t heard, the “largest IT outage in history” happened last Friday, with effects lingering through the weekend. The IT failure impacted airlines, hospitals, retailers, government offices and some financial services.^[i] Some painted a picture resembling what Y2K was supposed to be like—and what many investors fear a large-scale hack could be. Many have long fretted such a scenario hitting markets and/or the economy hard. But, perhaps counterintuitively, we think the event should actually assuage those worries in some vital ways.

A faulty software update from cybersecurity company CrowdStrike was apparently at the heart of the chaos. The bad file caused an error in Microsoft’s Windows operating system, rendering millions of computers inoperable—and leading to cascading, system-wide failures. By all accounts, the outage wasn’t due to a cyberattack or security breach, but the disruption had a similar outcome to a hack, impacting operations at scores of industries. For example, Delta Airlines paused all its Friday flights and had to cancel thousands through the weekend while French automaker Renault halted car production temporarily. The IT failure also impacted basic services, from 911 emergency systems to ATMs. Clients at some smaller trading venues couldn’t trade, and the London Stock Exchange reported some services and data weren’t available (though its securities trading wasn’t interrupted).

Friday’s events spurred a predictable outcry: When will the next IT meltdown happen and how bad could it get? With the world so interconnected and reliant on computers for everything from tracking inventories to paying for a cup of coffee, many worry future outages risk crippling basic everyday economic activity. 

However, stocks seemed largely non-plussed. Yes, global markets have endured some volatility lately, falling -0.7% on Friday, before recovering on Monday and then selling off anew on unrelated earnings news, chiefly. It is very hard to pin a modest, single-day drop on any one event, but there doesn’t appear to be much fallout from the outage here.^[ii] The fact markets seemed to move on isn’t to say disruptions aren’t a risk. But the issue appears more company-specific than market-wide—and past experience suggests it is especially so if the issue is with companies that harbor personal information.

Take the infamous 2017 data breach of consumer credit reporting agency Equifax, which affected an estimated 147 million US consumers. The credit bureau’s share price plummeted -13.7% after the news broke—and was down as much as -34.9% a week later before stabilizing.^[iii] Markets punished Equifax for its security failure, which isn’t surprising to us. The company failed at its core business: collecting and holding people’s private data. In a similar vein, US bank Capital One’s share price fell -5.9% on July 30, 2019, after word emerged of a data breach affecting more than 100 million accounts—including 140,000 Social Security numbers.^[iv]

However, markets also understand tech disruptions are (sadly) a part of our modern, computer-dominated lives and that not all data breaches have the same business impact. For example, hackers stole credit card information from Chipotle restaurants in 2017. Not great, but the news didn’t roil Chipotle’s stock price—the market recognized the burrito maker makes its money serving food, not safeguarding personal information. (See how E. coli and norovirus outbreaks did send Chipotle’s stock price tumbling back in 2015.^[v]) Likewise, retailer Target suffered a major breach that compromised the personal information of up to 70 million people in December 2013—yet instead of plummeting, its stock price actually ticked up 0.5% after the news became public.^[vi] Broader markets also recognize individual companies’ issues don’t automatically pose macroeconomic threats. Go back to Equifax. Even as its stock price was falling like a rock, global stocks were flat the day the breach became public and up 1.2% a week after the news broke.^[vii]

As for the economic impact, we don’t dismiss the inconvenience and potential hardship for individuals tied to hacks or service disruptions. Yes, CrowdStrike’s failure led to flight delays impacting thousands of travelers (and likely ruining some vacations); canceled doctor appointments and surgeries; and myriad business disruptions (e.g., some small businesses that have gone cashless had trouble taking payments). That isn’t good.

That said, the “largest IT outage in history” didn’t grind the global economy to a halt. Though inconvenient, the disruption lacked the scale to halt economic activity. Consider a thought exercise from research outfit Capital Economics, which imagined a cyber attack causing output to halve for three full days—leading to an estimated hit of -0.2% to developed economies’ annual GDP.^[viii] The CrowdStrike outage appears to be much shorter and less severe than that hypothetical scenario. The fallout is likely to be akin to a natural disaster (e.g., a big storm)—more of a blip than a wallop.

Next, think forward. An unintended positive consequence from this episode? Living through an outage helps reduce uncertainty. People get a taste of what it is like and it becomes less of an unknown, helping to sap the shock factor. The disruption may also motivate businesses to set up contingency plans for a future outage—for instance, New York City officials credited training drills for a potential IT outage or cyberattack for why government operations held up last Friday.^[ix] Companies may also decide to diversify away from a single provider to reduce their risk (e.g., having multiple telecommunication options to contact clients). Another potential unintended effect: The CrowdStrike outage may spur even more investment and competition in the space. That is right—the longer-term effects could be positive for economic growth and competition.

That isn’t to say additional investment and new players with innovative ideas will prevent future outages. One is always possible. But don’t underrate businesses’ flexibility. Companies must always account for myriad risks, from outages to regulatory changes to new competitors, to ensure they stay in business. Those that can adapt best earn the profits for their dynamism.