|
'No One Is Immune'
At 9 p.m. on Sunday, I got a text from my colleague Laura Alix, Bank Director’s director of research, who was stuck in the Atlanta airport after spending the weekend visiting her mother.
She waited in line for 9.5 hours to get her flight rebooked after seeing alternatives online that would have her flying back on Tuesday or even Wednesday. She finally returned home roughly 24 hours after her scheduled flight.
Alix was flying Delta Air Lines, which canceled the most flights Sunday among airlines, according to FlightAware. The root cause was a botched cybersecurity vendor update from CrowdStrike, which crashed Windows operating systems on Friday, July 19. CrowdStrike resolved the issue quickly, but Delta’s woes continued for days, with thousands of flights canceled and delayed. On Tuesday, U.S. Transportation Secretary Pete Buttigieg announced his agency’s investigation into Delta’s response to the incident.
Why was Delta less resilient than its competitors? We should learn more when the Department of Transportation completes its investigation. But these types of incidents will rise as the U.S. economy increasingly depends on interconnected technology systems to schedule flights, access bank accounts and generally do business.
The widespread and varied impacts of the outage serve as a “harsh reminder that no one is immune,” says Tracy Hall, a senior manager at Crowe LLP. While banks naturally focus on potential disruptions such as cybersecurity breaches and natural disasters, “we can’t lose sight of the daily technology and operational tasks that could cause these types of issues.”
A 2022 analysis from Uptime Institute, an IT standard-setting agency, found that the frequency of these software-related outages was rising. In response, Hall recommends that bank leaders understand the flaws that could bring down systems, how their institution would respond and test that plan to ensure it would work in an actual event.
While Delta made headlines, banks were affected, too. Banks such as TD Bank warned Friday of “intermittent service impacts, including longer wait times” as the outage affected online banking services and ATMs. As of Monday, the bank announced services were fully restored.
Whether their institutions were directly affected by the CrowdStrike outage or not, bank leaders can learn from it. “Any incident provides an opportunity to make a more robust and resilient plan for your own organization,’” says Chris Stanley, banking industry practice lead at Moody’s Analytics.
• Emily McCormick, vice president of editorial & research for Bank Director
| 
