CrowdStrike has recovered financially from the July 19, 2024 outage that crashed about 8.5 million Windows devices. It reported record net new annual recurring revenue (ARR) of $333 million in the quarter ended July 31, 2026, with revenue up 26% to $1.47 billion and retention rates improving from the prior quarter. Legal loose ends remain, including Delta's lawsuit seeking at least $500 million and customer commitment packages that still weigh on contraction.
Part of EPR's Crisis Communications coverage. Originally published and updated November 6, 2026. Figures come from CrowdStrike's SEC filings and earnings releases. For how the company handled the outage itself, see how CrowdStrike handled the biggest IT outage ever.
What did the July 2024 outage cost CrowdStrike?
The outage cost CrowdStrike about a third of its market value within 11 days. Reuters reported that CrowdStrike's share price fell 32% over the 11 days after the outage, wiping out $25 billion of market value, and CNBC reported that the shares closed down 11% on July 19 itself. The faulty Falcon sensor content update crashed about 8.5 million Windows devices, according to Microsoft's estimate, and disrupted airlines, banks, hospitals and emergency lines.
Delta Air Lines was the most visible customer casualty. Delta said in an SEC filing that the outage caused about 7,000 flight cancellations over five days and that its damages total at least $500 million, which it later broke into about $380 million of lost revenue and $170 million of added expense. CrowdStrike lowered its full-year guidance in August 2024 because of a customer commitment package related to the incident, according to Newsweek's reporting.
How do CrowdStrike's results look now?
CrowdStrike's results have set records in each of the last three reported quarters. The table uses CrowdStrike's own earnings releases filed with the SEC.
| Quarter ended | Net new ARR | Ending ARR | Other highlights |
|---|
| January 31, 2026 (Q4 fiscal 2026) | $331 million, up 47% | $5.25 billion, up 24% | First year above $1 billion of net new ARR |
| April 30, 2026 (Q1 fiscal 2027) | $256 million, up 32% | Not itemized here | Record cash flow from operations of $591 million; four-for-one stock split announced |
| July 31, 2026 (Q2 fiscal 2027) | $333 million, up 51% | $5.84 billion, up 25% | Revenue $1.47 billion, up 26%; Falcon Flex ARR above $2.29 billion, up 101% |
CEO George Kurtz called the second quarter the best in the company's history, according to the August 26, 2026 release. CrowdStrike guided fiscal 2027 revenue to $5.991 billion to $6.011 billion, up 25%, and ending ARR to $6.603 billion to $6.612 billion. The shares rose about 10% in after-hours trading after the report, per Investing.com.
Did CrowdStrike keep its customers?
Yes, the evidence points to strong retention, though it came at a cost. Kurtz said customer renewal rates stayed at 97% after the outage, according to Stratrix's case analysis. In the second quarter of fiscal 2027, both dollar-based net retention and gross retention improved over the prior quarter, per the company's release and earnings call.
The retention effort used customer commitment packages, which CrowdStrike's 10-Q describes as including discounting, additional modules, professional services, flexible payment terms or subscription extensions. The filing says the packages have caused and are expected to keep causing increased contraction because of longer subscription terms and lower upsell dollars. Stratrix reported that the packages reduced quarterly revenue by about $11 million, with a further $10 million to $15 million impact expected through the fiscal year-end. These are secondary figures and should be checked against the filings. New customers were still buying: net new ARR from new logos was an all-time record in the second quarter, according to the earnings call transcript.
What legal issues remain for CrowdStrike?
Several legal matters tied to the outage were still open as of CrowdStrike's latest 10-Q. Delta sued CrowdStrike in Fulton County, Georgia on October 25, 2024 alleging computer trespass, breach of contract, gross negligence and other claims, and CrowdStrike's own filing notes the airline seeks unspecified damages. A May 2025 ruling dismissed some counts, including the fraud claims, while gross negligence and others survived, per the ITLibra case tracker, and discovery is ongoing.
One matter has moved in CrowdStrike's favor. A federal judge in Austin, Texas dismissed a shareholder lawsuit led by New York State Comptroller Thomas DiNapoli that alleged inadequate software testing, in a decision reported in January 2026, though DiNapoli's office said the decision was under review. The 10-Q's legal proceedings note also lists consolidated passenger class actions and an SEC matter relating to revenue recognition and ARR reporting for certain customers, the July 19 incident and related matters. EPR found no public outcome for that SEC item.
How did CrowdStrike communicate through the recovery?
CrowdStrike communicated through founder visibility, technical disclosure and commercial concessions. Its response included a public apology from Kurtz, a published root-cause analysis, and the customer commitment packages. Stratrix reported that the company introduced the Falcon Flex subscription model after the incident as a retention program, and by the second quarter of fiscal 2027 accounts that had adopted Falcon Flex accounted for more than $2.29 billion of ARR.
The coverage reviewed names no PR or advertising agency for the response. EPR's reading is that the company let financial results carry the recovery message after the first months, which is analysis and not a CrowdStrike statement. The earlier case study, how CrowdStrike handled the biggest IT outage ever, covers the crisis response in detail.
How does CrowdStrike compare with other brand recoveries?
CrowdStrike's recovery is the fastest and most complete of the cases EPR tracks, because the damage was operational rather than reputational. The table compares it with EPR's other recovery pages.
| Brand | Trigger | Recovery status | EPR page |
|---|
| CrowdStrike | July 2024 software outage | Financially recovered; legal items open | This page |
| Cracker Barrel | August 2025 logo change | Partial; traffic still down 6.1% | Has Cracker Barrel recovered? |
| Tesla | Backlash against Elon Musk | Partial; deliveries about 2% below a year earlier | Has Tesla recovered? |
| Target | Consumer boycott | Sales and traffic rebounded in 2026 | Has Target recovered? |
| Bud Light | Consumer boycott | Not recovered | Has Bud Light recovered? |
The pattern across these cases is that businesses with contracted revenue and few substitutes recover faster than consumer brands that customers can swap overnight. That is EPR's analysis from the five cases above, not a finding from the sources cited. The brand boycott scorecard tracks the two boycott cases side by side.
What can brands learn from CrowdStrike's recovery?
Brands can take four lessons from CrowdStrike's numbers when they plan for an operational crisis.
- Pay for retention directly, as CrowdStrike did with commitment packages, and disclose the cost in financial filings.
- Put a senior executive in front of the crisis early, as Kurtz did, and follow with technical detail.
- Track recovery with the metrics your investors use, which for CrowdStrike were net new ARR and retention rather than sentiment.
- Keep reporting open legal matters, since Delta's case and the SEC item remain after the commercial recovery.
The decision for a communications team is to report recovery from an operational crisis in the metrics investors track and to keep open legal matters visible alongside them.
