Summary

  • Experts are warning of a risk of more disruption as cyber-criminals seek to take advantage of Friday's global IT outage

  • The boss of CrowdStrike, the cyber-security firm responsible, warned of "bad actors" that "will try to exploit events like this"

  • George Kurtz also encouraged CrowdStrike customers "to remain vigilant"

  • Cyber agencies in the UK and Australia are urging people to be vigilant to fake emails, calls and websites that pretend to be official

  • Microsoft says about 8.5 million Windows devices were affected by the glitch

  • Thousands of flights were cancelled and banking, healthcare and payment systems were affected by the mass outage

  • Although many airports say their IT systems are working again, travellers continue to face disruption as airlines try to recover from the outage's impact

  1. We're closing our coveragepublished at 18:25 British Summer Time 20 July

    Businesses and services are continuing to grapple with the aftermath of Friday's global IT outage, and although disruption across most industries appears to be easing, it's likely the impact will continue to be felt over the coming days.

    We're ending our live coverage now, thank you for joining us. If you would like to continue reading about this story, there's plenty on offer across the BBC:

    • Microsoft estimates that 8.5m computers around the world were affected by the global IT outage – read our cyber correspondent Joe Tidy's full report
    • Are GP services still affected? Find the latest update here
    • What caused the IT outage? Read our explainer here
    • Has your flight been disrupted? Here's your guide to refunds and compensation

  2. Microsoft 'working around the clock to provide support'published at 17:52 British Summer Time 20 July

    Joe Tidy
    Cyber correspondent

    We can bring you some more from Microsoft's latest statement now.

    The 8.5 million Windows devices affected by the IT outage accounts for less than 1% of all machines worldwide. Microsoft says that the "broad economic and societal impacts" shows the use of CrowdStrike "by enterprises that run many critical services".

    Microsoft can be very accurate on how many Windows devices were disabled by the outage as it has performance telemetry to many by their internet connections.

    The firm says its "’working around the clock" to provide "ongoing updates and support", with help from CrowdStrike.

    The tech giant, which stresses that this was not an issue caused by its software, says the incident highlights how important it is for companies to "prioritise operating with safe deployment and disaster recovery using the mechanisms that exist".

  3. Analysis

    IT outage likely to be the largest everpublished at 17:21 British Summer Time 20 July

    Joe Tidy
    Cyber correspondent

    We now we have a number on how bad the IT outage may have been in terms of disabled computers worldwide.

    It's fair to say this is probably the largest ever cyber event eclipsing all previous hacks and outages.

    The closest to this is the WannaCry cyber attack in 2017 that is estimated to have impacted around 300,000 computers in 150 countries. There was a similar costly and disruptive attack called NotPetya a month later.

    There was also a major six hour outage in 2021 at Meta, which runs Instagram, Facebook and WhatsApp – but that was largely contained to the social media giant and some linked partners.

  4. CrowdStrike glitch affected 8.5 million Windows devices, Microsoft sayspublished at 17:17 British Summer Time 20 July
    Breaking

    Joe Tidy
    Cyber correspondent

    Microsoft says it estimates that a CrowdStrike update – which caused a mass IT outage worldwide on Friday – affected 8.5 million Windows devices.

    The tech giant, which says it was not responsible for the IT glitch, adds that the figure accounts for less than 1% of all Windows machines worldwide.

  5. China swerved worst of global tech meltdown – here's howpublished at 16:43 British Summer Time 20 July

    Nick Marsh
    Asia business reporter

    Image of a computer showing a blank blue screenImage source, Getty Images
    Image caption,

    Images like this were significantly less frequent in China than in the rest of the world

    While most of the world was grappling with the blue screen of death on Friday, one country that managed to escape largely unscathed was China.

    The reason is actually quite simple: CrowdStrike is hardly used there.

    Very few organisations will buy software from an American firm that, in the past, has been vocal about the cyber-security threat posed by Beijing.

    Additionally, China is not as reliant on Microsoft as the rest of the world. Domestic companies such as Alibaba, Tencent and Huawei are the dominant cloud providers.

    So reports of outages in China, when they did come, were mainly at foreign firms or organisations. On Chinese social media sites, for example, some users complained they were not able to check into international chain hotels such as Sheraton, Marriott and Hyatt in Chinese cities.

    Over recent years, government organisations, businesses and infrastructure operators have increasingly been replacing foreign IT systems with domestic ones. Some analysts like to call this parallel network the "splinternet".

    "It's a testament to China's strategic handling of foreign tech operations," says Josh Kennedy White, a cybersecurity expert based in Singapore.

    Read more here.

  6. Analysis

    How hackers could take advantage of IT outagepublished at 16:25 British Summer Time 20 July

    Joe Tidy
    Cyber correspondent

    Whenever there is a major news event, especially one linked to technology, hackers respond by tweaking their existing methods to take into account the fear and uncertainty.

    We saw the same with the Covid-19 pandemic when hackers adjusted their phishing email attacks to offer information about the virus and even pretend to have an antidote in order to hack people and organisations.

    Because the IT outage has been a global news story we are seeing hackers capitalise.

    According to researchers at Secureworks, there has already been a sharp rise in CrowdStrike-themed domain registrations – hackers registering new websites made to look official and potentially trick IT managers or members of the public into downloading malicious software or handing over private details.

    The advice is mainly for IT managers who are the ones being affected by this as they try to get their organisations back online.

    But individuals too might be targeted, so experts are warning to be cautious and only act on information from the official CrowdStrike channels.

  7. Staying safe online: Key tips to avoid scamspublished at 16:04 British Summer Time 20 July

    Tom Gerken
    Technology reporter

    With many of the outages being resolved, the big development today has really been around security agencies, who are each warning of an increase in scams relating to CrowdStrike.

    You may be wondering what you need to do.

    The National Cyber Security Centre (NCSC) and others are specifically warning about phishing attacks – where scammers try to trick people into handing over their financial details.

    Once someone pays up, the scammers either vanish without a trace, or will try to scam them out of more money through follow-up messages.

    These sorts of scams have been around for decades and being aware of it them important, but prevention is better than intervention.

    The NCSC advises people to think about the information they share online – because cyber criminals will grab all the info they can get to make their scams more convincing – and the simplest thing you can do with the biggest impact is to review the privacy settings on your social media accounts.

  8. South Western Railway ticket machines still downpublished at 15:48 British Summer Time 20 July

    Ben King
    Business reporter

    South Western Railways ticket machine with a hand-written sign on it
    Image caption,

    Train services are "generally running normally", despite issues with ticket machines, South Western Railway says

    A sign that not every IT system has been fixed yet – South Western Railways which runs trains out of London's Waterloo to Surrey, Hampshire, Dorset and beyond says its ticket machines are still not working.

    Customers can still buy tickets on the app, website, ticket office or train, the company says.

    It says train services are "generally running normally", though there are some delays because of infrastructure issues.

    The company says it's "sorry for the inconvenience".

  9. IT issues in health sector 'not taken seriously enough' - GPpublished at 15:24 British Summer Time 20 July

    We've just had an update from the NHS saying systems are coming back online "in most areas", but we're still hearing from people who are having IT problems.

    Sarah Jane Cowley is a GP at Somerset Gardens Family Healthcare Centre in Tottenham, North London.

    She spoke with the BBC earlier to say that the practice has been "badly affected".

    “In our practice, we have been unable to make appointments, issue repeat prescriptions, look at test results, see most of the patients' notes, make referrals including for suspected cancer.

    “We have had to make paper notes and paper prescriptions but this is not sustainable for very long," she said.

    Cowley added that problems with EMIS – a widely used clinical system – "must be urgently sorted out".

    “It’s not being taken seriously enough and there seems to be no end in sight to it. It’s a big problem and it seems to be being played down," she added.

    After the NHS said many of its systems were back up and running, Cowley told the BBC: "I have just been able to access EMIS Web on my work laptop, but it isn't working properly.

    "It is very slow, and I still can't look at patients' notes or likely do much on it yet."

  10. Disruption to GP services to continue into next week – NHSpublished at 15:11 British Summer Time 20 July

    We've just got an update from the NHS about the ongoing issues that GP services are experiencing.

    An NHS spokesperson says disruptions will continue into next week, despite most systems now coming back online.

    They adds that its systems are running "slightly slower than usual".

    Patients should continue to attend appointments unless told otherwise and that the 999 service is running as usual," the spokesperson stresses.

    "As practices recover from the loss of IT systems on Friday, there may be some continued disruption, particularly to GP services, in some areas into next week as practices work to rebook appointments.

    "The advice for Monday remains that patients should attend appointments as normal unless told otherwise," they say.

  11. What's the latest?published at 14:57 British Summer Time 20 July

    A general view from Madrid-Barajas International Airport as passengers gather and wait due to the global communications outage caused by CrowdStrike,Image source, Getty Images
    Image caption,

    Thousands of flights were cancelled across the world on Friday due to the mass outage

    In the aftermath of Friday's IT outage, the focus today has been on restoring normal service and clearing backlogs as much as possible.

    Here's a look at the latest developments:

    • GPs have said they are still experiencing issues with their IT systems, as disruptions are expected to continue into next week
    • The National Pharmacy Association has warned of continued backlogs, but has stressed systems were "by and large" back online
    • While many airports and airlines have reported that their systems are back up and running, passengers are still experiencing delays
    • The Port of Dover has seen some displaced airport passengers opting to use their ferry services
    • Transport Secretary Louise Haigh has said the situation is improving and that she is in "constant communication" with the industry
    • Meanwhile, cyber agencies, such as the Australian Signals Directorate and the UK's National Cyber Security Centre, are calling for caution following warnings that criminals may seek to take advantage of the outage

  12. 'I'm heartbroken to miss my brother's wedding'published at 14:32 British Summer Time 20 July

    We've heard from James Dawson, 37, in Blackpool, who has told us that he is “heartbroken and fuming” because he's unable to get to his brother's wedding in Hannover, Germany, this afternoon.

    He was meant to fly on Friday from Manchester to Hamburg, but when he arrived at the airport he received a cancellation notice.

    Other family members took a train to London and have paid to travel on the Eurostar. He says they "should get there in time".

    But he, along with his son and others, can't afford the tickets.

    "Nothing can be done about it," Dawson says.

  13. 'Miserable way to end our holiday,' says couple stuck in Corfupublished at 14:09 British Summer Time 20 July

    Kris Bramwell
    BBC News

    We've been hearing from Melanie and Alan Cree, who say they have not been able to leave Corfu following a two week holiday celebrating their 40th anniversary.

    They have had a flight cancelled yesterday and today and had been put up in a hotel overnight along with friends before coming back to the airport.

    Melanie has also run out of some medication.

    She says there has been a "basic lack of communication".

    “It’s horrible, hot, crowded and a miserable way to end the holiday.

    “We are currently queuing to see if there is accommodation for us but already people have given up and have gone and booked their own.”

  14. Airports and train operators' IT systems 'working as normal', says transport secretarypublished at 13:53 British Summer Time 20 July

    We've had an update from Transport Secretary Louise Haigh who says the situation has improved.

    Writing on X, she says: "Pleased to report that UK airports and train operators have their IT systems back up and working as normal. We are in constant communication with industry.

    "There continues to be no known safety or security issues arising from the outage.

    "Some delays and a small number of cancelled flights are expected today. Train operators are no longer reporting cancellations and delays as a result of the IT failure."

    Here on the news desk, we're still hearing of continued disruption across industries - including knock-on delays for flights and instances of continued problems in the healthcare sector.

    We'll keep you updated as we hear more.

  15. Heathrow sees knock-on effect of IT outage as hundreds queue for replacement flightspublished at 13:35 British Summer Time 20 July

    Simon Jones
    Reporting from Heathrow

    A queue of people looking up at notice boards in Heathrow airport

    Heathrow was always going to be very busy today – with the start of the school holidays for many families.

    But the airport is now facing an additional challenge: hundreds of passengers who were unable to travel yesterday are standing in long queues trying to find alternative flights.

    Most of the people I’ve spoken to remain in good spirits – but some are worried about where they will stay tonight if they can’t find a flight.

    The prospect of bedding down on the floor of the terminal isn’t appealing.

    There are lots of staff on hand. Additional workers have been brought in to try to provide as much information as possible.

    But almost 50 flights to and from the UK have already been cancelled today – so even though the IT systems are working, the knock-on effects of yesterday’s outage are continuing to be felt.

  16. NHS IT issues 'causing a lot of anxiety' – GP practice managerpublished at 13:11 British Summer Time 20 July

    Kris Bramwell
    BBC News

    Asif Akram, 47, in Barnsley is practice manager at the White Rose Medical Practice.

    He says the clinical system Emis Web being down is “causing an awful lot of anxiety amongst managers and other people who work in GP surgeries”.

    “We are hoping it will be up and running before Monday otherwise the situation will get much worse.

    “Patient appointments were cancelled for bloods and other investigations on Friday and we were hoping to catch up on Monday.

    “If systems aren't working by Monday, we will have further appointment cancellations and a huge amount of catching up to do when systems return.

    “You do plan for these sorts of things but you don’t expect these things to go on for days and days and days - that is unprecedented," Akram told the BBC.

  17. Pharmacies say disruption likely to continue over the weekendpublished at 12:44 British Summer Time 20 July

    Most pharmacies systems are "by and large back online" and that medicine deliveries have resumed, the National Pharmacy Association (NPA) says.

    However, NPA chairman Nick Kaye adds that the outage would have caused backlogs, which means services are likely to "continue to be disrupted this weekend as pharmacies recover".

    "We urge people to be patient when visiting their local pharmacy and some may be still prioritising those patients with emergency prescriptions from their GP surgery," Kaye says in a statement.

  18. 'There's going to be a lot more issues later on in the week,' says GPpublished at 12:30 British Summer Time 20 July

    Dr Ahmad sits on the BBC Breakfast sofa
    Image caption,

    Dr Fari Ahmad told BBC Breakfast they couldn't access patient records

    BBC Breakfast heard earlier this morning from GP Dr Fari Ahmad who described yesterday as "horrible".

    "Everything went down… People were struggling to get in. We were struggling to tell people what was going on. And if people did turn up, you had to see them without accessing their medical records. The doctors and the surgery went down to pen and paper. We got our prescription pads out.

    "We were just trying to deal with the emergencies on the day that really couldn't wait," Ahmad said, adding that this morning's surgery could not go ahead as the system was not back up.

    "Sunday, Monday - it's all going to build up, so there's going to be a lot more issues later on in the week," she explained, adding she also knew of surgeries that were not affected by the outage.

    NHS England said yesterday the outage was causing disruption in the majority of GP practices.

  19. How are you affected by the IT outage?published at 12:15 British Summer Time 20 July

    BBC News Get in touch banner imageImage source, BBC News

    Please share your experiences with us. You can also get in touch in the following ways:

    • WhatsApp: +44 7756 165803

    In some cases a selection of your comments and questions will be published, displaying your name and location as you provide it unless you state otherwise. Your contact details will never be published.

  20. 'Everyone has a bad day', says internet security service bosspublished at 12:01 British Summer Time 20 July

    Tom Gerken
    Technology reporter, BBC News

    From one CEO to another, the head of internet security service Cloudflare has some words of wisdom for the head of CrowdStrike.

    "Everyone has a bad day," Matthew Prince posted on X, external a few hours ago.

    "This one really sucked for CrowdStrike. Continue to have faith in them as a partner and the best end point security solution on the market."

    Prince may know a thing or two about this - he oversaw an issue Cloudflare had back in 2019 which left many websites completely inaccessible.

    Cloudflare came back from that and remains a core part of the internet as it currently exists. So it's no surprise that when asked how CrowdStrike will recover from this, he put it simply: "They'll be fine."