Cybersecurity firm CrowdStrike is pushing back against threats of a lawsuit by Delta Air Lines.
Delta CEO Ed Bastian appeared on CNBC on July 31, saying that the carrier would have no choice but to sue for damages caused by the July 19 CrowdStrike software update failure.
The outage, which led to more than 6,300 cancellations between Delta and its regional subsidiary Endeavour over five days, cost Delta approximately $500 million, Bastian said.
In a Sunday letter to New York-based attorney David Boies, whom Delta has retained to deal with the CrowdStrike incident, CrowdStrike said it worked tirelessly to help its customer restore impacted systems.
"Within hours of the incident, CrowdStrike reached out to Delta to offer assistance and ensure Delta was aware of an available remediation," CrowdStrike attorney Michael Carlinsky wrote. "Additionally, CrowdStrike's CEO personally reached out to Delta's CEO to offer onsite assistance but received no response."
Bastian had acknowledged on CNBC that CrowdStrike offered free consulting advice but noted that was all it had offered.
He said CrowdStrike should have tested its technology.
"You can't come into a mission-critical, 24/7 operation and tell us you have a bug," he said.
In the Sunday letter, Carlinsky rejected Bastian's suggestion that CrowdStrike failed to do testing and validation. He said that if Delta goes forward with a lawsuit, the airline will have to publicly explain why its competitors who use CrowdStrike security systems restored operations much faster. The airline, he added, would also have to delve publicly into the design and operational resiliency structures of its IT infrastructure, "including decisions by Delta with respect to system upgrades, and all other contributory factors that relate in any way to the damage Delta allegedly suffered."
He also noted that per contract, CrowdStrike's liability to Delta is capped in the single-digit millions.
The CrowdStrike outage crashed Microsoft Windows operating systems around to globe. Bastian told CNBC that Delta has made hundreds of millions of dollars of investments in redundancies, but it suffered the most from the CrowdStrike failure because it is the airline most reliant on both CrowdStrike and Windows.
Delta had to manually reset 40,000 servers over the course of its recovery, he added.