A judge in the United States has allowed Delta Air Lines (DL, Atlanta Hartsfield Jackson) to proceed with several key claims in its lawsuit against cybersecurity firm CrowdStrike, stemming from a software update that allegedly caused a massive outage across Delta’s systems last year, which the airline claims cost it more than USD500 million.

In a May 16 court order, Superior Court of Fulton County Judge Kelly Lee Ellerbe denied in part CrowdStrike’s motion to dismiss Delta’s complaint, which accuses the cybersecurity provider of gross negligence, computer trespass, and fraud, among other allegations. The case centres on a faulty July 2024 software update that Delta claims crippled its operations as it had to cancel 7,000 flights.

Delta alleges the update bypassed safeguards and introduced unauthorised, untested programming that caused widespread crashes in systems running Microsoft Windows, including airport displays and employee workstations. The suit claims the update "negatively impacted millions of people across the globe".

CrowdStrike acknowledged flaws in the update but argued that Delta’s tort claims were improper under Georgia law. The company maintains it had authorisation under a subscription services agreement to access and update Delta’s systems.

However, the Atlanta-based court found Delta’s pleadings sufficient to support claims of unauthorised and reckless access, particularly given its allegations that CrowdStrike secretly altered its update delivery mechanism to avoid regulatory scrutiny. The judge noted that Delta’s claims of concealed actions, potential fraud, and gross negligence warranted further review.

The ruling allows the lawsuit, originally filed in October 2024, to proceed toward discovery and trial, with the exception of two withdrawn claims and portions of Delta’s fraud allegations that were dismissed due to contractual limitations.

In a statement to Reuters, CrowdStrike's lawyer Michael Carlinsky said he was confident the judge would find Delta's case has no merit, or would limit damages to the "single-digit millions of dollars" under Georgia law.

Delta told Reuters that it was pleased with the decision and remained confident in the merits of its case.