From Health 201FailSystems

CrowdStrike's root cause analysis says a new IPC Template Type defined 21 input fields, but the sensor code that called it supplied only 20. Testing and early deployments used wildcard matching for the 21st field, so the mismatch stayed latent. On 19 July 2024 a new Channel File 291 used a non-wildcard criterion for the 21st field. That triggered an out-of-bounds memory read, and Windows hosts that received it crashed. CrowdStrike's remediations include bounds checks, more testing, staged deployment through rings, and customer control over content rollout. Microsoft estimated 8.5 million Windows devices were affected, under 1% of the total, and noted that the damage was outsized because enterprises running critical services use CrowdStrike. CISA confirmed it was not a cyberattack but warned of phishing that took advantage of the outage. Tully et al. (JAMA Network Open, 2025) scanned hospital IP space and Epic FHIR endpoints from outside. Of 2,232 US hospitals, 759 (34.0%) had detectable disruptions. Of 1,098 disrupted services, 239 (21.8%) were patient-facing. Most services came back within 6 hours, but 43 were down for more than 48 hours. The authors note that network measurement is only a surrogate for clinical impact.^{[1,2,3,4,5,6,7]}

None documented at the patient level. Tully et al. could not confirm patient outcomes. 239 patient-facing services were disrupted at US hospitals.