In July 2024 a single bad CrowdStrike update bluescreened over 8 million Windows machines worldwide in a few hours. Airlines grounded fleets. Hospitals reverted to paper. Supermarkets couldn't process payments. It was the largest IT outage in history and it will not be the last.
This guide is the playbook for what to do when a global IT outage hits, whether it's a security vendor pushing a bad update, a major cloud provider going down, or a widespread ransomware event.
Hour 1: Confirm it's a global event
Quick checks:
- Is more than one machine affected, with similar symptoms? Yes → likely external.
- Check social media / news. A global outage trends within minutes.
- Check vendor status pages. Microsoft 365 status, AWS Health Dashboard, your security vendor.
- Phone another business in your area.
Don't reinstall anything until you've ruled out a global cause. Reinstalling Windows on a CrowdStrike-bricked machine in July 2024 didn't help; following CrowdStrike's specific recovery steps did.
Hour 1: Get communications working
Even if your primary systems are down, somebody can usually still talk to customers:
- Mobile phones.
- A working personal email account for a holding message: "We're aware of a wider IT outage affecting many businesses today. We'll update you as soon as we have more information."
- Your website status page or banner if your CMS is up.
- LinkedIn / X, short factual updates beat radio silence.
Don't wait until you have answers. Communicate that you don't have answers yet but you're working on it.
Hour 2–4: Stabilise
Triage like a hospital. What's still working, what's down but not urgent, what's down and critical.
If you have an IT support partner they should be running this with you. If you don't, this is the moment you wish you did, see our note on why IT support is important for business.
Hour 2–24: Apply vendor recovery steps
For a vendor-caused outage, wait for and follow the official recovery steps. Don't improvise.
- The CrowdStrike fix in July 2024 required booting each affected machine into Safe Mode and deleting a specific file. People who tried alternative "creative" fixes broke things further.
- Microsoft 365 outages typically resolve within hours; the right action is not to re-route DNS in a panic.
Document each machine you fix in a shared spreadsheet.
Day 2: Cleanup
- Verify backups ran during the outage. They probably didn't. Re-run them manually.
- Reconcile any failed transactions.
- Apologise properly to affected customers.
- Patch what caused it.
- Document everything for the post-mortem.
Week 1: The post-mortem
This is the bit most businesses skip and it's where the value is. Honest internal review:
- What worked, what didn't, what did it cost, what would have helped (a second internet line, a documented disaster recovery plan, a different security vendor)?
Building resilience
The single biggest lesson from CrowdStrike: diversity matters more than features.
- Don't put all your eggs in one vendor's basket.
- Manual fallbacks for critical processes (cards, invoices, top 20 customer contacts).
- Test backups quarterly. Untested backups are wishes, not backups. See our data recovery FAQ.
- Offline copies of critical contact lists.
- Current asset register.
- Documented recovery runbooks.
Cyber insurance
- Cyber insurance typically covers ransomware and data breach response. CrowdStrike was a grey area.
- Most policies now require MFA on every account, regular backups, patched systems, an incident response plan. Not having these can void cover.
We routinely help Birmingham clients make sure their security posture matches their insurance conditions.
When to call IT support
Immediately. Even if there's nothing they can do in the first hour because it's a global event, you want them on the call from the start.
Leadership checklist
- Offline contact details for our top 20 customers and IT support?
- 1-page incident communication template ready?
- Backups tested in the last 90 days?
- Any process that breaks if Microsoft 365 is down for 24 hours?
- An IT consultancy partner who has walked us through DR?
- Cyber insurance matches what our IT looks like in reality?
If any are no, fix them now.
The honest takeaway
Most resilience work isn't expensive or glamorous. It's a tested backup, a documented process, a relationship with an IT provider who picks up the phone, and a list of customer contacts you can find without your CRM. We help West Midlands businesses put exactly this kind of foundation in place.