After a significant software update from CrowdStrike caused disruptions for numerous companies worldwide in July, lawsuits quickly followed. One of the most notable is Delta Airlines’ potential $500 million lawsuit against the cybersecurity firm, with high-profile lawyer David Boies representing them. Boies, known for representing Theranos, Harvey Weinstein, and Al Gore in the Bush v. Gore case, adds another major case to his portfolio.

Even before Delta’s lawsuit, CrowdStrike shareholders filed a class action suit, accusing the company of misleading them about its software update procedures. CrowdStrike has hired Quinn Emanuel Urquhart & Sullivan, a well-regarded law firm, to handle the expected legal challenges.

Microsoft has been dragged into the controversy, though only to a small extent, because the faulty update affected Windows systems. However, the bulk of the legal battle will focus on CrowdStrike.

Rob Wilkins, a lawyer from Jones Foster, explains that while CrowdStrike faces a serious legal threat, it may be protected by contractual limits on damages, common in enterprise software agreements. Delta is alleging gross negligence or willful misconduct, which could void these damage caps. Proving these claims, however, could be challenging for Delta.

CrowdStrike contends that Delta’s internal systems played a role in its five-day disruption, longer than United Airlines’ three-day downtime. This could complicate Delta’s argument that the entire fault lies with CrowdStrike.

Regarding the shareholder lawsuit, Wilkins points out that proving CrowdStrike misled investors about its software testing practices will also be difficult. He expects individual lawsuits to merge into a class action, a common move in complex legal cases. Once a class action is established, other companies may join, and the cases could be consolidated in a federal court.

A “bellwether” trial might emerge, setting a precedent for potential settlements. Wilkins also notes that insurance companies, both CrowdStrike’s and its clients’, may play a role in seeking compensation for any damages.

Beyond the financial stakes, Wilkins stresses the reputational impact for CrowdStrike. While the company is likely to fight the lawsuits, Wilkins suggests they will also need to seek a resolution to maintain critical relationships with customers and shareholders.