Was CrowdStrike breached? The 2025 insider leak, earlier claims, and the July 2024 outage
CrowdStrike sells the Falcon endpoint and Next-Gen SIEM platform, so any claim that it was hacked spreads fast. This page separates what CrowdStrike confirmed, what attackers claimed, and what was never a breach at all, with every line dated and sourced.
Short answer
Was CrowdStrike hacked?
No breach of CrowdStrike’s systems has been confirmed. In November 2025 CrowdStrike said it had fired an insider in October who “shared pictures of his computer screen externally”; the Scattered Lapsus$ Hunters group posted screenshots of internal dashboards on Telegram. CrowdStrike said: “Our systems were never compromised and customers remained protected throughout,” and referred the case to law enforcement.
The hackers claimed they agreed to pay the insider $25,000 and received single sign-on cookies; those are their claims, not confirmed by CrowdStrike. Earlier, in July 2024, the actor USDoD claimed to have leaked CrowdStrike’s threat-actor list, which CrowdStrike said was intelligence already shared with tens of thousands of customers and partners. The global outage of 19 July 2024 was caused by a faulty Falcon content update, not by an attacker.
Timeline at a glance
Dec 2020Attempt to read CrowdStrike email via a Microsoft reseller’s Azure account fails. (CyberScoop)Not a breach
19 Jul 2024Faulty Falcon content update crashes Windows hosts worldwide. CISA: “not … malicious cyber activity”. (CISA)Not a breach
24–25 Jul 2024USDoD claims to leak CrowdStrike’s threat-actor list; CrowdStrike says the data is widely shared intel. (CrowdStrike blog)Unverified claim
Oct 2025CrowdStrike fires an insider who shared screenshots of internal systems. (TechCrunch)Confirmed
20–21 Nov 2025Scattered Lapsus$ Hunters post the screenshots; CrowdStrike says systems were never compromised. (BleepingComputer)Confirmed
Nov 2025Hackers claim a $25,000 deal and SSO cookies from the insider. (BleepingComputer)Unverified claim
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
CrowdStrike incident timeline, in detail
Confirmed = acknowledged by CrowdStrike, a regulator filing or a court. Reported = credible reporting CrowdStrike has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Oct – Nov 2025ConfirmedInsider / data leak (no system compromise confirmed)
Insider shares screenshots of internal systems with Scattered Lapsus$ Hunters
What happened. On 20 and 21 November 2025 the Scattered Lapsus$ Hunters group posted screenshots on Telegram showing internal CrowdStrike dashboards, including an employee’s Okta single sign-on dashboard, per TechCrunch. CrowdStrike said it had terminated the insider “last month” (October 2025) after determining he “shared pictures of his computer screen externally”, and that it had turned the case over to law enforcement.
Impact. CrowdStrike said: “Our systems were never compromised and customers remained protected throughout.” The group told BleepingComputer it agreed to pay the insider $25,000 and received SSO authentication cookies, but that CrowdStrike had already cut his access. CrowdStrike has not confirmed the payment or the cookie claim.
USDoD claims to leak CrowdStrike’s threat-actor list
What happened. On 24 July 2024 the actor USDoD claimed to have leaked CrowdStrike’s list of threat actors and indicators. CrowdStrike responded on 25 July that the threat intelligence is “available to tens of thousands of customers, partners and prospects”, that the actor “has previously exaggerated claims”, and that dates in the sample suggest when the actor obtained it.
Impact. CrowdStrike told Infosecurity Magazine that, even if the claim were accurate, it would not constitute a breach of CrowdStrike.
Failed attempt to read email through a Microsoft reseller
What happened. During the SolarWinds investigations, Microsoft told CrowdStrike on 15 December 2020 that a compromised Microsoft Azure reseller’s account had been used to try to read CrowdStrike’s email. CrowdStrike said the attempt failed, as confirmed by Microsoft, and released a free tool for reviewing reseller and partner privileges in Azure.
Impact. No access was gained. CrowdStrike did not attribute the attempt to the SolarWinds attackers.
What did the insider hand over? CrowdStrike describes screenshots of a screen; the hackers claim they also received SSO cookies. Only the screenshots are confirmed.
USDoD list: CrowdStrike says it is widely shared intelligence, not a breach; Outpost24 assessed it was likely scraped through a customer’s access. Neither confirms where it came from.
The July 2024 outage is sometimes described online as a hack. CISA said it was due to the Falcon content update “and not to malicious cyber activity”.
The pattern across the record
The outage was not a breach
The 19 July 2024 crash of Windows machines worldwide came from a faulty Falcon content update (Channel File 291) that CrowdStrike pushed itself; CISA said it was “not … malicious cyber activity”. It was a serious availability and change-control failure, but no attacker was involved and no data was taken.
Insiders are the cheapest way into a security vendor
The 2025 case shows criminal groups openly trying to buy employee access at security companies. Detection here came from the vendor’s own monitoring before the screenshots were published.
What it means for CrowdStrike customers — and what to do
No CrowdStrike customer data or system compromise has been confirmed. The practical lessons are about the access you give any security vendor and how you would know if it were misused.
1.Review the vendor’s access to your tenant
List the CrowdStrike support, API and Falcon Complete accounts with access to your console and logs. Remove what is not needed and alert on new API clients.
2.Rotate Falcon API keys and SIEM ingest tokens on a schedule
API client secrets and data-connector tokens for Next-Gen SIEM should have owners and a rotation date, so a future vendor-side leak is a routine change rather than a scramble.
The July 2024 outage showed that a security agent can take down every host at once. Use staged content and sensor update policies and keep a tested recovery runbook.
No breach of CrowdStrike’s systems has been confirmed. In 2025 an insider shared screenshots of internal systems with a hacking group and was fired; CrowdStrike says its systems were never compromised and customers remained protected.
Was the July 2024 CrowdStrike outage a cyberattack?+
No. It was caused by a faulty Falcon content update that crashed Windows machines. No attacker was involved and no data was stolen.
What did the CrowdStrike insider leak?+
Screenshots of internal dashboards, including an employee’s Okta single sign-on page, posted by Scattered Lapsus$ Hunters in November 2025. The group’s claims of a $25,000 payment and SSO cookies are unconfirmed.
Did hackers steal CrowdStrike’s threat intelligence?+
In July 2024 USDoD claimed to leak CrowdStrike’s threat-actor list. CrowdStrike said that intelligence is shared with tens of thousands of customers, partners and prospects and that the claim does not show a breach.
Do CrowdStrike customers need to do anything?+
No customer action was required by these events. As good practice, review vendor access to your console, rotate Falcon API and SIEM ingest secrets on a schedule, and stage sensor and content updates.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by CrowdStrike. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →