NEW YORK – New York City officials say the global outage impacting Microsoft computers has not had a major impact on city operations.
The outage did impact banks, airlines and more globally that rely on Microsoft 365 applications.
The cybersecurity firm CrowdStrike, which supplies antivirus software to Microsoft, said it identified a problem in its software update that caused that outage and was working to resolve it.
Adams says New York City has been training for just this moment
New York City Mayor Eric Adams was joined by other top officials at a news conference to discuss the outage’s impact.
Adams said he had been warned specifically by his predecessor Bill de Blasio about the hazards related to IT outages.
“I often recall, although this was not – it was not – a cyberattack, I recall when I was briefed by the former mayor, he says one of the major concerns is dealing with any form of IT outage, including if it is a cyberattack. We need to be prepared,” Adams said.
He went on to explain that the city has been holding drills about dealing with any sort of IT outage or cyberattack, and that training paid off Friday.
“It was good to see how quickly the team coordinated,” Adams said. “You see the results of that – from not only from the notifications… but also the coming together of the team. The blueprint was already in place, all we had to do was execute on it.”
At a separate event, New York Gov. Kathy Hochul also spoke about the outage.
“I want to be very clear, at this time that we have no indication that this is a hack or a cybersecurity threat. It is a more of a technical issue. There is no risk to personal sensitive information that we’re aware of, although we are continuing to monitor the environment very closely. Nonetheless, this has caused huge disruptions across the state of New York around the country. And indeed the globe,” Hochul said.
Emergency services, mass transit up and running
“There are no calls that are being held or missed. There is no backlog at the FDNY,” Adams said. “We want to assure New Yorkers that 911 call systems have not been impacted. Our infrastructure and emergency operations, they are all in place.”
Traffic signals were also not impacted. New York City subways, buses, commuter rails and paratransit were also not impacted. All hospitals in the city were functional. The Staten Island Ferry was running as normal. The city’s Summer Rising program will continue as normal.
The extent of the impact in the subway system was some countdown clocks may not be working on some platforms.
“The airline system may be in disarray, but New York City’s public transit system is going full speed,” MTA chair and CEO Janno Lieber said.
Breaking down the outage and the response
New York City’s Chief Technology Officer Matt Fraser said city officials started to detect the issue at approximately 12:20 a.m.
“This is one of the reasons why we have New York City Cyber Command, and we have a citywide operations center, so we can detect these things as quickly as possible, and dispel what’s a threat versus what’s not a threat,” Fraser said. “So as we started to see the symptoms manifest, we contacted our partners both at Microsoft and at CrowdStrike, and subsequently we got down to the root of the issue.”
Fraser said it’s important for cybersecurity that operations like CrowdStrike push out updates in realtime.
“When they push a patch, if that patch goes wrong, this is a perfect example of how bad that can be,” Fraser said.
Fraser said by 1:30 a.m. CrowdStrike had stopped deploying that bad patch.
“Unfortunately, the recovery at this moment is a fairly manual process that requires a physical touch to most of the machines, and we have a team of people that are working across the city in realtime trying to get things up and running in real time,” Fraser said. “The good news is that despite the challenge that appeared today, our most critical services remain up and running, and we have a pathway to recovery to bring everything else up.”
Fraser said the city’s most critical services are isolated and kept “in a separate environment.” He said that automatic updates to those services are applied only after they’ve been thoroughly tested beforehand.
