When a faulty CrowdStrike software update crashed millions of Windows computers in July 2024, Delta alone cancelled around 7,000 flights, stranding roughly 1.3 million passengers. Now the travellers caught in that chaos are asking the US Supreme Court to let them sue — after lower courts threw out their case on a legal technicality that has nothing to do with who caused the mess.
The passengers sued CrowdStrike, not Delta, arguing the cybersecurity firm failed to properly test and release its update. Lead plaintiff Julio del Rio spent about $1,200 replacing tickets for himself and his wife, slept on airport benches during an 11-hour overnight delay in Kona, Hawaii, and got home 17 hours late. His lawsuit, filed in August 2024, claimed negligence, failure to warn, and public nuisance.
But a federal judge dismissed the case in June 2025, and the Fifth Circuit backed that decision in May. The reason: the 1978 Airline Deregulation Act bars states from regulating airline 'price, route, or service' — including schedules. Courts have ruled that even ordinary negligence claims count as state regulation if they touch airline services, and that a damages award can pressure a company into changing how it operates. So the passengers' claims over cancelled flights, rebooking and baggage were deemed off-limits — even though the defendant isn't an airline and sold nothing to the travellers at all.
The contrast with Delta is stark. The airline bought CrowdStrike's product directly, and a Georgia judge let most of Delta's own lawsuit against the company proceed, including contract and gross negligence claims. The stranded passengers have no such contract to point to, since CrowdStrike made them no promises.
Their Supreme Court petition, filed September 14 as del Rio v. CrowdStrike, asks the justices to resolve a long-running disagreement among appeals courts over what 'service' actually means under the deregulation law. The Fifth Circuit reads it broadly to cover anything passengers bargain for — ticketing, boarding, baggage, food. The Ninth Circuit reads it narrowly, focusing on prices, schedules and routes. The Eighth Circuit joined the broad camp just this month, widening the split. Even so, legal observers give the case roughly a 10% chance of being heard, since no other appeals court has allowed a comparable suit against a software vendor, and CrowdStrike's response is due October 16.
Why should travellers care? Because right now, if a third-party vendor's failure wipes out your flights, the airline has legal recourse but you likely don't. Passenger advocates argue Congress should clarify that ordinary negligence claims survive deregulation preemption — travellers would still have to prove the vendor owed them a duty and caused their losses. Until that happens, your compensation options after a mass IT meltdown remain limited to airline goodwill and credit card protections rather than the courts. It's a small legal filing with big implications for who pays when the system breaks.
