world415_aeu_01

We want to get ahead of preparing a settlement agreement for the Delta matter. Can you let me know which of Delta’s original causes of actions are no longer live as we head into the pre-trial conference in March? You can ignore the derivative claims, though I would like to know if punitive fees are likely to apply and whether there is a limit to them based on CrowdStrike’s litigation case file against Delta. And, assuming that IronPeak agrees to insure us during mediation next week, please also ...

1. Delta's Causes of Action
Based on Delta’s complaint (“Delta-v-CrowdStrike-Complaint-10-25-24.pdf”), Delta pleaded seven causes of action under the Official Code of Georgia Annotated (OCGA) in its complaint (see Counts I through VII) and further asserted two derivative claims (see Counts VIII (Attorney's Fees) and IX (Punitive Damages)).

CrowdStrike filed a motion to dismiss Delta’s complaint for failure to state a claim, which the Court’s order allowed in part and denied in part.

As a result, there are two causes of action from Delta's original pleadings that are no longer live: Count V on page 30: Strict-Liability: Product Defect and Count VII on page 31: Deceptive and Unfair Business Practices (OGCA § 10-1-391 et seq.).

2. Analysis on Punitive Damages
Punitive damages are likely to apply if the Court finds that there was gross negligence. 

Punitive damages are pled pursuant to OGCA § 51-12-5.1 (see “Georgia Code 51-12-5.1.pdf”), and the statute specifies that punitive damages “may be awarded only in such tort actions in which it is proven by clear and convincing evidence that the defendant's actions showed willful misconduct, malice, fraud, wantonness, oppression, or that entire want of care which would raise the presumption of conscious indifference to consequences.” Thus, a successful claim for punitive damages must be (1) tied to a tort action, and (2) demonstrate that the punished party acted with willful intent. 

Given CrowdStrike's immediate actions following the cybersecurity incident (e.g. press releases, contacting Delta, filings to the SEC on the same day as the incident, etc.), it is difficult to establish that punitive damages are warranted for most of the causes of action alleged (computer trespass, trespass to personalty, and breach of contract). Additionally, the Court's order narrowed the scope of Delta's claim on the basis of intentional misrepresentation/fraud by omission (See page 39: "The Court finds Delta has failed to state a claim for fraudulent inducement for any misrepresentations prior to June 30, 2022 based on Delta's affirmation of the SSA which contains a merger clause."; page 44: "In light of all the foregoing, the Court finds Delta has stated a claim for fraud albeit more limited than the claim Delta has alleged."), principally to the clause in section 6.2 of the services agreement between Delta and CrowdStrike. As such, any punitive damages awarded are most likely tied to Delta's claim of gross negligence.

Georgia courts have found that the willful intent establishing a successful claim of gross negligence often also meets the requisite intent when determinng whether punitive damages should be applied for that same claim (for e.g. see McFann v. Sky Warriors, Inc., and Southern Bell Telephone & Telegraph Co. v. Coastal Transmission Service, Inc., 167 Ga. App. 611 (1983)). For other torts, the willful intent to establish punitive damages is often treated as a different standard (for e.g., see Monitronics International Inc. v. Veasley (2013)). Thus, if Delta's claim of gross negligence is successful, then it is likely that punitive damages will be awarded.

The punitive damages are likely limited to $250,000 by operation of OGCA § 51-12-5.1(g), which applies generally unless the punitive damages are claimed under OGCA § 51-12-5.1(e) (on the basis of product liability) or OGCA § 51-12-5.1(f) (which requires Delta to establish the higher standard of CrowdStrike having "acted, or failed to act, with the specific intent to cause harm") in which case they are unlimited. Since Delta's claim on the basis of product liability (Count V) is no longer part of the litigation, and Delta has not alleged that CrowdStrike acted with an intent to cause harm (in fact the Court's order acknowledged this in reducing the scope of Delta's claim misrepresentation), there is likely a $250,000 limit to any punitive damages awarded.

3. Budget
Finally, the budget we are working with as we head to trial is roughly $37M.

In the memo to Crowdstrike dated October 2, 2025 (“CrowdStrike Litigation Summary and Update Memo.pdf”), CrowdStrike was advised to retain a $30M reserve in light of the litigation costs ($18M at the time) and the potential insurance coverage of $25M. There were no additional changes to these figures in the most recent update most recent update memo to CrowdStrike regarding the litigation and regulatory exposure dated November 14, 2025 (“Analysis of Legal Exposure Final.pdf”). Thus, assuming that these figures are still representative of the current budget for CrowdStrike’s litigation against Delta, and assuming IronPeak is agreeable in the mediation, the budget is roughly $37M.