Airline IT outage cost: Southwest 2022, Delta 2016, BA 2017 priced

Historical Reference Events

Major airline IT outages, disclosed costs

Southwest December 2022

The largest airline IT-caused meltdown on record

Winter Storm Elliott began affecting US air operations on 21 December 2022. Most US carriers managed the storm and resumed normal operations by 24 or 25 December. Southwest did not. Between 21 and 29 December, Southwest cancelled approximately 16,700 flights, stranding an estimated 2 million passengers during the highest-revenue travel week of the year.

The proximate cause was the in-house SkySolver crew scheduling system. Once severe weather disrupted the planned routing for a critical mass of crews, SkySolver was unable to re-optimise the schedule fast enough to keep up with the cascading effect of out-of-position crews and aircraft. Crew check-in lines at major hubs reportedly required 14-hour waits. The recovery was effectively manual.

Southwest disclosed approximately $1.1 billion in net cost across reimbursement and refunds (around $600 million), lost revenue (around $375 million), and incremental operating costs from the disrupted schedule (around $125 million). In December 2023, the Department of Transportation issued a $140 million civil penalty, the largest in DOT consumer-protection history. The Hubbard External Review report subsequently identified longstanding under-investment in operational IT as a contributing factor.

For a CTO or CFO building an internal business case for IT modernisation, the Southwest case is the single most-citable reference point. The cost-per-day of a major airline IT failure at peak travel is approximately $135 million ($1.1B / 8 days), which sets a defensible floor for any "what does it cost if our scheduling system fails on Christmas Eve?" analysis.

Delta August 2016

The data center power failure case

On 8 August 2016, a power failure at Delta's Atlanta data center took down the airline's passenger-facing systems for approximately five hours of acute outage, with operational impact extending across three days. 2,300 flights were cancelled. Delta disclosed $150 million in direct cost in its Q3 2016 10-Q filing. The disclosed figure included passenger compensation, rebooking, hotels, and lost revenue.

What makes the Delta 2016 case useful is that it triggered a multi-year data center modernisation programme that Delta executives subsequently cited in investor presentations. The $150 million event cost is the bottom of the iceberg. The remediation investment in the following years was much larger. For a board considering whether to fund data center resilience improvements, the right comparator is not just the avoided single-event cost but the avoided remediation-programme cost that follows a public failure.

British Airways May 2017

The bank-holiday weekend case

On Saturday 27 May 2017 (the Saturday of a UK bank-holiday weekend), a power surge at a data center near Heathrow took down most of British Airways' passenger-facing systems for approximately 12 hours of acute outage, with operational impact extending across the entire bank-holiday weekend. Approximately 75,000 passengers were stranded and 672 flights were cancelled at Heathrow and Gatwick.

Parent company IAG disclosed approximately £80 million in cost in subsequent reporting. The cost was almost evenly split between contingent compensation (EU261 payments, hotel and meal vouchers, rebooking on other carriers) and brand-damage spend in the following six months as competitors targeted BA's frequent-flyer base. The EU261 line alone, applied to 75,000 passengers at an average of around £350 per passenger, comes to approximately £26 million.

Per-Cancellation Cost Stack

What a single cancelled flight costs the airline

The aggregate dollar figure of an airline outage is a function of the per-cancellation cost stack times the number of cancellations. The stack varies by jurisdiction (EU261 is more generous than US DOT rules), aircraft size (a 737 versus a 777 has very different passenger counts), and time of year (peak holiday rebooking is more expensive than off-peak). The table below lists the standard components.

For a single 737 carrying 175 passengers, a cancellation in the EU triggers approximately €87,500 of EU261 compensation alone (€500 per passenger at the typical short-haul rate), before any hotel, rebooking, or refund cost. For 672 cancelled flights at this rate (the BA May 2017 case), the EU261 line is approximately €58.8 million, which aligns with the ~£26 million figure once adjusted for actual passenger loads and the mix of refund-versus-rebook outcomes.

Regulatory Exposure

DOT, FAA, FCC, and EU regulator action

The Southwest 2022 incident produced a $140 million DOT civil penalty, the largest in DOT consumer-protection history. The DOT's authority to issue such penalties comes from 14 CFR Part 259 and Part 399 on customer service obligations. The penalty was negotiated to include $35 million in cash and $90 million in flight vouchers for affected passengers, plus a $15 million civil penalty.

For US carriers, the regulator-penalty risk is meaningful but largely depends on whether the outage produced a clear consumer-harm pattern. Pure technical outages without sustained customer-facing impact rarely trigger regulator action. Multi-day operational failures with poor communications and inadequate compensation routinely do.

For European carriers, EU261 is the dominant exposure and is operational rather than regulatory in nature (the obligation triggers automatically). For Asia-Pacific carriers, the regulatory framework varies by jurisdiction but is generally lighter than EU or US.

The Delta CrowdStrike Case

Third-party-caused outage cost recovery

The CrowdStrike Falcon update incident of 19 July 2024 affected most major US airlines, but Delta's recovery took meaningfully longer than its peers. Delta cancelled approximately 7,000 flights over five days, while United and American largely recovered within 48 hours. Delta subsequently filed a $500 million lawsuit against CrowdStrike (and a separate suit against Microsoft) seeking to recover the cost.

The case raises an unresolved question about when a supplier-caused outage is recoverable from the supplier versus when it is the customer's responsibility to maintain the resilience to recover quickly. CrowdStrike's contractual liability cap (typical of enterprise security contracts) is far smaller than Delta's claimed loss. The litigation is ongoing as of mid-2026 and will likely set a precedent for the cost-allocation of cascading supply-chain incidents. For more on the CrowdStrike incident itself, see our full CrowdStrike case study.

Frequently Asked

Common Questions