U.S. prosecutors and regulators investigating a $32 million deal between CrowdStrike Holdings Inc. and a technology distributor are probing what senior company executives may have known about it and are examining other transactions made by the cybersecurity firm, according to two people familiar with the matter.
In recent months, investigators with the Justice Department and the Securities and Exchange Commission have been probing the transaction between CrowdStrike and the distributor, Carahsoft Technology Corp., to supply cybersecurity software to the Internal Revenue Service. CrowdStrike has previously said that Carahsoft made on time payments for the order. However, the IRS never purchased or received the products. It remains unclear why the companies struck the deal without an IRS purchase, but Carahsoft previously said it stands by the transaction.
Investigators have questioned former employees about how the deal was struck, what awareness CrowdStrike’s leaders had of it and whether staff raised concerns about other transactions, the people said. Investigators have also obtained internal CrowdStrike records, said the people, who asked not to be named because they aren’t authorized to discuss the matter.
The investigators’ questions suggest the parallel SEC and DOJ probes into CrowdStrike are broader than previously known.
CrowdStrike spokesperson Brian Merrill said in an email, “As we have stated previously, we stand by the accounting of the transaction.” Carahsoft representatives didn’t respond to calls and emails seeking comment; a lawyer for the company had previously declined to comment on the federal investigations.
Prosecutors from the U.S. Attorney’s Office for the Southern District of New York have taken the lead in questioning several witnesses, the people said. A spokesperson for the Manhattan federal prosecutor’s office, Nicholas Biase, declined to comment, as did SEC spokesperson Cory Jarvis.
Shares of CrowdStrike fell 2.3% in premarket trading on Friday following Bloomberg’s report on the scope of the federal investigations.
Around the time CrowdStrike closed the deal for the IRS, on the last day of a fiscal quarter in 2023, some staff at the Austin, Texas-based company raised concerns that it was “pre-booking” the transaction, Bloomberg previously reported. The employees viewed the deal as incomplete because it was unclear whether the tax agency would ultimately make the purchase.
U.S. regulators have in some cases sued and fined companies over alleged pre-booking, also known as channel stuffing, claiming they misled investors by improperly recognizing revenue to inflate their financial figures.
In interviews starting last fall, prosecutors and regulators have asked whether CrowdStrike employees believed other deals were handled in similar ways, the people said. The investigators have specifically asked about another 2023 transaction involving the IRS that was worth more than $1 million, they said.
According to one of the people, investigators also inquired about multi-million dollar deals for the Department of Health and Human Services and the Department of Energy.
A CrowdStrike spokesperson, Jeremy Fielding, told Bloomberg in October that a deal for the Department of Energy’s National Nuclear Security Administration was among transactions put through a “second, independent and thorough review” in response to employee concerns. He said the $32 million deal also got “a separate and extensive review,” that each transaction had “non-cancellable order” and that “it is demonstrably false that there was any ‘pre-booking.'”
Among the internal CrowdStrike records that investigators have obtained are employee responses to questionnaires meant to ensure transactions comply with the Sarbanes-Oxley Act, the people said. The law, passed after several accounting scandals in the early 2000s, was intended to reduce corporate fraud by improving financial auditing and public disclosure requirements.
One of these records showed an employee formally expressed concerns that the company handled the $32 million deal inappropriately, one person said. Investigators have also sought detailed information about CrowdStrike’s process for closing the transaction and asked about who in the company’s sales and corporate leadership may have been involved in different aspects of it, the people said.
The transaction was big enough that it could have made the difference between CrowdStrike beating or missing Wall Street projections on two key financial metrics for the quarter in which it closed in 2023. The company has declined to detail to Bloomberg how it accounted for the deal.
Chief Executive Officer George Kurtz highlighted it in an earnings call after markets closed on Nov. 28, 2023, saying, “identity threat protection wins in the quarter included an eight-figure total deal value win in the federal government.” The day after CrowdStrike reported results for the record quarter, its shares rose 10%.
Carahsoft paid CrowdStrike on time for the deal, the cybersecurity firm told Bloomberg last fall.
Both companies said then that they had a “non-cancellable order” between them, but declined to say why they struck the deal without a purchase from the IRS. A purchase order seen by Bloomberg split the purchase into four $8 million payments, with the final payment due at the end of last October.
Last November, CrowdStrike excluded roughly $26 million from the annual recurring revenue in its quarterly earnings report. Chief Financial Officer Burt Podbere said the company determined a transaction wouldn’t be repeated “after a distributor in the federal space provided notice of its intention to exercise transferability rights with respect to a transaction.” CrowdStrike representatives have declined to elaborate.
