DOJ and SEC Investigate $32 Million CrowdStrike Contract with Carahsoft

Federal authorities scrutinize cybersecurity deal for potential misconduct

The U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) are currently investigating a substantial $32 million contract between CrowdStrike Holdings Inc. and Carahsoft Technology Corp., aimed at providing cybersecurity tools to the Internal Revenue Service (IRS). This inquiry is based on insights from individuals familiar with the matter and documents reviewed by Bloomberg News. Investigators have reportedly been interviewing relevant parties and collecting documentation related to the deal, as the investigation raises questions about the transaction's legitimacy and financial implications for both companies.

The agreement was finalized by Carahsoft on the final day of CrowdStrike's fiscal quarter in 2023; however, the IRS never proceeded with the actual purchase of the software. Reports from Bloomberg suggest that this deal was significant enough to potentially influence CrowdStrike's financial results, with the firm later experiencing a notable 10% increase in its stock value the day after announcing impressive quarterly results. However, CrowdStrike has refrained from elaborating on the specifics of how this transaction was recorded in its financial statements.

The dual investigations represent heightened scrutiny not only of CrowdStrike but also of Carahsoft, a key distributor of technology solutions for the U.S. government. Previously, the FBI conducted a search at Carahsoft’s headquarters, and there is an ongoing civil investigation into allegations of overcharging the government in collaboration with another technology company.

In response to the investigation, CrowdStrike’s spokesperson Brian Merrill expressed confidence in the transaction's accounting, while Carahsoft's legal representative, Samarth Barot, chose not to comment. Officials from the U.S. Attorney’s Office for the Southern District of New York and the SEC have similarly refrained from commenting on the investigation's status.

According to sources, the SEC and DOJ have already begun interviewing former CrowdStrike employees and IRS officials, continuing to gather records and communications related to the deal. Investigators have focused on the interactions between CrowdStrike sales representatives and IRS officials leading up to the deal, particularly inquiring about the IRS's actual purchase of CrowdStrike's software, to which they received a consistent response of "no."

The specifics surrounding the deal remain convoluted. It was intended for identity threat protection software for the IRS, but the agency never completed the acquisition. CrowdStrike's CEO George Kurtz previously highlighted this deal in an earnings call, suggesting it was a significant win in federal government sales. Nonetheless, CrowdStrike has clarified that despite ongoing payments from Carahsoft, the lack of an official purchase order from the IRS raises questions about the validity of the agreement.

In November 2024, CrowdStrike disclosed that it excluded approximately $26 million from its annual recurring revenue for the quarter, attributing this unusual decision to a distributor's intention to exercise transferability rights concerning the deal. Although CrowdStrike's representatives have not confirmed whether this statement is linked to the IRS and Carahsoft agreement, they did assert that concerns regarding “pre-booking” the transaction were unfounded, emphasizing that their accounting was scrutinized and approved.

Federal investigations of this nature often extend over several years, with many concluding without any formal accusations. Adam Pritchard, a law professor at the University of Michigan and former SEC attorney, noted that the inquiry could impose significant legal costs on both CrowdStrike and Carahsoft, consuming valuable time for their executives and drawing attention from their respective boards. Investigators are likely examining whether there were any undisclosed understandings between the companies about the deal's execution, particularly if there were implicit agreements concerning financial arrangements should the IRS transaction fail to materialize.

As the investigation unfolds, the implications for CrowdStrike, Carahsoft, and their stakeholders remain significant, potentially affecting their reputations and operational practices moving forward.