Case Study: Windows Update KB5094126 Causes Data Loss

Two Independent Incidents – Custom Build (ASUS Z390) and HP Pavilion

Author: Wasmut Fiedler, Dipl.-Inf. (FH) · IT Consultant · July 19, 2026

Summary

The Windows 11 June 2026 Patch Tuesday update KB5094126 (Build 26200.8655 / 26100.8655) caused complete data loss on two unrelated systems due to a BSOD with the error CRITICAL_SERVICE_FAILED (0x5A). Both incidents were carefully documented and forensically investigated using Recovery-Tool. The identical failure pattern on different hardware largely rules out hardware- or manufacturer-specific causes and points to a system-related error in the update.

Incident 1 – Doctor’s Office in the Ostalb Region (Custom Build, ASUS Z390)

1.1 System Configuration

Hardware:

Manufacturer:   Custom Build (Alternate), Order No. 271724227, March 18, 2020

Motherboard:    ASUS ROG STRIX Z390-E GAMING

CPU:          Intel Core i7-9700K

RAM:          16 GB DDR4-3200

SSD (original):  2x Samsung 970 EVO Plus 500 GB in RAID-1

RAID:         Intel RST (Intel RAID 1 Volume)

OS:           Windows 11 Pro (UEFI boot, originally Win 10 Pro)

Build:        26200.8655 after KB5094126

EFI Partition:    100 MB (system partition)

Recovery:     1.02 GB, of which 985 MB is used (96% full)

1.2 Sequence of Events

July 3, 2026, approx. 6:00 PM: Installation of the CapiCall (Shamrock) software via remote support. After a reboot, a BSOD with the error CRITICAL_SERVICE_FAILED (0x5A) appeared. Initially, CapiCall was suspected as the cause, as the timing seemed to correlate.

Extensive recovery attempts over several hours were unsuccessful. A forensic analysis using recovery tool revealed that patient data from the last 6 weeks could no longer be recovered. Older data (dating back to November 2025) was only partially recoverable. All newer file segments found had been overwritten with NULL bytes.

The last available complete backup was from May 16, 2026—prior to the June update. The data loss covers the entire period following the last backup, including the complete Q2/2026 quarterly billing statement to the Baden-Württemberg Health Insurance Fund (estimated loss: approximately 100,000 euros).

1.3 Subsequent Findings

After the KB5094126 issue came to light due to a second independent incident (see Section 2), the initial suspicion regarding CapiCall was revised. The BSOD error code CRITICAL_SERVICE_FAILED (0x5A) matches exactly the reported symptoms of KB5094126 on other systems. The full recovery partition (985 MB of 1.02 GB used) matches the pattern described by Windows Latest: On devices with a small or full EFI/recovery partition, the Secure Boot certificate update from KB5094126 fails—resulting in a BSOD.

Incident 2 – Personal HP Pavilion Laptop

2.1 System Configuration

Hardware:

Manufacturer:   HP (Pavilion, Model 17-cd0111ng)

OS:           Windows 11 Pro

Last update before the incident: March 2026 (all updates through March installed)

Update:       KB5094126 (June 2026 Patch Tuesday)

2.2 Sequence of Events

June 25, 2026: The user started the laptop after a long period of inactivity (last used in March 2026). Windows automatically installed the pending June update KB5094126. After restarting, the system was no longer bootable. All of Windows’ built-in recovery mechanisms failed.

A forensic analysis using recovery tool revealed the same damage pattern as in Incident 1: the directory structure was only rudimentarily intact, and most file areas had been overwritten with NULL bytes. Private data—including documents required by the tax office—could not be recovered. A complete reinstallation of Windows was necessary.

2.3 Significance of This Incident

This incident is particularly significant from a forensic perspective because it completely rules out third-party software as the cause. The laptop had not undergone any changes since March 2026. The only new element was KB5094126. The identical damage pattern on completely different hardware (HP instead of ASUS, different SSD, different configuration) proves that the cause lies in the update itself.

3. Forensic Findings – Identical Damage Pattern

After analysis with recovery tool, both systems exhibited the same pattern:

• Directory structure partially still intact (filenames, metadata)

• File contents predominantly overwritten with NULL bytes (0x00)

• Newer data more severely affected than older data—typical of TRIM activation

• Operating system completely compromised

• No signs of external interference (no virus, no ransomware)

The NULL-byte pattern is characteristic of a TRIM command executed immediately after data loss—which is typical in the case of a BSOD on modern NVMe SSDs. The combination of a BSOD caused by KB5094126 and an immediate TRIM command explains the complete and irreversible data loss.

Classification as part of the known KB5094126 issue

KB5094126 was released on June 9, 2026, as the June Patch Tuesday update for Windows 11 24H2 and 25H2. Immediately after the rollout, reports of system failures began to surface:

• Over 150 reports in less than 48 hours on Windows Latest

• BSOD error codes 0xc0430001 and CRITICAL_SERVICE_FAILED (0x5A)

• BitLocker recovery loops on affected systems

• HP systems particularly affected, but other hardware is also impacted

• Cause: The update affects Secure Boot files, certificates, and EFI content

• The update fails on devices with a small EFI partition (100 MB)

Microsoft has confirmed isolated issues with KB5094126 but has not yet officially acknowledged the BSOD error (as of July 19, 2026).

5. Why this report is important

The incidents documented here differ from most reported KB5094126 cases in one key respect: the data loss is irreversible.

While most affected users “only” experienced an unbootable PC—a problem that could be resolved by uninstalling the update or performing a system restore—the combination of BSOD and NVMe-TRIM resulted in complete data loss on both systems documented here. Professional data recovery companies (Kroll Ontrack, Attingo, comfor-it) confirmed the irreversibility of the data loss.

The financial damage in the business case (approximately 100,000 euros in quarterly revenue) as well as the personal damage in the private case (tax documents) far exceed what can be expected from a security update.

6. Demands and Recommendations

To Microsoft:

• Official acknowledgment of the BSOD issue caused by KB5094126 on systems with a small EFI/recovery partition

• Pre-installation check: Ensure sufficient storage space on the EFI/recovery partition

• Warn or block installation if the recovery partition is more than 90% full

• Goodwill policy for affected users who have suffered irreversible data loss

• Improve TRIM behavior during a BSOD: Do not perform an immediate TRIM before creating a minidump

To system administrators and IT support staff:

• Check the recovery partition before Patch Tuesday updates—ensure at least 500 MB of free space

• Evaluate NVMe TRIM in critical environments—disabling TRIM increases the chances of data recovery

• Perform a backup immediately BEFORE Windows updates—not just as part of daily routine backups

• On NVMe SSDs: Reevaluate your backup strategy—TRIM makes data recovery after a BSOD virtually impossible

7. Sources and Further Reports

Windows Latest, June 14, 2026: ‘Windows 11 KB5094126 causes BSODs on some PCs (HP?), breaks OneDrive in File Explorer’

Windows Latest, June 21, 2026: 'Microsoft confirms issues in Windows 11 KB5094126 June 2026 update'

Neowin, June 15, 2026: ‘Windows 11 KB5094126 Causes BSODs, Freezing, and Forces BitLocker Lockout’

allthings.how, June 16, 2026: 'Windows 11 KB5094126 Issues: BSOD, BitLocker, and OneDrive Fixes'

WinCentral, June 16, 2026: ‘Windows 11 KB5094126 Issues: BSOD, BitLocker, & OneDrive’

CyberSecurityNews, June 15, 2026: 'Windows 11 Update KB5094126 Freezes Systems, Forces BitLocker Recovery'

Microsoft Feedback Hub: Multiple entries regarding CRITICAL_SERVICE_FAILED after KB5094126

The author is available for questions and additional information.