I wonder how they came to this number? And how reliable is it? It is very quick and relatively a very small number. Very convenient for damage management.
But Windows has to boot before it can send telemetry, right?
Device that was sending telemetry data with Crowdstrike installed and is no longer sending telemetry data after the event time frame can be considered to be affected.
Another possible source is Crowdstike itself who definitely has the data.