Mario de Cicco, VP, European Financial Institutions, Morningstar DBRS: "The Microsoft outage could result in a number of insurance claims, mostly related to businesses experiencing financial losses, operational disruptions, and delays in serving customers. However, not all businesses will automatically be entitled to compensation, as this depends on the terms and conditions of their insurance policies.
|
Some cyber insurance policies only cover losses caused by malicious cyberattacks, whereas the Microsoft outage appears to have resulted from a technical failure rather than a deliberate attack. Additionally, some policies include waiting periods before business interruption cover becomes effective.
The 2024 CrowdStrike outage is a useful comparison. The issue was caused by a faulty software update that affected around 8.5 million Windows devices worldwide. It disrupted major industries, including airlines, hospitals, banks, and retailers, and caused flight cancellations, business interruptions, financial losses, and delays in services that generated insurance claims. The CrowdStrike had a significant global impact—according to CyberCube, it generated insurance losses between USD 400 million and USD 1.5 billion. Although currently less severe, if the Microsoft outage continues for several days, it could become equally serious or potentially worse.
Both outages highlight the credit and operational risks that insurance companies face from their growing reliance on concentrated technology providers and server infrastructures, the consequences of which are difficult to predict. The ultimate impact on claims will be determined by the scope of policy coverage, and insurers’ responses will depend on the waiting period, deductibles, sublimits, and exclusions. Economic losses outside of policy terms and conditions will be borne by businesses.
In our view, the overall credit impact of the Microsoft outage on insurers is likely to be limited, with global insured losses estimates at USD 300 million to USD 500 million, well below the CrowdStrike outage estimates. This reflects the potentially limited coverage under existing cyber policies and exclusions for nonmalicious tech failures. However, this remains a preliminary estimate given the ongoing nature of the outage and the uncertainty surrounding its ultimate duration and overall impact."
|
