For the insurance industry, the incident is another reminder that cyber risk is no longer confined to data breaches, ransomware attacks or malicious activity. Technology failures at major cloud and software providers can create widespread business interruption losses, even in the absence of a cyberattack, said analysts.
Washington:The global Microsoft outage could generate insurance claims of between $300 million and $500 million, although the overall impact on the insurance industry is expected to remain manageable, according to credit rating agency Morningstar DBRS.
The disruption has affected businesses and institutions across multiple sectors and geographies, potentially triggering claims under cyber insurance, business interruption and other commercial insurance policies.
Mario De Cicco, vice president of European financial institutions at Morningstar DBRS, estimated global insured losses from the incident at $300 million to $500 million.
While significant, the estimated claims burden is below the $400 million to $1.5 billion financial toll associated with the July 2024 CrowdStrike outage, which crashed more than eight million Windows-based computers and caused widespread business disruptions.
The latest incident, however, raises fresh questions about insurers’ exposure to systemic risks arising from the growing concentration of digital infrastructure and dependence on a handful of technology providers, said analysts.
Microsoft has experienced several service disruptions in recent months. Its Microsoft 365 services suffered outages in January this year and October last year, while a disruption involving its Azure cloud platform last month affected productivity applications and businesses worldwide.
“The bigger worry is that this is not the first Microsoft 365 outage this year,” said Josh Gilbert, a market analyst at trading platform eToro.
Repeated disruptions could prompt businesses to reconsider their dependence on a single technology provider. However, analysts point out that switching costs remain high because Microsoft services are deeply embedded in corporate operations.
From an insurance perspective, the extent of losses will depend on the nature of individual policies, coverage extensions, business interruption provisions and applicable exclusions. The incident also highlights the complexity of determining liability and coverage when a disruption at a single technology provider affects thousands of policyholders simultaneously.
The outage affected a broad range of commercial and public-sector operations.
British insurer Aviva activated backup arrangements for its earnings calls, while European exchange operator Euronext reported email disruptions. Danish shipping giant Maersk warned customers of delayed updates.
In India, airlines IndiGo, Akasa Air and Air India reported disruptions to their email support services.
Financial institutions in Taiwan also experienced operational difficulties, with fund management activities at securities firms, life insurers and investment trust companies affected. One company reportedly cancelled a bond repurchase transaction, while another resorted to fax communications to confirm trades.
The disruption also affected the UK’s National Health Service and London’s Metropolitan Police. The latter said its inability to access email and other services affected the reporting of certain crimes online, although emergency response operations continued.
US artificial intelligence companies OpenAI and Anthropic also reported problems with Microsoft connectors.
Australian Cyber Security Minister Tony Burke said Microsoft did not suspect a cyberattack, indicating that the disruption was related to its email systems.
For the insurance industry, the incident is another reminder that cyber risk is no longer confined to data breaches, ransomware attacks or malicious activity. Technology failures at major cloud and software providers can create widespread business interruption losses, even in the absence of a cyberattack, said analysts.
It also brings the issue of cyber insurance accumulation into sharper focus. A single outage can affect policyholders across multiple industries and countries at the same time, creating the potential for correlated claims across insurers and reinsurers.
As businesses increasingly depend on cloud platforms and interconnected digital systems, insurers face growing challenges in pricing cyber risks, assessing third-party technology exposures and managing the possibility of multiple claims arising from a single event.
:::