Microsoft outage could generate $700 million in insured losses: Kovrr

Insured losses from the Microsoft 365 and Exchange Online outage could total around $700 million, Shalom Bublil, co-founder and chief product officer at Kovrr, said on Friday.

Bublil gave a preliminary range of $300 million to $1.4 billion for the outage, which began at 1617 GMT on Thursday. The estimate is based on the outage being resolved by 1900 GMT on Friday.

He based his estimate on economic losses of about $16 billion on a lost-productivity basis, with the gap between the economic and insured loss estimates reflecting restrictions on cover for non-malicious failures at technology providers and low cyber insurance uptake among small businesses.

Bublil described the figures as a “back-of-an-envelope” assessment, with most adjustment factors representing working estimates. Severity was the most sensitive assumption, while longer disruption during US business hours on Friday would increase insured losses, he said.

In an update around 1300 GMT on Friday, Microsoft reported continued recovery across affected regions but said some users could still experience intermittent access issues or delayed email. It said there was no evidence of malicious activity.

Microsoft outage hits Outlook, Teams and Copilot worldwide

DEPENDENT ON BUSINESS INTERRUPTION CLAUSE

Market sources told The Insurer the scale of cyber insurance claims arising from the outage would depend on whether affected companies have business interruption cover for accidental failures at technology providers and could demonstrate financial losses.

One reinsurer said it expected losses similar to those arising from the July 2024 CrowdStrike outage. An estimate by reinsurance broker Guy Carpenter (now Marsh Re) in January put insured losses from the CrowdStrike outage at approximately $250 million.

One broker said it had already received claims notifications relating to the outage.

“It’s a covered loss in many good cyber policies from a sort of system failure perspective,” Tom Dryden, partner at broker McGill and Partners, said. “It’s exactly the sort of event the market has been sort of concerned about from a broader systemic perspective, quite similar to that CrowdStrike outage of 2024.”

WHAT TRIGGERS BI COVER?

One cyber broker said some SME policies required a security failure or cyberattack before cover responded, potentially excluding losses from an accidental outage.

Other policies extend business interruption protection to non-malicious system failures. However, customers must establish whether that cover also applies to failures at outside technology providers, through dependent or contingent business interruption provisions.

Beazley’s published policy guidance, for example, includes dependent business interruption arising from either a dependent security breach or a dependent system failure.

Two cyber brokers who spoke to The Insurer cited waiting periods of 8 to 12 hours before business interruption cover could respond, depending on the policy and the duration of each customer’s qualifying disruption.

One broker also identified evidence of financial loss as a potential obstacle, particularly for professional services companies. Disruption to email may delay work at such companies without permanently reducing revenue if staff are able to rectify missed progress on work at a later date.

Beazley’s guidance says unproductive employee time alone does not establish an income loss where the business ultimately earns its normal revenue. Reasonable additional expenses incurred to avoid or reduce lost income may nevertheless be recoverable, depending on the policy. These could include temporary workarounds or additional staffing costs.

“It’s a bit early to tell [about losses], but there probably will be some slightly nervous insurers around the systemic nature of this,” Dryden said.