As Microsoft services recover, a multi-day cloud outage is triggering complex business-disruption claims.
Corporate treasuries are just beginning to calculate losses from the multi-day outage and performance degradation of many core Microsoft services that began on Nov. 12, as the tech giant continues restoring Copilot, Microsoft 365, Outlook, and Teams connectivity.
“We’re seeing encouraging recovery progress, with service availability and email delivery performance improving across a growing portion of affected infrastructure,” said Charles Lamanna, executive vice president of Copilot, Agents, and Platform at Microsoft Inc. “We know our customers rely on our services to get important work done every day, and we regret the impact these outages had on those who depend on us. Our teams are reviewing what happened and how we can prevent similar issues going forward.”
A platform outage at a provider of Microsoft’s scale has concerned insurers because it can create aggregated exposure across cyber insurance policies, said Sasha Romanosky, a senior policy researcher at the global policy think tank RAND Corp.
Various cyber modeling companies like CyberCube Analytics Inc.; RMS, a subsidiary of Moody’s Corp.; and others, as well as carriers, brokers, and reinsurers, have modeled the risk using data from other historic cloud outages to estimate losses, he added.
“This one was longer than others, so observing the subsequent losses and claims will help us understand the shape of the loss curve,” said Romanosky. “In other words, is the loss from a 10-hour outage equal to just 10 times the loss from a one-hour outage; is it more; is it less?”
Making a Claim
No matter what, calculating losses will be a battle for forensic accountants, said Joshua Gold, a partner at the law firm Anderson Kill.
“Some cyber insurance covers system disruption no matter what the cause,” he said. “Other policies cover system disruption, but only if it’s at the hands of a cyber threat actor. Both are very common in policies today.”
However, insurance carriers take a hard line against business-disruption claims, commonly arguing that policyholders ultimately made up their losses one way or another through subsidiaries.
“Forensic accountants are usually quite good at providing a reasonable calculation of what would have been made but for the loss event,” said Gold.
Companies should not delay notifying their cyber insurance carrier of their intent to file a claim and should provide an overview of the event and any lingering issues affecting their business, he added. “After that, keep constant dialogue with your insurance company, but commit much of this to writing. Phone calls to your broker or the 1-800 claims number aren’t good enough.”
Rob Daly writes about the economy and fintech. You can reach him at rdaly@gfmag.com.
