News

Insurers could face a raft of business interruption claims after crippled industries from travel to finance on July 19, insurance industry experts said. A software update by global cyber-security firm CrowdStrike appeared to have triggered systems problems that grounded flights, forced some broadcasters off the air and left customers without access to services such as healthcare or banking. “Insurers are bracing for hundreds, if not thousands, of claim notifications from organisations that are impacted by the CrowdStrike event,” said Mr Ryan Griffin, a partner focused on cyber at insurance broker McGill and Partners. However, not all businesses will get insurance cover for their lost time and money. A typical business interruption policy within a regular commercial insurance programme would not provide coverage against losses stemming from the July 19 outage, said Mr Marcos Alvarez, head of insurance at ratings agency DBRS Morningstar. And not every cyber insurance policy likely has coverage for business interruption; such coverage would have to be bought separately at extra cost. “Some cyber insurance policies exclude non-malicious events, and there are waiting periods and deductibles that businesses will have to consider before making a claim with their insurance carriers,” said Mr Nir Perry, chief executive at CyberWrite, a cyber insurance risk platform. Mr Perry said economic damages could reach tens of billions of dollars in such events, and added the outage should be considered an example of an “event that can produce what could be defined as an insurance catastrophe”. The event could also bring with it legal claims for CrowdStrike and Microsoft. A defective update by CrowdStrike, designed to protect Microsoft Windows systems, triggered the global information technology outage. CrowdStrike and Microsoft did not immediately respond to requests for comment. “Airlines (and other industries) might have rights under their contracts that allow them financial or other remuneration based on the CrowdStrike outage,” said Mr Sam Levine, senior vice-president of professional and cyber solutions at speciality insurance broker CAC. The outage caused major issues for travellers around the world – grounding planes for hours. Travel insurer InsureMyTrip said it anticipates an increase in travel insurance claims, with the most from travel delay and missed connection policies. More than 1,600 customers may be impacted as they depart for or return from trips on July 19, it said. Industry experts also said that force majeure would not apply for the event. Force majeure clauses in contracts remove liability for unforeseeable and unavoidable catastrophes that prevent participants from fulfilling obligations. “This is exactly what cyber insurance is meant to cover. This is not something that is outside of our control,” said Ms Meredith Schnur, the US and Canada cyber practice leader at broker Marsh. REUTERS