CrowdStrike outage could cause insurance industry losses of up to $1 billion
A Guy Carpenter report indicates that insurance losses from the CrowdStrike outage are expected to range between $300 million and $1 billion, and reminds the insurance industry to pay attention to the risk of more frequent small and medium-sized events.
Key Takeaways
- The global IT outage on July 19 caused by a faulty CrowdStrike Falcon software update is expected to result in insured losses of $300 million to $1 billion, according to a report released by Guy Carpenter on Friday.
- The report noted that losses could have been much larger if the event had been a malicious attack. A ransomware attack on such widely used technology systems could have resulted in losses of $600 million to $2 billion.
- Guy Carpenter suggested that the insurance industry needs to rethink its risk perspective, focusing not only on single 'super catastrophes' but also on more frequent, smaller-scale 'kitty cat' events.
In-Depth Analysis
The CrowdStrike event is widely regarded as one of the largest IT outages in history. The incident led to the cancellation of thousands of commercial flights globally, forced hospitals to postpone surgeries, and temporarily knocked out 911 emergency systems in multiple U.S. cities, causing widespread chaos.
Many insured institutions have filed notices of circumstances, but the claims process is still in its early stages. The report estimates that less than 1% of companies worldwide with cyber insurance were affected.
A report by Parametrix released in late July estimated that Fortune 500 companies would face $5.4 billion in direct losses (excluding Microsoft) due to the outage. Moody's reported that the majority of insured losses would be driven by business interruption claims.
The insurance industry may need to incorporate smaller but more frequent catastrophic events into its modeling considerations. Findings in the Guy Carpenter report indicate that the CrowdStrike event will not cause material losses for most insurers. However, this situation may vary depending on insurers' policy wording, underwriting concentration across industries, and the take-up rate of system failure coverage.
Since May 2023, the widely exploited MOVEit file transfer vulnerability, the Change Healthcare attack, attacks on Snowflake customers, and the CDK Global cyberattack, when combined with this new event, could have a 10% loss ratio impact on the insurance industry. The company stated that this is closer to the magnitude of a single catastrophic event.