July 19 (Reuters) - Insurers could face a raft of
business interruption claims after a worldwide tech outage
crippled industries from travel to finance on Friday, insurance
industry experts said.
A software update by global cybersecurity firm CrowdStrike ( CRWD )
appeared to have triggered systems problems that
grounded flights, forced some broadcasters off air and left
customers without access to services such as healthcare or
banking.
"Insurers are bracing for hundreds, if not thousands, of
claim notifications from organizations that are impacted by the
CrowdStrike ( CRWD ) event," said Ryan Griffin, a partner focused on
cyber at insurance broker McGill and Partners.
However, not all businesses would get insurance cover for
their lost time and money.
A typical business interruption policy within a regular
commercial insurance program would not provide coverage against
losses stemming from Friday's outage, said Marcos Alvarez, head
of insurance at ratings agency DBRS Morningstar.
And not every cyber insurance policy likely has coverage for
business interruption; such coverage would have to be bought
separately at extra cost.
"Some cyber insurance policies exclude non-malicious events,
and there are waiting periods and deductibles that businesses
will have to consider before making a claim with their insurance
carriers," said Nir Perry, CEO at CyberWrite, a cyber insurance
risk platform.
Perry said economic damages could reach tens of billions of
dollars in such events, and added the outage should be
considered an example of an "event that can produce what could
be defined as an insurance catastrophe."
The event could also bring with it legal claims for
CrowdStrike ( CRWD ) and Microsoft ( MSFT ). A defective update by
CrowdStrike ( CRWD ), designed to protect Microsoft Windows systems,
triggered the global IT outage.
CrowdStrike ( CRWD ) and Microsoft ( MSFT ) did not immediately respond to
requests for comment.
"Airlines (and other industries) might have rights under
their contracts that allow them financial or other remuneration
based on the CrowdStrike ( CRWD ) outage," said Sam Levine, senior vice
president - professional and cyber solutions at specialty
insurance broker CAC.
The outage caused major issues for travelers around the
world - grounding planes for hours.
Travel insurer InsureMyTrip said it anticipates an increase
in travel insurance claims, with the most from travel delay and
missed connection policies. More than 1,600 customers may be
impacted as they depart for or return from trips on Friday, it
said.
Industry experts also said that force majeure would not
apply for the event.
Force majeure clauses in contracts remove liability for
unforeseeable and unavoidable catastrophes that prevent
participants from fulfilling obligations.
"This is exactly what cyber insurance is meant to cover. ...
This is not something that is outside of our control," said
Meredith Schnur, U.S. and Canada cyber practice leader at broker
Marsh.