Hunton Insurance Recovery Blog

The November 12 Microsoft 365 outage is another reminder that some of the most disruptive cyber losses may have nothing to do with a cyberattack.

On November 12, a widespread Microsoft 365 disruption affected Exchange Online and functionality across Outlook, Teams, and other cloud-based services. Microsoft attributed the disruption to infrastructure problems, including servers becoming unavailable and a process used to establish secure connections becoming overwhelmed. Microsoft has reported no evidence of malicious activity to date.

For policyholders suffering losses from this or similar cloud outages, the absence of malicious activity does not necessarily mean the absence of insurance coverage. Modern cyber policies often extend protections beyond hacking and ransomware. Depending on the wording, potentially responsive coverage can include:

• Business interruption for income loss and extra expense resulting from a covered system failure of the insured’s computer systems;
• Contingent or dependent business interruption when disruption at a cloud, software, or other technology provider impairs the policyholder’s operations; and
• Extra expense and mitigation costs incurred to maintain operations, restore access, or reduce losses.

Indeed, even where the policyholder’s own computer systems have not experienced a system failure or security breach, contingent or dependent business interruption coverage may provide coverage for lost income and extra expense resulting from a vendor’s system failure or security breach. If your policy does not currently provide system failure coverage (or contingent business interruption coverage when the triggering event is a system failure rather than a security breach), discuss with your broker whether you can purchase a policy with that broader coverage at renewal.

Further, policyholders should consider that the Microsoft outage provides a real-world example of waiting periods in cyber insurance policies and how they impact potential coverage. These periods require that an outage last a certain number of hours before coverage can be triggered. While the outage may have felt like an eternity to corporate America, companies with a longer waiting period may not have coverage for the incident, depending on whether services and full operability were restored within that time period.

In contrast, policyholders with shorter waiting periods may be more likely to satisfy that threshold. Policyholders should discuss waiting-period options with their brokers at renewal, including whether a shorter waiting period may be available based on the company’s risk profile and underwriting information. Demonstrating strong controls and processes may help give the insurer sufficient underwriting comfort to offer a shorter waiting period.

As with all potential insurance claims, coverage will turn on the particular policy, including definitions of system failure and dependent service provider, waiting periods, sublimits, and causation requirements. Policy forms can differ significantly, and policyholders often can negotiate important coverage enhancements through endorsements tailored to their particular risks.

Policyholders experiencing material disruption should document downtime, operational impacts, lost revenue, and mitigation expenses now. They also should consider providing notice promptly rather than assuming that a widespread vendor outage falls outside their cyber coverage. As businesses become increasingly dependent on cloud infrastructure, companies and those who run them should work closely with brokers, outside coverage counsel, and other risk professionals to ensure that their insurance programs are designed to respond as broadly as possible for technology failures regardless of whether a threat actor is involved.