Business

Microsoft 365 outage: early estimate puts cyber losses at $300m-$500m

Marsh Re expects minimal insurance impact from the Microsoft 365 outage. What waiting periods and proof-of-loss rules mean for UK firms’ cyber cover.

Chart motif with the headline Microsoft outage leaves insurers largely unscathed, labelled cyber insurance

The Microsoft 365 outage that knocked out Outlook and Exchange Online for well over 12 hours is expected to cost cyber insurers relatively little, with early estimates of $300m to $500m in global insured losses. For UK businesses, the real story is how little of their own disruption their policies may actually pay for.

What happened

Microsoft 365 began failing at around 18:26 GMT on Thursday 12 November, according to the company’s service advisory. Outlook, Exchange Online and calendaring took the worst of it, with knock-on problems reported across other Microsoft 365 apps, including Copilot and Defender XDR, and in the connectors that third-party AI tools use to reach Microsoft 365 data.

The UK felt it directly. The government said it was working with Microsoft and had contingency plans in place, police forces were unable to take crime reports online, and the National Pharmacy Association warned that prescriptions could be delayed because NHS email was affected. By Friday morning US time Microsoft said services were broadly recovering, though intermittent delays persisted. It has said it found no sign of malicious activity and has promised a full root-cause account.

On Friday 13 November reinsurance broker Marsh Re published an assessment and concluded the insurance market impact should be minimal. Morningstar DBRS put a preliminary figure on it: $300m to $500m of insured losses worldwide. For comparison, CyberCube’s estimate for the 2024 CrowdStrike incident ranged from $400m to $1.5bn.

The detail

Three mechanics in a typical cyber policy explain the small insured bill.

The first is the waiting period. Contingent or dependent business interruption cover, which responds when a supplier rather than your own estate fails, usually only starts after a time excess. Marsh Re put that at roughly four hours for a small business, rising to 12 hours or longer for bigger organisations. Business Insurance reported a typical range of eight to 12 hours, while Insurance Business UK said wordings of up to 24 hours are common. This outage cleared the shorter thresholds, but timing matters: because it started after most UK offices had shut on Thursday evening, many organisations lost far fewer working hours than the headline duration suggests.

The second is proof of loss. Business interruption pays for lost net profit or increased costs of working, not for inconvenience. Marsh Re’s view is that most of the damage was delayed communication and lost productivity rather than lost revenue. Andrea DeField of law firm Hunton Andrews Kurth framed the question insurers will ask: was income actually lost, or merely deferred and made up later? Retailers whose email campaigns failed, or professional firms facing negligence claims over missed deadlines, are likelier claimants.

The third is the trigger itself. Some cyber policies respond only to a malicious event, and Morningstar DBRS’s Mario de Cicco pointed out that this one looks like a technical failure. Others cover non-malicious system failure, but only at specified suppliers, and some dependent business interruption wordings exclude IT providers altogether, according to Acrisure London Wholesale. Even where cover applies, dependent sublimits are often a fraction of the headline limit.

Not everyone in the market reads this as a gap. Tom Dryden, London-based head of cyber for Europe at McGill and Partners, told Business Insurance that “a good cyber policy should respond to exactly this sort of outage”, adding that cover for non-malicious failure at critical technology providers has become standard as insurers compete for business. He does not expect the event to move cyber pricing in any material way.

Checklist of five policy features that limit cyber insurance payouts for the Microsoft 365 outage: waiting periods, proof of loss, trigger wording, supplier limits and sublimits

Why it matters for UK organisations

Many UK organisations renewed cyber cover in a soft market, where broad extensions were easy to obtain and few buyers read the dependent business interruption clauses closely. This week is a useful, low-cost stress test of those clauses before a longer or more damaging outage arrives.

There is also a regulatory angle for financial services. Since July, Microsoft Ireland Operations Limited has been one of four designated critical third parties to the UK financial sector, alongside AWS, Google Cloud and Oracle, under oversight from the Bank of England, the PRA and the FCA. Firms that depend on Microsoft 365 for an important business service will want evidence that they stayed within their impact tolerances, and supervisors may ask.

Finally, outages are a gift to fraudsters. Insurance Business UK reported fake IT support calls and attempts to change bank details while staff were cut off from normal email, which is exactly the confusion that social engineers exploit.

Expert view

In my experience, resilience testing and insurance purchasing rarely talk to each other. When we run tabletop exercises, the scenario is almost always a ransomware attack. Yet for most organisations Microsoft 365 is the single biggest concentration risk in the estate: identity, email, file storage, collaboration and increasingly AI assistants all ride on one tenant.

The modest loss estimate is not a reason to relax. It reflects luck as much as design: an evening start time, a fault that degraded rather than fully stopped some services, and a recovery within roughly a working day. A similar failure starting at 9am on a Monday, or running for three days, would test those waiting periods and sublimits very differently. Ed Ventham, co-founder and director of Assured, was right to warn that it is “far too early to say what this will mean for claims”, and Morningstar DBRS itself describes its figure as preliminary.

Insurers pay on evidence, not recollection.

What to do now

  1. Log the incident now. Record when your services failed, what staff could not do, which workarounds you used, what extra costs you incurred and when service returned.
  2. Notify your broker early. Even if you doubt you have a claim, late notification is an easy reason for refusal. Ask specifically about dependent business interruption.
  3. Read the wording, not the summary. Check the waiting period, the dependent business interruption sublimit, whether non-malicious system failure is covered and whether IT or cloud providers are named or excluded.
  4. Tighten payment verification. Confirm any change of bank details by phone on a known number, never via contact details in the request. Cyber Essentials does not cover this kind of process control, so write it into finance procedures explicitly, and keep MFA (part of the Cyber Essentials user access control requirements) enforced on email accounts.
  5. Plan for the platform being down. Keep an out-of-band contact list, an alternative communication channel and offline copies of critical procedures. Make sure staff know not to move client data into personal email or messaging apps as a workaround.
  6. Add a cloud outage scenario to your next exercise. Financial services firms should map it against their impact tolerances under the UK operational resilience rules.

Bottom line

The insurance market looks set to absorb this outage without much strain, but that is mostly because the policies were written to absorb very little of it. Treat the week as free intelligence: check what your cover would really pay, collect your evidence, and plan for the version of this event that starts on a Monday morning.

Sources

Related Posts