Microsoft Outage From Nov. 12 Puts Cyber Insurance Policies to the Test

The Microsoft outage that began on Nov. 12 and stretched across multiple days is now moving from an IT incident into a finance problem: corporate treasuries have just started to calculate their losses, and cyber insurers are bracing for what the claims reveal.

Microsoft continues to restore Copilot, Microsoft 365, Outlook, and Teams connectivity after days of outages and performance degradation across many of its core services. The recovery is under way, but the accounting has only begun.

"We're seeing encouraging recovery progress, with service availability and email delivery performance improving across a growing portion of affected infrastructure," said Charles Lamanna, executive vice president of Copilot, Agents, and Platform at Microsoft Inc. "We know our customers rely on our services to get important work done every day, and we regret the impact these outages had on those who depend on us. Our teams are reviewing what happened and how we can prevent similar issues going forward."

That apology will not settle the invoices. A platform failure at a provider of Microsoft's scale worries insurers for one structural reason: it can create aggregated exposure across many cyber insurance policies at once, said Sasha Romanosky, a senior policy researcher at the RAND Corp., the global policy think tank.

Who has already run the numbers?

Cyber modeling firms, carriers, brokers, and reinsurers have not waited for claims to land. CyberCube Analytics Inc., RMS — a subsidiary of Moody's Corp. — and other modelers have already priced the risk, drawing on data from earlier historic cloud outages to estimate losses, Romanosky said.

This event offers something those datasets lack: duration. "This one was longer than others, so observing the subsequent losses and claims will help us understand the shape of the loss curve," said Romanosky. "In other words, is the loss from a 10-hour outage equal to just 10 times the loss from a one-hour outage; is it more; is it less?"

That question matters far beyond this incident. If losses scale non-linearly with outage length, pricing for every cloud-dependent policy in the market shifts.

What does a claim actually require?

Whatever the policy says, putting a number on the loss will be a battle for forensic accountants, said Joshua Gold, a partner at the law firm Anderson Kill.

Coverage terms diverge sharply. "Some cyber insurance covers system disruption no matter what the cause," Gold said. "Other policies cover system disruption, but only if it's at the hands of a cyber threat actor. Both are very common in policies today." The Nov. 12 event involved no attacker, and that distinction will decide thousands of files.

Expect resistance. Insurance carriers take a hard line against business-disruption claims, commonly arguing that policyholders ultimately made up their losses one way or another through subsidiaries.

Even so, the tools exist to fight back. "Forensic accountants are usually quite good at providing a reasonable calculation of what would have been made but for the loss event," said Gold.

What should CFOs do right now?

Gold's guidance for affected companies is procedural and immediate:

• Notify the cyber insurance carrier of the intent to file a claim without delay.
• Provide an overview of the event and any lingering issues affecting the business.
• Keep constant dialogue with the insurer — but commit much of it to writing.

"Phone calls to your broker or the 1-800 claims number aren't good enough," Gold said.

The takeaway in plain words: the size of this loss curve, and whether policies pay for disruption without an attacker, will shape cyber insurance pricing and drafting long after Teams traffic returns to normal.