On Thursday afternoon, email stopped. Outlook, Teams, Copilot and other Microsoft 365 tools went down for thousands of users, with nearly 130,000 Outlook problem reports on Downdetector just after 1 p.m. Eastern (AP via WGBH). Microsoft said a number of its servers were unexpectedly unavailable, which strained the rest of its system (ABC News).
Most businesses lost a few hours. Some lost orders, deadlines and client calls. The question we’re already hearing: is any of that covered?
1. This wasn’t a cyber attack, and that changes how coverage works
Most cyber insurance was built around attacks: ransomware, hacking, stolen data. Thursday’s outage, based on what Microsoft has said so far, was a system failure, not a breach.
That distinction matters. Many policies pay for lost income only when the outage is caused by a “security failure.” A plain technical failure may fall outside that trigger unless your policy also covers system failure, sometimes called non-malicious or operational outages. (We looked at the attack side of this question after October’s PHP2Shell attacks.)
2. Your vendor’s outage is covered only if your policy says so
When the system that fails belongs to someone else (Microsoft, a cloud host, a payroll or software provider), you need dependent business interruption coverage, also called contingent business interruption.
- It’s often optional: Some cyber policies include it. Many add it only by endorsement.
- It may be sublimited: Coverage for a vendor’s outage is often a fraction of your main limit.
- It may be narrow: Some forms cover only named providers, or only outages caused by an attack on the provider.
We read the forms! Two policies with the same limit can respond very differently to the same outage.
3. The waiting period decides whether a short outage is covered at all
Business interruption coverage usually starts only after a waiting period, measured in hours. If your policy waits 8 or 12 hours and the outage lasts 6, the policy may pay nothing, even with the right coverage in place.
Know your waiting period and how it’s measured. Some policies count from when the outage starts, others from when you discover it.
4. The best protection is a plan for the day your email goes dark
Insurance pays for losses. A plan keeps the losses small:
- Backup channel: Agree now on how the team reaches each other and key clients if email and Teams are down (text, phone tree, a second platform).
- Offline essentials: Keep a current list of client, vendor and staff contacts that doesn’t live only in Outlook.
- Who decides: Name the person who declares an outage and tells clients what’s happening.
- Contracts: Check your client contracts for deadlines and service commitments, and know what notice you owe if a vendor outage makes you late.
How ALS Helps
We read your cyber policy against how your business actually runs: which vendors you depend on, how long you could go without them, and what the policy really pays for. As your “outsourced” risk manager, we flag the gaps, the sublimits and the waiting periods before an outage does. Learn more about our cyber risk services.
If you need more information on any of the topics covered here, or are interested in a Risk Management Assessment (“RMA”), please contact our Managing Principal, Albert Sica, at asica@thealsgroup.com or at 732.395.4251.
Frequently Asked Questions
Does cyber insurance cover a Microsoft or cloud outage?
It depends on the policy. Coverage usually requires dependent business interruption coverage for outside providers, and the outage often has to be caused by a covered event. Many policies cover attacks on a provider but not a plain technical failure.
What is dependent business interruption coverage?
It pays for lost income when a business you rely on, such as a cloud provider or software vendor, has an outage that stops your operations. It’s often added by endorsement and may carry a lower limit than your main coverage.
What is a waiting period in business interruption coverage?
It’s the number of hours an outage must last before coverage begins. Losses during that window are yours. Short outages often never get past it.
Will Microsoft pay us for the outage?
Cloud providers’ service agreements usually offer service credits, not payment for your lost income. That’s why your own insurance and your own plan matter.
How can we tell whether our policy would respond?
Look for the words “system failure,” “dependent business interruption” and “waiting period” in your cyber policy. An independent review can tell you what applies to your vendors, and where the gaps are.
