CrowdStrike losses ‘sizeable but manageable’: Guy Carp
Broker places insured loss between $300m and $1bn
Guy Carpenter estimates that the CrowdStrike outage will cost insurers between $300m and $1bn, making it a “sizeable but manageable” loss for most carriers.
The broker said losses were kept in check because less than 1% of companies globally with cyber cover were impacted by the event. Losses were also reduced by the bug’s quick fix, which gave many organisations the opportunity to mitigate problems before the waiting period for cyber business interruption claims, which are typically 4 to 12 hours.
“Guy Carpenter’s findings align with the conclusion that this event would not result in a material loss for most insurers, although this could change based on the wordings adopted by carriers, concentration of underwriting within affected industry sectors, and uptake of System Failure coverage,” said the reinsurance broker.
It noted that many insureds have filed notices of circumstances but it is still early in the claims process.
The loss estimate equates somewhere between 2% and 6% of Guy Carp’s estimated $15.8bn in annual gross cyber premium.
Its figures compare with an estimate between $400m and $1.5bn from CyberCube.
Guy Carpenter said that the insured loss would have been far greater if the outage had been caused by a malicious attack. It estimates that a ransomware attack that directly impacts a widely used operating system could cause between $600m and $2bn in insurable loss.
The reinsurance broker went on to call on the insurance industry to re-evaluate its perspective of risk and consider the impact of frequency cyber losses alongside cat events.
“As the cyber market continues to mature, the potential for cat events has influenced scenario modelling and reinsurance purchasing trends. However, given the events of the past 18 months, the industry should re-evaluate its perspective of risk and consider the impact of frequency losses alongside the market moving systemic risks. Rather than bracing for the single super cat, perhaps the market should be more concerned with the growing litter of “Kitty Cats”– mid-size events that meet the criteria for a cat loss, but at a smaller scale,” it said.
Guy Carp said that since May 2023, the cyber market has experienced five Kitty Cats – MoveIT, Change Healthcare, CDK Global, CrowdStrike, and Snowflake – that were headline news. “While these losses have had limited impact individually, when aggregated into a single treaty period, they could generate a >10% loss ratio impact to the industry, which is more in line with the expectation for a single super cat,” it added.
