You may recall that during the Covid pandemic and shortly after, some businesses had attempted to make a claim against their business interruption insurance policy. Whilst policies responded to the claim, a large number did not. This prompted the Financial Conduct Authority (FCA) to engage in the well-publicised Test Case around business interruption insurance cover. At the time, the UK Supreme Court (UKSC) found in favour of policyholders. However, the success was limited as the UKSC’s decision was only in relation to a limited number of policies.    

Unfortunately, not all businesses benefit from business interruption insurance. In many cases, it is considered an ‘added extra’ with additional costs involved and businesses simply do not add it to their policies.  In a letter to the Chief Executives of insurance companies, sent in January 2021, the FCA explained that most SME business interruption policies are focused on property damage and would not have paid out for the Covid pandemic.

What about CrowdStrike?

On 19 July 2024, what should have been a simple software update ultimately prohibited Windows computers from rebooting, causing worldwide disruption.  News reports have suggested that 8.5 million devices were affected by the CrowdStrike outage, which resulted in planes being grounded, supermarkets unable to process card payments and medical appointments being cancelled. Broadly speaking, there may be two options for businesses impacted by the CrowdStrike outage:

1. Business interruption insurance claim; or
2. Damages claim.

Business interruption insurance claim

Insurance companies are expecting to receive a large number of claims from businesses affected by the CrowdStrike outage, with the anticipated losses to the insurance industry expected to be up to $1 billion.

Ultimately whether or not a business can bring a business interruption insurance claim will depend upon the wording of its insurance policy and whether the policy will respond to cyber interruption that was not malicious in nature. In this regard, policyholders should carefully review the wording of their policy and seek legal advice if the insurance company does not allow a claim to be brought under their specific policy.  

Breach of contract

In circumstances where businesses have contracted directly with CrowdStrike, it may be possible to bring a claim against CrowdStrike for breach of contract.

Alternatively, where there isn’t a direct contractual relationship with CrowdStrike it may still be possible for businesses to bring proceedings against their own IT provider for failing to fulfil their contractual obligations, such as to avoid interruptions of service or to have sufficiently robust mitigation measures in place. The IT provider could then bring its own claim against Crowdstrike as a result.

For consumers

Any consumers impacted by the CrowdStrike outage such as holidaymakers should consider a compensation claim against the airline. Most notably, the US-based Delta Air Lines faces a potential class-action lawsuit brought by passengers for failing to provide automatic refunds for flights disrupted by the outage. Simultaneously, the airline itself may seek a compensation claim against CrowdStrike for the outage costing the company an estimated $500 million.