Analysts at ratings agency Fitch Ratings have said that last week’s mass global IT outage is not expected to have a material impact on the financial results of insurers and reinsurers, with preliminary market estimates of global insured losses in the mid-to high single digit billion USD range.
While Fitch does not expect any meaningful financial impact for re/insurers from the event, the rating agency does note that market loss estimates remain subject to ongoing claims and litigation.
“The insurance lines most affected will be business interruption, contingent business interruption and cyber. Several smaller lines such as travel insurance, event cancellation, and technology errors and omissions will also be affected,” says Fitch.
Although business interruption claims are expected to drive the bulk of industry losses, Fitch explains that time element periods will limit insured losses, as will a lack of insurance coverage, high deductibles and sublimits.
“Industries such as hospitals and airlines will be more affected, as they require 24/7 availability and often lack robust redundancies. APAC and EMEA regions had more of their work day affected by the outage, unlike the Americas, which had a solution to the outage, although it requires physical access to machines and in some instances access to a recovery key,” continues Fitch.
Microsoft has estimated that the update affected 8.5 million devices, or less than 1% of all Windows machines. Clearly, it could have been far worse and impacted many more devices, but the outage still highlights a growing risk of single points of failure (SPoF).
“SPoF are critical bottlenecks in the delivery of systems that, if impacted, will have an outsized effect on the system. SPoF risk has been modeled for cloud outages and popular software such as operating systems. However, it has not been well modeled or understood for industry-specific software such as CrowdStrike or more recently ChangeHealth,” explains Fitch.
Adding, “SPoF are likely to increase as companies seek consolidation to take advantage of scale and expertise, resulting in fewer vendors with higher market shares. Utilizing multiple, redundant vendors can help offset SPoF risks, but can also add increased complexity and costs that often are not feasible.”
The ability to properly model cyber risks has been a hot topic for years, and as noted by Fitch, SPoF risks highlight the inherent challenges in modelling the exposure as the frequency of events are low but the potential severity can be high.
“Wider development of the cyber risk transfer market and securitization requires further maturation of the product, including greater standardization of coverage terms and policy language, price discovery and risk modeling applications,” states Fitch.
“Cyber risk remains difficult for insurers to assess due to the dynamic root causes of claims. Challenges include a lack of effective, widely accepted modeling tools and a limited data set of historical claims, where past events are not necessarily indicative of future risks. Early ILS deals within the spectrum of cyber-risk transfer will comprise cyber risks that are easier to model and quantify and will be of modest size,” concludes the rating agency.
Time will tell exactly how impactful this unprecedented event proves to be for the insurance and reinsurance sector, but as things stand, the expectation is that it will be manageable.
So far, prominent cyber underwriter Beazley has said that it will not change its current undiscounted combined ratio guidance of low-80s for its full year 2024 results in light of the event, while W.R. Berkley said it does not see the incident as a material loss to the company.
No doubt other insurers and reinsurers will also comment on the IT outage in the coming days and weeks as second quarter results are announced, which should provide a clearer picture of where the ultimate insurance industry loss might fall.
