Article
$5.4 Billion in Losses. 10-20% Covered by Insurance.
CrowdStrike's 2024 outage cost Fortune 500 companies an estimated $5.4 billion. Only 10-20% of that was covered by cyber insurance. The gap was not an accident. It was already written into the contracts everyone had signed.
- Published
- July 19, 2024
- Updated
- June 18, 2026
- Reading time
- 8 min
2026 updated analysis
What changed since the original article
This page keeps the original Transformidy article as the canonical record and leads with the current interpretation, source notes, and Revenue Unknown framing.
The Loss and the Coverage Gap
That second figure is the one worth sitting with longer than the headline loss number. A gap between total loss and insured loss is not unusual after a major incident; what is more specific and instructive here is why the gap existed. It was not primarily a story of companies failing to purchase adequate cyber insurance, though that is part of it. It was a story of standard contract language, present in the large majority of vendor agreements industry-wide, that simply was not written to cover this category of event as a compensable loss in the first place.
The distinction matters because it changes what a company should actually do in response. A coverage gap caused by under-insurance is fixed by buying more insurance. A coverage gap caused by structural contract language, best-effort commitments, force majeure exclusions, disclaimed software liability, requires reviewing and potentially renegotiating the underlying agreements themselves, a different and more involved fix.
Estimated Fortune 500 losses, against the share covered by cyber insurance
The gap traces to standard force majeure and best-effort contract language, not simply under-insurance.
The Clauses Were Already There
The specific contractual mechanics behind the coverage gap are worth naming directly, because they are common rather than unusual. Most cloud and IT vendor contracts promise only "best effort" during disasters and exclude liability for force majeure events beyond their control, a standard provision present across the industry, not a CrowdStrike-specific weakness. Vendors typically commit to practicing "diligence" and "due care," but, as the reporting notes, "there are no uniform standards in the software industry that definitively clarify what the standards are for diligence and due care," making that commitment difficult to enforce as a specific, breach-based claim.
Compounding the gap further, "almost all software licenses disclaim the producer's liability," and "there exists no widely recognized legal standard that demarcates secure from insecure software development practices." Taken together, these are not loopholes exploited after the fact; they are the baseline, standard terms present in the large majority of enterprise software and cloud agreements before this incident ever occurred. The CrowdStrike outage did not create this contractual reality. It exposed it, at a scale and public visibility that made the gap impossible to ignore.
The practical guidance that emerged from legal analysis of the incident reflects this reality directly: companies were generally advised to negotiate with vendors for pricing discounts and other considerations rather than pursue litigation, since the contractual basis for a stronger legal claim was, for most affected companies, simply not there. That is a sobering, but useful, data point for any business assuming its existing vendor relationships already provide adequate protection against a comparable incident.
Discovering the Gap After vs. Reviewing Contracts Before
One is a costly surprise. The other is a routine legal review that most companies skip.
Discovering after: a major vendor incident occurs, and legal teams learn in real time that standard force majeure and best-effort language leaves most of the resulting loss uncovered, exactly what happened industry-wide after CrowdStrike. Reviewing before: proactively auditing existing vendor contracts and cyber insurance terms for these same standard clauses, identifying the coverage gap while there is still time to negotiate stronger terms at the next renewal.
The Leadership Move
The structural choice for legal, procurement, and risk leadership is whether to treat vendor contract review as a reactive exercise triggered by an incident, or as a standing practice conducted ahead of the next comparable event.
- Ownership
Legal and procurement leadership own the responsibility to audit existing vendor and cyber insurance agreements specifically for force majeure exclusions and best-effort language, rather than waiting for a major incident to reveal the gap under crisis conditions.
- Tradeoff
Negotiating stronger liability terms with major software and cloud vendors takes time and leverage that a business may not have in every vendor relationship, particularly with dominant providers. The tradeoff against attempting that negotiation is inheriting the same standard, weak-coverage contract language that left the large majority of CrowdStrike's Fortune 500 customers absorbing losses directly.
- Human consequence
Employees and customers of affected companies experienced the operational disruption of the outage directly, while the companies themselves absorbed a financial loss that, per this data, few had structured their vendor relationships to actually transfer or share.
Next Move
If you have not reviewed your critical vendor contracts since 2024: Audit them specifically for force majeure exclusions, best-effort language, and software liability disclaimers, and flag the resulting coverage gap as a known risk rather than an assumption.
If you are entering a renewal cycle with a critical software or cloud vendor: Use the CrowdStrike incident's documented financial and coverage data as leverage to negotiate stronger liability terms before the agreement locks in for another cycle.
FAQ
How much did the CrowdStrike outage cost Fortune 500 companies?
Parametrix, an analytics and insurance provider, estimated the July 2024 CrowdStrike outage, which affected 8.5 million Windows systems, may have cost Fortune 500 companies as much as $5.4 billion in lost revenues and gross profit.
How much of that loss was covered by insurance?
Parametrix estimated only 10 to 20% of the companies affected would be covered by cyber insurance for the incident, leaving the large majority of the estimated $5.4 billion loss uninsured.
Why was so little of the loss covered?
Standard cloud and IT vendor contracts typically promise only "best effort" during disasters and exclude liability for force majeure events beyond the vendor's control. Software licenses also generally disclaim the producer's liability, and there is no widely recognized legal standard that demarcates secure from insecure software development practices, meaning affected companies had little contractual basis to claim damages from the vendor whose update caused the outage.
What should a business do differently given this gap?
Review existing vendor and cyber insurance contracts specifically for force majeure and best-effort language before the next major incident, not after, and treat the resulting coverage gap as a known, quantifiable risk to plan around rather than an unpleasant surprise to discover during a crisis.
Sources & References
Original article archive
Original article published July 19, 2024: "Microsoft And CrowdStrike Outage Alarmed Millions Of Businesses And Customers". Preserved here for provenance, historical context, and citation continuity.
The widespread disruptions caused by the recent Microsoft and CrowdStrike outage exposed the precariousness of our hyper-connected world. This incident, affecting sectors from aviation to healthcare, underscored the systemic risks inherent in our over-reliance on a handful of critical infrastructure providers. This insight delves into the specifics, how that impacts experiences, and what can companies do to safeguards their customers and stakeholders.
Microsoft and CrowdStrike Outage Explained
CrowdStrike is a cybersecurity company that offers a cloud-based platform to protect businesses from cyberattacks. Their platform focuses on safeguarding key areas like endpoints, cloud workloads, identity, and data. By using advanced technology and threat intelligence, CrowdStrike helps businesses detect, prevent, and respond to cyber threats efficiently. Their goal is to provide strong security while being easy to use and implement.
The outage was the result of a defect found in a single content update issued at 04:09 UTC on 18 July 2024. It included the faulty kernel driver csagent.sys, causing affected machines to enter a blue screen of death with the stop code PAGE_FAULT_IN_NONPAGED_AREA. for Windows hosts. Mac and Linux hosts are not impacted. As noted by CrowdStrike representatives, this outage is not related to a security incident or cyberattack.
Outage Implications
The Microsoft and CrowdStrike outage had far-reaching consequences, impacting various industries in distinct ways. Let's delve into a few specific examples:
Travel
The aviation industry was one of the most visibly affected sectors. With flight operations heavily reliant on digital systems for everything from ticketing and boarding to air traffic control, the outage caused widespread disruptions. Airlines around the world including Hong Kong Airlines, KLM, IndiGo, Porter Airlines, and others faced massive cancellations, delays, and operational challenges.
Passengers experienced significant inconvenience, financial losses, and disrupted travel plans that may be unresolved for hours or days. Employees may be stranded in destinations which would further impact scheduling.
Financial Services
Financial institutions worldwide were impacted by the outage. In South Africa, Capitec Bank and other lenders experienced difficulties. The Philippines was significantly affected, with major banks like RCBC, Metrobank, LandBank, BDO, UnionBank, BPI, and PNB reporting online system failures. Digital payment platforms such as Maya and GCash were also affected in the Philippines. DenizBank in Turkey faced accessibility issues with its website and mobile banking app. Bradesco Bank in Brazil confirmed it was affected as their customers were notable to login. As at 12:00 UTC, the bank disabled the login button.
For different financial institutions, online banking, electronic payments, and stock trading were severely hampered, leading to financial losses for both institutions and customers. The outage exposed the vulnerability of the modern financial system to system failures. It underscored the importance of redundant systems, data backups, and disaster recovery protocols in the financial industry.
Social Services
The outage led to significant disruptions in 911 emergency services across several states, including Alaska, Arizona, Florida, Indiana, Kansas, Michigan, Minnesota, New York, Ohio, Pennsylvania, and New Hampshire. Some states experienced complete 911 outages, while others faced difficulties with 911 call centers.
Heathcare
While not as immediately visible as the impacts on aviation or finance, the healthcare industry also faced challenges. Electronic health records, patient management systems, medical employee scheduling software and medical device operations were disrupted, potentially affecting patient care.
Surgeries might have been delayed, and critical patient data could have been inaccessible. This incident emphasized the need for robust IT infrastructure and contingency plans in healthcare settings to ensure patient safety and continuity of care.
Retail
The retail industry, heavily reliant on digital platforms for sales, inventory management, and customer relationship management, was significantly impacted. Online stores experienced outages, point-of-sale systems malfunctioned, and supply chain operations were disrupted. This led to lost sales, customer dissatisfaction, and operational inefficiencies. The outage highlighted the importance of omni-channel strategies and robust IT systems in the retail industry.
Beyond Immediate Impact
Beyond the immediate impact on businesses and consumers, the outage revealed deeper vulnerabilities in our digital ecosystem. The ripple effects extended far beyond the industries discussed. Supply chains were disrupted, economic activity is slowed by incomplete transactions, and consumer confidence may be shaken. The outage served as a reminder of the interconnectedness of our global economy and the potential of a single point of failure.
Customer Experience
Across all industries, the outage resulted in a deterioration or removal of potential key customer experience processes. As a result, impacted customers could face frustration, inconvenience, and potential financial losses. This incident handled without care could erode trust in businesses and highlighted the importance of effective crisis communication and customer support. Organizations should prioritize building resilient systems and providing exceptional customer service to mitigate the impact of future disruptions.
The examples above underscore the risks associated with the over-reliance on a few critical technology providers. It is imperative for industries to invest in building resilient infrastructure, diversifying technology suppliers, and developing comprehensive business resumption/disaster recovery plans to protect against future disruptions.
James Connell, Senior Global Marketing, Branding, OmniChannel and Digital Transformation Executive said, "Reassuring your customers that their data is safe, provide proactive updates that are timely on social channels, website and email that are clear and succinctly worded."
What Happens Next?
A major outage like the one caused by the Microsoft and Crowdstrike incident demands a swift and coordinated response to minimize customer disruption. Rapid incident response and clear communication are paramount.
First Response
Establishing a dedicated incident response team to manage the situation is crucial. This team should be responsible for disseminating timely, accurate, and transparent information to both internal and external stakeholders, including customers. By providing regular updates on the outage's nature, cause, and resolution efforts, organizations can alleviate customer and employee anxiety and maintain trust.
Prioritizing critical systems is essential to mitigate the impact on customer experience. Identifying systems that are vital to business operations and customer interactions allows organizations to focus restoration efforts accordingly.
Implementing contingency plans for essential services ensures continued operations during the outage, reducing customer inconvenience. Company should also leverage alternative communication channels, such as phone, email, and social media. It is crucial to maintain contact with customers and provide support, where possible. Proactive customer outreach to high-impact customers can help mitigate issues and demonstrate care and empathy. Transparency, timeliness, and consistency are key.
Performance Metrics
To measure the effectiveness of the response, company can employ the following performance metrics. Outage duration, including the time to restore critical systems, provides a clear indicator of the incident's impact. This may also resolution time for specific issues or service restoration. Information on the estimated time the outage will be resolved could be used to determine the next communication touchpoint.
Assessing the number of customers affected and the severity of their experience helps gauge the overall impact of customer expectation versus experience. Physical and online engagement can be deployed to manage expectation and resolve issues.
Customer satisfaction surveys/feedbacks and social media monitoring can provide insights into customer sentiment during and after the outage. Additionally, evaluating the performance of the response team and the effectiveness of communication and collaboration is essential for identifying areas of improvement.
Tracking system availability before, during, and after the outage helps assess the overall resilience of the IT infrastructure. Finally, estimating the financial loss due to the outage provides a quantitative measure of the incident's impact. By focusing on these strategies and metrics, organizations can enhance their ability to respond to and recover from future disruptions, safeguarding customer experience and protecting their reputation. Building trust is an ongoing endeavour!
Transform For The Better
The reliance on a few technology vendors could create systemic vulnerabilities. There is an opportunity for companies to collaborate and explore alternative tools for developing and deploying critical infrastructure that could report issues faster and ensure there is more redundancy on essential services. Training, testing, and reporting incident processes will ensure companies can manage expectations in an organized manner.
As we move forward, it is imperative that we learn from this incident. By building more resilient, diverse, and equitable digital infrastructures, we can mitigate the risks of future disruptions sooner and reduce the financial, reputation, and service implications.
How Can We Help?
Transformidy is available to assist in helping you understand trust and assess how trustworthy your company is.
Contact us or set up a 30 minute complimentary consultation for more information on our services, insights, or showcases. We look forward to hearing from you.
FAQ
How much did the CrowdStrike outage cost Fortune 500 companies?
Parametrix, an analytics and insurance provider, estimated the July 2024 CrowdStrike outage, which affected 8.5 million Windows systems, may have cost Fortune 500 companies as much as $5.4 billion in lost revenues and gross profit.
How much of that loss was covered by insurance?
Parametrix estimated only 10 to 20% of the companies affected would be covered by cyber insurance for the incident, leaving the large majority of the estimated $5.4 billion loss uninsured.
Why was so little of the loss covered?
Standard cloud and IT vendor contracts typically promise only 'best effort' during disasters and exclude liability for force majeure events beyond the vendor's control. Software licenses also generally disclaim the producer's liability, and there is no widely recognized legal standard that demarcates secure from insecure software development practices, meaning affected companies had little contractual basis to claim damages from the vendor whose update caused the outage.
What should a business do differently given this gap?
Review existing vendor and cyber insurance contracts specifically for force majeure and best-effort language before the next major incident, not after, and treat the resulting coverage gap as a known, quantifiable risk to plan around rather than an unpleasant surprise to discover during a crisis.
Related intelligence
Article
One DNS Failure Exposed a Much Bigger Cloud Risk
An AWS DNS failure in October 2025 showed how a narrow infrastructure problem can create a much wider business blast radius. Forrester expects at least two more multiday cloud outages in 2026.
Article
SharePoint's Real 2025-2026 Story Was Nation-State Attacks, Not CX Strategy
Nation-state hackers exploited on-premises SharePoint servers in 2025, confirmed by Shadowserver at over 300 victims worldwide. In 2026, a new vulnerability rated 9.8 out of 10 severity emerged in the same product line. SharePoint did not quietly rewire anyone's CX strategy. It became a sustained target.
Article
Apple Is Reportedly Building a MacBook Designed to Lose the Spec Sheet Comparison
Apple's new MacBook Neo runs an iPhone chip, not a Mac chip, and starts at $699 to $899, roughly $100 to $300 below the MacBook Air. It has no Thunderbolt. Apple built its first laptop specifically to lose a spec sheet comparison, on purpose, to win a price comparison instead.