CrowdStrike-Microsoft Outage To Cost $44M Per Fortune 500 Company: Report
New data from cloud insurance firm Parametrix sheds light on the financial cost of the massive CrowdStrike outage last week that affected millions of Microsoft devices.
The massive CrowdStrike outage that affected millions of Microsoft devices is predicted to cost U.S. Fortune 500 companies $5.4 billion in total direct financial loss, with an average loss of $44 million per Fortune 500 company, according to new data from cloud monitoring and insurance firm Parametrix.
The health-care industry could see the largest direct financial loss suffered by Fortune 500 health providers at $1.94 billion, followed by large banking companies at $1.15 billion.
The New York-based insurance services company said insured losses from the outage will total from $540 million to just over $1 billion for the Fortune 500 companies.
[Related: CrowdStrike Flacon Issue ‘Fix Has Been Deployed;’ Microsoft Identifies ‘Root Cause’ Of Outage]
“Our analysis of the CrowdStrike outage shows not only the possible extent of a systemic cyber loss event, but also its boundaries,” said Jonatan Hatzor, CEO of Parametrix, in a statement. “It tells us more about the ways that insurers and reinsurers can diversify their cyber risk portfolios to minimize the potential impacts of systemic cyber risk.”
Outage To Cost Airlines $860 Million, IT Service Companies $560 Million
One of the biggest industries hit during the CrowdStrike-Microsoft outage was airlines.
The issue will cost six of the Fortune 500 airlines approximately $860 million, according to Parametrix.
Software and IT-related services companies will take a direct financial loss of $560 million, while retail and wholesale Fortune 500 companies will take a $470 million loss.
On the other side of the coin, the manufacturing industry suffered the least amount of financial loss at $36 million in total across 130 companies.
Parametrix said the portion of the financial loss by Fortune 500 companies under cyber insurance policies is likely to be no more than 10 percent to 20 percent, due to many companies’ large risk retentions and to low policy limits relative to the potential outage loss.
The analysis report excluded any losses from Microsoft.
Key Findings From CrowdStrike-Microsoft Analysis
One-quarter of the Fortune 500 was impacted, according to Parametrix, which comes to 125 corporations.
This includes 100 percent of airlines in the Fortune 500, and 43 percent of retailer and wholesaler companies. About 67 percent of health and banking sector firms suffered direct costs.
Parametrix said beyond such primary financial losses, CrowdStrike’s impact on critical services resulted in a cascade of operational delays affecting the Fortune 500 companies and their downstream entities.
“Quantifying these risks is important. This involves measuring the potential financial and operational impacts of downtime or failures within your bundled solutions,” said Hatzor.
Traditional industries relying on physical computers experienced longer recovery times, which underlines the resilience and rapid recovery of cloud-based systems, according to the data.
Parametrix uses proprietary IT to continuously monitor the performance of a variety of third-party IT services across the globe and to collect data on service interruptions.
“Prevention is important, but risk carriers have limited control over event occurrences and service provider practices,” he added. “The industry should focus on controllable areas, like mapping and managing aggregation risk. By understanding these points, we can evaluate key exposures, and mitigate both malicious and no-malicious threats. This proactive approach enables better underwriting decisions, and effective risk-transfer solutions to manage systemic risk.”