What Happens When Everyone Claims at Once?

The cyber insurance question, part three of three.

Imagine arriving at work on a Monday morning to discover that your company's systems are unavailable. Customers cannot place orders, employees cannot access important files and your payment services are not functioning.

At first, the problem looks like an ordinary technology failure. Your IT team contacts its service providers, employees are told to wait and managers begin considering how long the disruption might last.

Then the scale of the incident becomes clear.

Thousands of other businesses are experiencing the same problem. The disruption affects companies across several European countries, including manufacturers, retailers, financial institutions and healthcare providers. All depend, directly or indirectly, on a shared technology service that has suddenly become unavailable.

For individual businesses, the consequences could include lost revenue, operational disruption and expensive recovery work. For insurers, however, the problem would be considerably larger.

Instead of handling a series of unrelated claims, they could find themselves dealing with thousands of losses arising from one incident.

This is one of the greatest challenges facing Europe's growing cyber insurance industry. As companies become more dependent on shared digital infrastructure, the financial consequences of a major cyber event could spread far beyond the organisation initially affected.

The question is whether the insurance market can provide meaningful protection when the same incident affects a substantial number of policyholders at once.

The problem with insuring a connected world

Traditional insurance relies heavily on understanding the probability and financial consequences of particular events.

A property insurer might cover thousands of buildings across different locations. Although some events, such as major storms, can damage many properties simultaneously, insurers have decades of experience modelling these risks and distributing their exposure.

Cyber insurance presents a different problem.

Businesses that appear unrelated may depend on the same cloud provider, software product, payment processor or technology infrastructure.

A retailer in France, a logistics company in Germany and a financial services business in Austria may operate in different industries, but their systems could rely on services provided by the same technology company.

A serious incident involving that provider could affect all three.

For insurers, this creates what is commonly described as accumulation or systemic risk. Losses are not necessarily independent of one another, and a single event can generate claims across an otherwise diversified portfolio.

The difficulty becomes greater when insurers lack a complete understanding of the underlying dependencies.

A company might use a cloud service directly, while another depends on a supplier that uses the same provider. These indirect relationships can make it difficult to estimate how widely an incident might spread.

This is why the development of cyber insurance requires more than calculating how frequently individual companies experience attacks.

The industry must also understand how failures can move through interconnected digital systems.

What the CrowdStrike outage revealed

In July 2024, a faulty software update from cybersecurity company CrowdStrike caused widespread disruption to Windows systems around the world.

Airlines, airports, businesses and other organisations experienced interruptions as affected machines failed to operate normally.

The incident was not a malicious cyberattack, making it particularly revealing. A routine software update from a trusted security provider was sufficient to cause disruption across multiple sectors.

For the insurance industry, it illustrated the extent to which digital operations depend on a relatively concentrated group of technology providers.

Munich Re highlighted the outage in its 2025 assessment of cyber insurance risks, drawing attention to the economic consequences of shared technology dependencies.¹

The incident also revealed an important distinction between a cybersecurity failure and an insurable event.

Not every insurance policy necessarily covers losses caused by a non-malicious technology outage. Coverage can depend on whether a policy includes system failure, contingent business interruption or other relevant provisions.

For businesses affected by such an incident, the difference can be substantial.

A company may experience genuine financial losses but discover that its insurance responds differently depending on whether the disruption was caused by ransomware, a technical error or an external provider.

For insurers, distinguishing between those events is part of managing the risks they agree to cover.

The CrowdStrike incident demonstrated that systemic digital disruption does not require a sophisticated attacker. Ordinary technological failures can create consequences extending across countries and industries.

A growing industry with a difficult problem

Europe's cyber insurance industry is expanding, although estimates of its size differ.

Market Data Forecast projects that the European market will grow from $1.77 billion in 2026 to $5.47 billion by 2034.²

Munich Re, using its own market assessment, estimated that European cyber insurance premiums had already reached $3.3 billion in 2024, representing approximately 21% of the global market.¹

The different figures underline the need for caution when comparing industry forecasts, particularly where research providers may use different definitions, geographical boundaries or product categories.

Nevertheless, insurers and reinsurers recognise significant opportunities in providing protection against cyber-related financial losses.

The difficulty is determining how much risk the industry can responsibly accept.

Munich Re has identified the relatively limited history of cyber loss data as a challenge for insurers. Unlike many traditional insurance categories, cyber threats evolve rapidly as organisations adopt new technologies and attackers discover new vulnerabilities.

The consequences of an attack can also change as businesses become more dependent on digital infrastructure.

An incident that might have caused relatively minor disruption a decade ago could now interrupt essential commercial activities across an entire supply chain.

Insurers must account for these changes when assessing premiums, setting coverage limits and deciding how much capital should be reserved against future claims.

That becomes particularly difficult when trying to estimate the financial consequences of rare but potentially widespread incidents.

When a cyberattack becomes a geopolitical event

The challenge becomes even more complicated when cyber incidents involve governments or occur during international conflicts.

Cyber operations attributed to state actors can create significant disruption, particularly when they target infrastructure or use techniques capable of spreading beyond the intended victim.

For businesses, the origin or political motivation of an attack may initially seem less important than its immediate financial consequences.

A company whose systems are unavailable still needs to recover operations, pay employees and meet obligations to customers.

For insurers, however, attribution can be central to determining whether a claim is covered.

Insurance policies have historically contained exclusions for losses associated with war. Applying similar principles to cyber incidents creates difficult questions about what constitutes a state-backed operation, when cyber activity becomes part of a conflict and how responsibility can be established.

A cyberattack may be attributed to a group believed to have government connections without being formally acknowledged by the state concerned.

It may also affect businesses in countries that are not directly involved in the underlying political dispute.

These circumstances create uncertainty for both insurers and customers.

The issue has received considerable attention within the Lloyd's insurance market.

Lloyd's introduced requirements for standalone cyber policies to address certain losses arising from war and state-backed cyberattacks, with revised arrangements and model clauses intended to make the scope of coverage clearer.^4,5

The requirements do not mean that every state-sponsored cyberattack is automatically excluded from every insurance policy. Different clauses provide different levels of coverage, and insurers may offer particular forms of protection subject to their underwriting arrangements.

Nevertheless, the developments illustrate an important tension.

Businesses may purchase insurance to protect themselves from serious cyber incidents, while insurers must consider whether certain events could generate losses beyond the financial capacity of the market.

When those incidents become closely connected to geopolitical conflict, determining where commercial insurance protection begins and ends can become exceptionally complicated.

Could one attack create too many claims?

Consider a hypothetical cyberattack targeting the systems of a major cloud provider.

If successful, it could disrupt thousands of companies that rely on the provider for applications, storage, communications or other essential services.

Some businesses might experience relatively minor interruptions. Others could lose access to systems needed to process transactions, operate machinery or deliver services.

Each business would face different consequences, but the losses would share a common cause.

For an insurer covering many of those organisations, the incident could generate claims from several industries and countries simultaneously.

Reinsurance helps insurers manage this exposure by distributing part of their financial risk. However, reinsurers face similar challenges when an incident affects large numbers of companies across the portfolios of multiple insurers.

The question is not necessarily whether one incident would bankrupt the insurance industry. That depends on its scale, policy terms, limits, reinsurance arrangements and the capital available to absorb losses.

Rather, the concern is that some events may be sufficiently widespread to challenge conventional assumptions about how risks can be diversified.

Insurers can respond by limiting particular exposures, introducing exclusions, purchasing reinsurance or developing more sophisticated models of shared technology dependencies.

Each approach involves trade-offs.

Restricting coverage can protect insurers against excessive losses, but it may leave businesses exposed to precisely the incidents they are most concerned about.

Providing broader protection can make insurance more useful, but it may require higher premiums or additional capital.

This creates a difficult commercial problem for an industry attempting to expand while maintaining financial stability.

Does cheaper insurance mean the risk is falling?

The current pricing environment adds another dimension to this question.

Marsh reported that European cyber insurance rates declined by 9% in the second quarter of 2026, marking the eleventh consecutive quarter of decreases.³

The broker attributed favourable market conditions to competition and the availability of insurance capacity, with some providers willing to offer broader coverage and larger limits.

For businesses purchasing insurance, these developments are generally welcome.

However, falling premiums should not automatically be interpreted as evidence that cybersecurity threats have become less serious.

Insurance prices are influenced by numerous factors, including competition, capital availability, underwriting results and expectations about future claims.

A business may be able to negotiate a lower premium even while its dependence on technology continues to increase.

Similarly, an insurer may consider an individual customer's risk acceptable while remaining concerned about the possibility of a much larger systemic event.

This distinction is particularly important when evaluating the long-term sustainability of cyber insurance.

The industry needs to remain commercially attractive to customers while ensuring that prices and coverage limits reflect the financial exposures insurers are accepting.

A major cyber event could lead providers to reassess those exposures, although the scale and direction of any resulting market changes would depend on the actual losses and circumstances involved.

Who should pay when digital infrastructure fails?

The possibility of widespread disruption raises a question extending beyond insurance contracts.

If a major cyber incident affects thousands of businesses and causes significant economic damage, who should ultimately bear the financial consequences?

Individual companies may be expected to maintain appropriate cybersecurity protections and business continuity arrangements.

Technology providers have responsibilities to manage their systems and reduce the likelihood of failures affecting customers.

Insurers can offer financial protection against specified risks, while governments have an interest in the resilience of infrastructure supporting economic activity and essential services.

These responsibilities overlap, but they are not identical.

A small business may have little influence over the security practices of a major international cloud provider, despite depending on its services for everyday operations.

Likewise, an insurer may struggle to cover an event affecting a substantial part of the economy without restricting exposure or obtaining additional financial support.

This has encouraged discussion about whether certain extreme cyber events may require approaches resembling those used for other catastrophic risks.

Potential options include specialist reinsurance arrangements, shared industry mechanisms or forms of public-private cooperation.

Such arrangements would raise difficult questions about eligibility, public financial exposure and the incentives created for businesses and technology providers.

There is no universally accepted model for dealing with every category of systemic cyber risk, and the appropriate response would depend on the types of incidents being considered.

Nevertheless, the question is becoming increasingly relevant as digital infrastructure supports a larger proportion of economic activity.

The limits of financial protection

Cyber insurance has an important role in helping businesses manage the consequences of digital incidents.

It can provide access to specialist assistance, support recovery and reduce the financial uncertainty associated with particular losses.

For smaller companies, that protection may be especially important because a serious interruption can threaten the continuation of the business itself.

However, insurance cannot restore a service that remains unavailable, guarantee that stolen information will not be misused or prevent damage spreading through interconnected systems.

Financial compensation also has practical limits.

A company may receive an insurance payment after a disruption, but that does not necessarily restore customer confidence or repair every commercial relationship affected by the incident.

For organisations providing essential services, the consequences of disruption can extend beyond financial losses to affect the wider public.

The distinction matters because the expansion of cyber insurance should not be mistaken for a complete solution to digital insecurity.

Effective protection still depends on cybersecurity investment, organisational preparedness, resilient technology infrastructure and cooperation between businesses, providers and public institutions.

Insurance is one part of that wider system.

Europe's cyber insurance question

Europe's cyber insurance industry is developing at a time when businesses are becoming more digitally interconnected and increasingly dependent on a relatively small number of critical technology providers.

The commercial opportunities are substantial, particularly as more organisations seek protection against the financial consequences of cyber incidents.

Yet the industry's greatest challenge may not be insuring another thousand businesses against individual attacks. It may be understanding how to provide meaningful coverage when a single event affects thousands of those businesses simultaneously.

The 2024 CrowdStrike outage demonstrated the scale of disruption that can arise from a shared technology dependency, even without malicious activity.

The continuing debate over state-backed cyberattacks and insurance exclusions adds further uncertainty, particularly where geopolitical conflict and commercial digital infrastructure overlap.

For insurers, the task is to develop policies that remain financially sustainable while offering protection customers can rely on.

For businesses, the challenge is to understand what their insurance actually covers and which risks remain their own responsibility.

And for governments, the wider question concerns the resilience of a digital economy in which failures can spread across sectors and national borders.

Cyber insurance will continue to play an important role in helping organisations manage digital risk. But its limitations also reveal something about the nature of modern cybersecurity.

When businesses share infrastructure, they can also share vulnerabilities. When those vulnerabilities produce widespread disruption, the financial consequences cannot always be neatly separated between individual companies.

Europe's growing cyber insurance market may help businesses recover from many incidents. Whether it can adequately respond to the most serious systemic events remains one of the industry's defining questions.

Also in this series: Part one: the market · Part two: small businesses.