Over 130 thousand reports in the United States alone, inconveniences extended to more than 70 countries and an estimated 430 million customers affected. A few hours after the restoration of Microsoft services, it is time to take stock of the actual and potential damage.
The Morningstar DBRS rating agency speaks of global insured losses of between 100 and 400 million dollars, "if the company offered credit and other compensation to customers". According to the Independent, initial forecasts indicate a "billion pound" impact due to the disruption of communications, transactions and productivity, even for organizations that do not use Microsoft services.
Speaking to the same publication, Samuel Mather-Holgate, director of the financial consultancy firm Mather & Murray Financial, reported that the blackout could become one of the most economically damaging in the history of technological accidents, adding that most companies "will recover little more than service credits from Microsoft".
In Italy, Codacons asked in a note for "automatic compensation for citizens and businesses involved in the blackout", given that "even a few hours of interruption can lead to production slowdowns, delays in deliveries, lost sales opportunities and difficulties in managing relationships with customers".
On the economic compensation front, two scenarios open up: on the one hand, refunds or contractual credits recognized directly by Microsoft; on the other, the activation of an insurance policy, if previously stipulated by the affected company to cover the costs of the operational stoppage.
"In any case", as lawyer Nicola Fabiano, an expert in digital rights, states to ANSA, "the cyber policy can cover the costs of the incident but the security obligations and, when due, notification, remain the responsibility of the company. In Italy, administrative sanctions are uninsurable. And if inaccurate declarations or reticence regarding security measures relevant to the risk were detected, the compensation could be reduced or even lost".
It is no coincidence that cybersecurity expert Paolo Ballanti confirms that, "the possibilities of obtaining compensation depend on the contractual conditions, the guarantees of stopping the activity and contingent interruption, the causes of the event and any exclusions".
On a contractual level, the specialized site Office Watch reports the Microsoft 365 service level agreement which provides as the only remedy for cases of this kind a credit on the fee, equal to 25%, 50% or 100% depending on the duration of the interruption, non-automatic and without compensation for lost sales or overtime. For European consumers, the terms of the Microsoft Services Agreement exclude indirect damages, including lost profits, unless there is intent or gross negligence.
"The fact of being insured against cyber attacks", continues Ballanti, "does not necessarily mean being protected against every form of digital paralysis". "For the insurance market", he concludes, "the real problem is the accumulation of risk: when thousands of companies depend on the same provider, a single accident can generate simultaneous compensation claims on an international scale. These are scenarios that require companies to rethink evaluation models, compensation limits and management of aggregate exposures, without giving up on offering companies truly effective protections".
