When Telstra’s mobile network failed in the early hours of 8 July, cafes, retailers and transport operators across Australia lost the ability to take card payments or reach customers for much of the working day. Payment provider Tyro said some merchants could not connect their terminals over 4G, and the Commonwealth Bank confirmed some of its merchant customers were affected. Telstra traced the problem to a fault in its network timing systems, said there was no sign of malicious activity, and restored the network around 4pm. The damage was already done to many hundreds of businesses.
None of those businesses had suffered damage, been hacked or done anything wrong. That is exactly the kind of loss many commercial policies are not built to cover.
Small Business Minister Anne Aly urged affected owners to keep records of their losses, and Telstra later opened a compensation hotline for small and medium businesses. For many of them, that compensation may matter more than their insurance. Optus’s outage in November 2023, which cut off about 10.2 million people and 400,000 businesses, raised the same question. Two national outages in under three years make this a recurring exposure rather than a freak event, and clients caught out in July are likely to ask their broker what cover they had.
The answer is often uncomfortable. Property business interruption (BI) cover usually needs physical damage to trigger it. Cyber policies can respond to an outage without damage, but many exclude failures of shared infrastructure such as power, telecommunications and the internet when those services are outside the insured’s control, as Munich Re has said. Waiting periods then remove many of the shorter events. For a cafe that loses a day of card sales, that combination can sink a claim before anyone looks at the numbers.
A new study from Allianz Commercial reviewed 7,888 BI claims paid between 2021 and 2025, worth about €6.74 billion (roughly A$11.2 billion). The average claim now exceeds €850,000 (about A$1.4 million), around 70% more than the average property damage claim.
That gap matters for how limits are set. A program sized around rebuilding a site can fall well short if the bigger bill is the trading lost while the site is out of action.
The shift toward outside causes is clearest in cyber. Contingent business interruption (CBI), meaning losses caused by an outage at a supplier, cloud host or IT provider, made up about 15% of the value of Allianz’s cyber claims above €1 million in the first half of 2025, up from 6% in 2024. If that trend holds, the supplier a client rarely thinks about could become the most likely source of a large claim.
Many of those outages have no attacker behind them. Faulty updates and configuration errors now account for a meaningful share of large cyber losses, according to Michael Daum, Allianz Commercial’s global head of cyber claims. “And with increasing use of AI this trend is very likely to continue,” he said. A policy that only responds to malicious events will miss a growing part of the risk.
“Business interruption remains the single biggest financial loss driver for cyber,” said Caitlin Ewing, a complex cyber claims analyst at the insurer. In other words, the downtime section of a cyber policy is where most of the money goes, and it deserves the most scrutiny.
Read next: Best cyber insurance providers in Australia: 5-Star Cyber 2026
Australian risk managers already rank AI as their biggest concern. In the Allianz Risk Barometer 2026, AI rose from eighth to first place in Australia, ahead of cyber incidents in second.
Allianz’s claims files show how that worry turns into cost. Criminals are using AI to pick targets and write better phishing, which shortens the gap between a break-in and a full shutdown. “AI shortens the time between initial access and full operational disruption, leaving less room to intervene before business interruption crystallizes,” Daum said. For businesses, that puts more weight on what they can do in the first few hours, before the loss starts to build.
The report also cites media accounts of an AI coding tool causing two limited outages at an Amazon Web Services unit, a reminder that a business’s own AI tools can cause downtime too.
Local forecasts suggest the bill will grow. Research commissioned by CyberCX projects that AI-driven attacks could cost Australian businesses up to A$37 billion a year by 2030, with nearly half of that coming from business interruption, including outages at third-party suppliers. If that projection is even close, the part of a cyber policy that pays for lost trading will carry much of the cost, and contingent cover is often subject to its own sublimit.
Two Australian rules now push businesses toward the preparation that also shortens a claim. APRA’s operational risk standard, CPS 230, has applied to banks, insurers and super funds since 1 July 2025. It requires them to identify critical operations and the material service providers behind them, and to test whether those operations can continue through a severe disruption.
For a much wider group, the Cyber Security Act 2024 requires businesses with annual turnover above A$3 million to report any ransomware payment to the Australian Signals Directorate within 72 hours. The obligation started on 30 May 2025, and its education-first phase ended at the close of that year, according to Clyde & Co.
Both regimes make businesses write down their dependencies and record what happens during an incident. That is the same evidence an insurer will ask for when a BI claim is lodged, so clients building it for regulators are also building their claim file. Marisa Anthony, a senior complex cyber claims analyst at Allianz Commercial, said firms dealing with an incident and their regulatory duties often forget to start gathering BI records, even though BI is “often the largest part of the claim.”
Read next: Data centre losses could cross policies and portfolios, Asia-Pacific insurers warn
The biggest risk for a broker is a client who believes they are covered for an outage and finds out otherwise after the event. Closing that gap starts with the wording. CBI cover goes by several names in the Australian market and can mean different things in the detail, underwriters told Insurance Business Australia. Brokers should confirm whether a client’s policy responds to non-malicious outages, whether it covers providers the client does not contract with directly, and how its infrastructure exclusion treats telcos and payment networks.
Time limits come next. Allianz says cyber BI indemnity periods typically run 90 to 180 days, compared with 12 to 24 months for property. A 90-day period can run out before a complex recovery does. Values need checking as well. “Where values are not reviewed regularly, inflation may contribute to underinsurance,” said Sarah Versavaud, who leads Allianz Commercial’s global BI practice group.
The last lever is how clients respond on the day. Daum said the best results come from restarting core systems in stages rather than waiting for a full fix, and clients that used AI-supported detection had shorter interruptions in Allianz’s claims data, even when the full IT recovery took longer. Those habits cut the size of a claim, which counts at renewal as much as it does on the day.
