New Zealand businesses lost access to Outlook, Teams and SharePoint for much of Friday morning after a global Microsoft 365 failure and the first question reaching cyber brokers was whether any of the loss can be claimed.
“It's probably a great reminder that if you have cyber insurance, to check your wordings,” said Andrew Brett (pictured), director of Infosure Insurance, an Australia-based specialist cyber brokerage. There is no uniform answer, he said, because there is no uniform wording.
Microsoft said a component on its servers that processes health checks had become overwhelmed, pulling servers out of service and straining the rest, and that the cause was not a surge in traffic. Its service health alert named Exchange Online, Teams, SharePoint Online, Copilot for Microsoft 365 and Defender XDR. More than 5,500 Australian users had reported Outlook problems to Downdetector by 9am on Friday, according to AAP, with Service NSW, Queensland Health and federal agencies among those affected, AAP and ABC News reported.
Brett said his phone had been running hot since the outage began, with callers wanting a yes or no on cover. His answer is the oldest one in insurance. “Every claim will be based on its own merit,” he told Insurance Business.
Brett is unconvinced that the outage represents anything genuinely new. He put it alongside the recent wave of attacks on supermarket refrigeration systems in Europe. The Associated Press reported on 13 October 2026 that a cyberattack on refrigeration control systems had hit about 700 French stores, and RetailDetail EU reported a further wave affecting supermarkets in at least seven European countries on 2 November 2026, with stock spoiling as temperatures rose.
“They're attacking the fridges in Europe, and we're going, well, this is just part and parcel,” Brett said.
Read next: State-sponsored attacks and the cyber cover question for brokers
Businesses want the benefit of running refrigeration from an iPad in another state, he said, and have to take some of the negative that comes with it. Go back far enough and the equivalent failure was the office phone line and the dial-up connection dropping out. The packaging differs, the event does not. “I don't think it's anything new.”
In his view the outage is not even an insurance question so much as a broad 2026 question.
The first thing to check in any cyber policy, Brett said, is the waiting period that must pass before business interruption cover responds. Some insurers set eight hours, others 12.
“It's almost like an excess, but it's a time excess,” he said.
What happens once that threshold is crossed varies by insurer. Brett said some backdate cover to the start of the incident, while others treat the first eight or 12 hours as uncovered and pay only for the hours beyond it. He said he was aware of one insurer whose time excess for contingent business interruption can run to 48 hours.
That threshold is why the CrowdStrike incident yielded so few claims, Brett said. It was resolved inside the eight to 12 hour window, quite apart from the lower cyber uptake at the time, and large airlines were the exception rather than the rule. Insurance Business has reported that the faulty CrowdStrike update dated from July 2024, and has examined cloud concentration risk in the current Microsoft 365 outage separately.
Exposure varies by sector. A law firm or a brokerage loses productivity rather than revenue, Brett said, while flower shops, supermarkets and airlines lose sales the moment systems stop. Waiting periods exist, in his reading, precisely so that insurers do not snap-trigger a business interruption loss on every short outage.
Cyber behaves like any other class, Brett said. As with home contents or motor, every insurer sets its own clauses and exclusions, and some write extensions broad enough to catch these scenarios. He made a related argument in August 2026 about why Australian SMEs understand cyber cover but still will not buy it.
The outage is also a contingent event rather than a direct one. The failure sits with Microsoft rather than with the insured's own systems, which sends any claim to the contingent business interruption section of a cyber policy. Some insurers scope that section separately, and more narrowly, than direct business interruption.
Read next: Microsoft email, teams goes out globally puts cloud concentration risk back on brokers' radar
Businesses without cyber cover may look instead to the business interruption section of a traditional business package. A lot of them “will get a rude shock,” Brett said, because most packages carry a cyber exclusion. Insurance Business has also reported warnings to Australian employers over the Friday 13th Microsoft outage.
Brett said he hoped the outage would make people think about it more, because it is not an obvious claim and that it was a good chance to look at cyber insurance coverage itself.
