The car dealers never got hacked themselves - but they still suffered. In June 2024, a ransomware attack hit CDK Global, the software provider many of them use to sell cars, run service bays and process payroll. About 15,000 dealerships went back to using old-school paperwork for close to three weeks, at a cost of roughly US$1.02 billion in direct losses, according to Anderson Economic Group.
That kind of secondhand loss is becoming a fixture of cyber claims. A new business interruption study from Allianz Commercial finds that contingent business interruption (CBI) - losses triggered by problems at a supplier, cloud host or IT vendor rather than the insured itself - has risen markedly in its large cyber claims in recent years. It made up about 15% of the value of cyber claims above €1 million in the first half of 2025, up from 6% in 2024. The insurer’s wider findings on property-driven BI were published earlier this month; the cyber data tells a different, faster-moving story.
The shift Allianz’s cyber claims team flags most is how many big losses involve no criminal at all. Faulty software updates, configuration mistakes and infrastructure failures now drive a meaningful slice of large cyber BI claims, said Michael Daum, global head of cyber claims at Allianz Commercial. “And with increasing use of AI this trend is very likely to continue,” he said.
The examples have been widely reported by our team as they happened. A bad CrowdStrike security update in July 2024 crashed roughly 8.5 million Windows devices. In October 2025 an AWS outage ran for about 15 hours, and a month later a configuration error took down parts of Cloudflare, which sits in front of around one in five websites. Allianz, citing tracker IncidentHub, counts more than 48,000 outages across cloud and software services in 2025 alone.
And AI is adding to problems by adding a new kind of glitch. Allianz points to media reports that an AI coding tool caused two limited outages at an AWS unit last year. Such events “blur the line between cyberattack and technical failure,” Daum said.
Yet big disruption has not always meant big insured losses - although they can be hard to estimate early. CyberCube put insured losses from the October 2025 AWS event at between US$38 million and US$581 million, and Moody’s estimated a mean of just US$22 million. The outage’s short duration, expected reimbursements from AWS and cyber BI waiting periods of typically eight to 12 hours all kept claims down. The flip side is that much of the economic loss likely stayed with the businesses affected.
Read next: Assessing the “perfect storm” repercussions of the CrowdStrike outage
The deeper problem arises when just one vendor has many, many users. When a single platform serves a whole sector - dealers on CDK, UK retailers on Blue Yonder, which was hit by ransomware in November 2024 - then one incident can produce many claims at once.
Caitlin Ewing, a complex cyber claims analyst at Allianz Commercial, said there is no quick exit. “Unwinding such reliance could take years to transition to alternative providers or be prohibitively expensive,” she said. She added that these losses often end up in litigation, as customers sue providers to recover their costs.
Data centers are the physical version of the same risk. Alberto Barani, who leads BI risk consulting at Allianz Commercial, said operators tend to be strong on cyber defense but not always on property loss prevention. In June 2026 a fire at a third-party data center disrupted Google Cloud customers in India. In 2021, a blaze at an OVHcloud site in Strasbourg knocked millions of websites offline; French investigators found it began in a room housing batteries and backup power, which had no automatic extinguishing system.
“If something happens to a data center that is not under a company’s control, they risk losing their data and having their operations disrupted,” Barani said.
Read next: CFC targets supply chain blind spot with customer business interruption product
For brokers used to property BI, cyber claims can be disorienting. There is often no physical damage to point to, which makes cause and scope harder to prove. A single incident can hit every site a company runs within hours. Interruptions are shorter but sharper, so a lost weekend of peak sales can swing the number. And indemnity periods are tight: Allianz says cyber BI cover usually runs 90 to 180 days, against 12 to 24 months for property.
In real life, that gap matters when as recovery can drag. Marks & Spencer took about 15 weeks to restore click-and-collect after its 2025 cyberattack - longer than the shortest cyber indemnity periods. “Business interruption remains the single biggest financial loss driver for cyber,” Ewing said.
Wording is the other trap. Brokers have been warning that some policies do not cover non-malicious outages or failures at third-party providers, putting a spotlight on contingent BI coverage at renewal. US buyers are paying attention: in the Allianz Risk Barometer 2026, American respondents ranked cyber their top risk at 40% and BI second at 37%, according to the survey’s US results.
Read next: £3.4M BI case highlights gaps in cover for upstream cyber disruption
Allianz’s claims files point to a few habits that cut losses. The first is speed. “The biggest loss-saving levers we see are early detection and speed of response, combined with a phased restart of core systems rather than waiting for full IT restoration,” Daum said. In one outage at a critical IT provider that hit several insureds at once, a client kept its loss down by switching to a backup cloud environment, processing high-value transactions by hand and pausing everything else.
The second is paperwork from day one. Marisa Anthony, a senior complex cyber claims analyst at Allianz Commercial, said teams focused on containment and regulators often forget to collect the evidence a BI claim will need - even though BI is “often the largest part of the claim.”
The third is rehearsal. Ewing described a client hit by ransomware a month after a tabletop exercise: staff knew their roles and kept the disruption small. As Daum put it: “Claims outcomes are materially better where business continuity plans are realistic and tested.”
