A cyber insurer is asking a judge to declare it owes United Airlines nothing for the July 2024 CrowdStrike outage.
In a complaint filed July 20, 2026, in the US District Court for the Northern District of Illinois, Homesite Insurance Company asked the court to rule that it has no obligation to pay United Airlines Holdings' business interruption claim from the outage.
Homesite provides excess coverage in United's cyber insurance program. Its excess follow-form policy carries a $5 million limit and takes a 50% share of a $10 million layer above $45 million, according to the complaint. It follows a primary policy from Lexington Insurance Company, which has a $15 million limit and a $50 million retention - the amount United must absorb itself before this coverage applies.
On or about July 19, 2024, a faulty CrowdStrike Falcon update took down United's computer systems, the filing says. United faced several days of disruption, including cancelled flights and an inability to process payments at airports. The complaint says United was fully back online by the morning of July 22, 2024, with just one flight cancelled that day. United submitted the claim on or about June 18, 2025, Homesite alleges, with a spreadsheet summarizing its losses.
The heart of Homesite's case is that United is trying to collect twice. The complaint alleges - on information and belief - that United already recovered from third parties for outage losses, then tried to count those recoveries against its $50 million retention instead of subtracting them from its claim. Homesite says the policy blocks that, citing language that no loss "shall be paid hereunder to the extent an Insured has collected such Loss or part of Loss from an Outsource Provider or any other third party."
Two loss categories are in dispute. On customer claim payments, the filing says United handed out electronic travel certificates it called "gestures of goodwill," plus cash payments, hotels, meals, ground transportation, frequent-flyer mileage awards, and minor in-flight food and beverage amounts. United contends these were required by law and count as covered "Passenger Compensation," according to the complaint. Homesite says United "has not identified any specific 'law or regulation' that 'required'" them, and issued them without the insurers' prior written consent.
On downstream revenue losses, Homesite alleges United claimed money on later flight segments that ran as scheduled once systems recovered, using an agreed flight-value method meant only for cancelled flights - and never tested the assumption against real data.
For claims teams, the case pulls several cyber flashpoints together: retention erosion versus double recovery, what qualifies as legally required passenger compensation, whether goodwill gestures are covered at all, and how far proof-of-loss rules reach. Homesite also says United never provided the final report from the approved forensic accountant tasked with quantifying the loss.
The allegations have not been tested in court, and no judge has ruled.
