United Airlines sues insurer Homesite over $5 million cyber claim refusal after CrowdStrike outage

United Airlines has initiated legal action against Homesite Insurance after the company declined to pay a $5 million claim linked to the July 19, 2024, CrowdStrike cyber outage. The outage severely disrupted Microsoft Windows systems worldwide and caused chaos in United's network, forcing the airline to cancel 1,600 flights and delay thousands more. About 200,000 passengers were stranded as United scrambled to restore its IT infrastructure, resulting in losses approaching $114 million.

United foreseen such a scenario and secured an extensive insurance program designed for catastrophic cyber events. This risk-transfer arrangement, known as an insurance tower, involves nine insurers providing a combined $200 million in coverage above a $50 million self-insured retention. Under this structure, United shoulders the first $50 million in losses before claiming insurance proceeds. The various tiers are divided among different insurers, each with coverage limits and specific payout responsibilities.

The first layer was insured by AIG, which paid out the full $15 million expected from its portion of coverage. The second layer, jointly insured by Starr and Evanstan, covered a $10 million limit, with each insurer paying $5 million. Scottsdale held the third layer's $10 million coverage limit and fulfilled its payout completely. The fourth layer was shared by Starr and Liberty to a $10 million limit, with both paying $5 million each.

The fifth and final layer in the tower was divided between Indian Harbor and Homesite, who shared a $10 million maximum. Indian Harbor fulfilled its commitment by paying $5 million; however, Homesite refused to pay its $5 million share. This refusal prompted United to file the lawsuit in an Illinois district court, charging Homesite with bad faith and breach of contract for failing to honor its obligations.

United's legal team contends that of the total losses from the CrowdStrike incident, approximately $20 million resulted directly from federal regulations requiring compensation payments to passengers. Homesite supposedly argued that United should have sought prior written approval before disbursing these compensations, a condition United's lawyers state is not legally justifiable or consistent with insurance norms.

The complaint emphasizes that no insurer acting in good faith would force a policyholder to choose between complying with federal mandates and receiving insurance coverage. United highlights that seven other insurers covering the same event agreed to pay their claims in full, making Homesite's stance an outlier and lacking reasonable grounds.

United also highlights contrasting positions taken within the same insurance layer, where Starr approved claim payments while Homesite denied them. This disparity supports United's argument that Homesite's refusal was not a genuine coverage dispute but rather an attempt to evade contractual responsibilities and financial commitment after collecting premiums.

The lawsuit seeks a jury trial along with the $5 million Homesite owes. Furthermore, United requests a judicial declaration that Homesite acted in bad faith and is liable for pre- and post-judgment interest, plus additional damages resulting from the denial. The suit marks a rare public confrontation over cyber insurance claims and may influence how insurers handle complex, high-value cyber events in the future.

This dispute underscores the challenges facing airlines and other large corporations in managing financial risks from increasingly frequent and impactful cyber disruptions. United's comprehensive insurance tower was designed to provide layered protection, but the refusal by a single insurer to pay can jeopardize rapid recovery efforts after catastrophic incidents.