United Airlines sues insurer Homesite over $5 million cyber claim refusal after CrowdStrike outage
United Airlines is suing one of its cyber insurers after it refused to pay out a claim the Chicago-based carrier made following the infamous July 19, 2024, CrowdStrike outage, which bricked millions of computers running Windows software worldwide. In the immediate aftermath of the outage, United was forced to cancel 1,600 flights, and thousands more were delayed. Around 200,000 passengers were left stranded as the airline raced to restore its IT systems, resulting in losses totalling nearly $114 million. Thankfully, United had taken out a comprehensive insurance policy for just this kind of “catastrophic cyber event.” Specifically, United had created a so-called ‘insurance tower’ with nine different insurance companies providing a combined $200 million in coverage above a $50 million self-insured retention. The way this tower works is that United is responsible for the first $50 million of losses before it can start making claims for its various insurers. The first layer in this insurance tower was covered by AIG who agreed to pay out the full $15 million its coverage offered. The second layer was shared by Starr and Evanstan to a limit of $10 million. Both insurers paid out $5 million to reach this limit. The third layer was covered by Scottsdale, which also had a limit of $10 million, and this was paid out in full. The fourth layer was shared by Starr and Liberty, also to a $10 million limit. Again, both insurers paid out $5 million each. The fifth and final layer was shared by Indian Harbor and Homesite to a limit of $10 million. Indian Harbor paid out its share of $5 million, while Homesite, the final insurer in the tower, refused. “This case is about an insurer that took United’s premium, watched every other insurer… pay a valid claim in full, and then—standing alone against the unanimous judgment of seven other insurers—refused to honor its own policy,” lawyers acting on behalf of United wrote in an unusually strongly worded complaint filed in an Illinois district court earlier this week. “Homesite’s refusal is not a good-faith coverage dispute. It is an outlier position.” United’s lawyers explain that around $20 million of the losses it incurred from the CrowdStrike outage was from paying out compensation to passengers – something that it claims was required under federal mandate. Meanwhile, Homesite has allegedly claimed that United should have sought written permission before it paid out this compensation. “No insurer acting in good faith would demand that its policyholder choose between federal regulatory compliance and insurance coverage,” United’s lawyers add in their complaint. “The diametrically opposed positions taken by two insurers in the same layer… confirm that Homesite’s coverage denials are not the product of a good-faith evaluation of coverage but are instead driven by a desire to avoid its contractual obligations.” United is demanding a jury trial in this case, and, along with the $5 million it says it is owed by Homesite, the airline is also seeking a judgment declaring that Homesite acted in bad faith, pre and post-judgment interest, and other monetary damages.