CyberCube, the leading cyber risk analytics provider, has released a preliminary loss estimate for the Amazon Web Services (AWS) outage ranging from $38 million to $581 million.
The event, which CyberCube is nicknaming “Amazonk”, is expected to have a loss ratio impact for cyber insurers in the low- to mid-single digits, in keeping with CyberCube’s view that this event presents the potential for only moderate insurance impact. Although the event could play out in a variety of ways, CyberCube sees most potential outcomes clustering toward the lower end of the quoted range, with the higher end of the range allowing headroom for information that could emerge beyond what is known today.
The estimates were made in a second Security Incident Report (SIR) published on Amazonk for clients this week. CyberCube’s Cyber Aggregation Event Response Service (CAERS) initial procedures were activated following the outage on 20 October, which affected a broad set of downstream dependent platforms, including Snapchat, Fortnite, Roblox, Atlassian, and fintech apps such as Coinbase, Venmo, and IoT/smart-home services such as Ring. CyberCube’s SIRs are part of the CAERS offering.
In the latest SIR, CyberCube’s analysis shows that the outage is likely to have affected over 2,000 large organizations and nearly 70,000 organizations in total. The analysis is based on Portfolio Manager Version 6, which was released earlier this year. It allows users to assess potential impacts from cloud service disruptions across portfolios.
The SIR states: “In terms of industry effects, we see those that depend on high availability being the most affected, including technology and financial services firms. While the majority of AWS’s us-east-1 customers sit in the US, the effects were certainly felt by companies domiciled in the UK, Europe, and elsewhere, given the critical role that us-east-1 plays in AWS’s entire cloud infrastructure.”
It adds: “Moreover, we expect AWS will act to reimburse companies for downtime and to avoid lawsuits. In light of the short duration of the event, companies may decide it is not worth the hassle to claim. These considerations would point more in the direction of our Low estimate.
“Although initial headlines about Amazonk focused on the size and scale of AWS and the sheer number of firms reliant on it, one of the key takeaways from this event should be the levelheadedness with which the insurance industry is able to respond to it. This type of event is something that is modeled, priced for, and underwritten, and is well within insurers’ expectations.”
