Single Point of Failure (cyber accumulation)
A shared digital component whose single failure can trigger simultaneous losses across a very large number of insureds.
On July 19, 2024 at 04:09 UTC, CrowdStrike pushed a faulty configuration file, Channel File 291, to its Falcon sensor. About 8.5 million Windows machines blue-screened according to Microsoft, and airlines, hospitals and banks stopped the same morning. That is a single point of failure in the cyber insurance sense. It is a shared digital component whose failure spreads to every organization that depends on it: a cloud provider, software vendor, certificate authority or security vendor. Cyber accumulation analysis starts here, because this is what turns one isolated technical event into a correlated mass loss across a portfolio. In property, geographic spread caps accumulation. In cyber, dependencies concentrate on a handful of infrastructures, and a book spread over thirty countries can go down through one vendor. The underwriter therefore maps, on top of each insured's own weaknesses, the vendors the whole portfolio shares, which is aggregate exposure work more than single-risk analysis. These dependencies are often missing from submissions. An insured knows its direct providers, rarely the ones running them one tier down, and almost never the fourth tier. CrowdStrike added a wrinkle many scenarios handled poorly: the outage was not malicious. So everything turned on whether each policy carried business interruption cover for non-malicious system failure. Not to be confused with accumulation itself: the single point of failure is the common cause, accumulation is the sum of the losses it produces. The term rarely appears in the policy, which speaks of supplier failure or dependent business interruption. It shows up in the accumulation scenarios an insurer hands its reinsurer and its supervisor.
The malicious counterpart: on February 21, 2024, the ALPHV/BlackCat ransomware got into Change Healthcare, a UnitedHealth subsidiary, through a stolen credential with no multi-factor authentication. One clearinghouse processed claims for a large share of American pharmacies and hospitals; they stayed blocked for more than a week. UnitedHealth booked 872 million dollars of attack effects in the first quarter of 2024 alone, and ended up reporting about 193 million people affected to HHS on July 31, 2025. For a book of American healthcare insureds, that is one supplier failure shared by thousands of policies at once.
- UnitedHealth Group, first-quarter 2024 results (872 million dollars of cyber attack effects), as reported by PYMNTS and ITPro; HHS Office for Civil Rights, Change Healthcare breach FAQ, updated July 31, 2025 (192.7 million people reported), as covered by Healthcare IT News and TechTarget
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.