Understanding insured losses from the October AWS cloud outage

Author: Afsar Ali, Director - Product Management, Moody's

The Amazon Web Services (AWS) cloud outage at its US-East-1 region, which emerged in the early hours Eastern Time (ET) on Monday, October 20, had widespread and sudden consequences for companies and organizations increasingly reliant on their cloud services.

Insured loss estimate

To estimate potential U.S. cyber insurance losses from the AWS cloud outage, our analysis of an ensemble of Moody’s Cyber Solutions Version 9.0 event footprints found that there is a 95% chance that they will not exceed US$76 million, with a mean gross loss estimate of US$22 million.

This is based on Moody’s 2025 U.S. Cyber Insurance Exposure Database, containing around 1.84 million cyber policies.

*95% confidence interval; Losses rounded to the nearest million

Outage impacts global companies

The AWS US-East-1 region represents a significant base for Amazon, its oldest and most heavily utilized data center hub. Many companies and supporting services rely on its operation, spanning the U.S. and beyond. Moody’s was able to identify how the error impacted more than 570 service providers across the globe.

Although cloud adoption is widespread across organizations, numerous factors come into play as different sectors adopt cloud technologies to align with their needs for flexibility, security, and scalability, resulting in diverse patterns of integration and dependency.

A footprint heat map pinpointed the sectors most impacted by the outage and their overall contribution to the gross loss (see top impacted sectors in the table below).

Being impacted by the outage would not directly translate into financial losses. An organization may experience service disruption without significant financial loss, with differences driven by the revenue impact on companies of specific sizes and sectors.

Not a cyberattack, the issue arose when AWS clients were unable to connect to its automated domain name management (DNS) database system, DynamoDB, which stores clients' data and manages capacity and traffic. The root cause was an empty DNS record, which DynamoDB had not automatically repaired.

Other AWS services, such as EC2 for apps and Network Load Balancer, which manages network demand, were drawn into the cascading DynamoDB fault. Manual intervention was required, with AWS needing to take DynamoDB automation offline.

The recovery was also problematic; after the root cause had been established, at 8.35 a.m. ET, AWS reported that the underlying DNS issue had been mitigated. By 1 p.m. ET, outages spiked again, with AWS reporting all services had returned to normal operations later that day at 6.53 p.m. ET.

For many AWS clients directly affected, loss of service quickly equated to real-world financial losses, and these firms will look to their cyber insurers for support.

How can insurers begin to estimate the overall loss impact and insured losses?

Generating a loss estimate by ensuring the best capture of cloud outage peril and appropriate market conditions

We analyzed an ensemble of Moody’s Cyber Solutions Version 9.0 event footprints to estimate potential U.S. cyber insurance losses from the outage. In establishing this insured loss estimate, the first stage of the analysis involved examining the modeled event footprint to focus on the most cloud-reliant sectors.

The top five industries identified (see table above) are sectors that are highly dependent on the cloud for their business, such as retail, where the firm is either selling or delivering services via the cloud. In our estimation, these five sectors drove around 70% of gross losses.

Cyber policy terms and conditions, which typically feature a claims waiting period on a deductible basis, are considered in the Moody’s estimate.

The typical waiting period is 8-12 hours before claiming; for Cyber Solutions Version 9.0, Moody’s deployed 10 hours as a suitable average. These policy waiting periods dramatically limit potential insured gross losses.

Moody’s is also aware that a high volume of modeled small claims may not materialize as actual claims in the real world due to the administrative burden and perceived low value of pursuing them. The timing of the outage during the early morning ET may have also dampened the financial impact for firms with a meaningful diurnal pattern to their business operations.

Regardless of these sensitivities, the critical priority is to ensure that this risk is accurately represented by developing a comprehensive understanding of the intricate architecture of cloud systems, the causal relationship between proximate outages and cascading failures, the differentiation between CSP and user downtime and recovery periods, and the implications of CSP adoption patterns and usage behaviors. These effects have been explicitly addressed within Moody’s Cyber Solutions Version 9.0 as a Cloud Outage Peril.

Looking Ahead

Accidental cloud outages have historically occurred and are expected to persist in the future. Outages are an area where Moody’s modeling uses multiple layers of analytical rigor to enhance our understanding of accidental events. These efforts will continue to evolve, ensuring that future refinements support the delivery of best-in-class service offerings for our clients.

Find out more about Moody’s Cyber Solutions Version 9.0 here.