Homesite Sues United Airlines Over CrowdStrike Outage Business Interruption Coverage

Homesite Sues United Airlines Over CrowdStrike Outage Insurance Recovery Dispute

Two years after a flawed CrowdStrike software update grounded flights across the globe, litigation arising from that outage has entered a new phase: not a fight between an airline and the technology vendor whose product failed, but between an airline and its own insurer. In July 2026, Homesite Insurance Company and United Airlines Holdings, Inc. filed competing lawsuits in the U.S. District Court for the Northern District of Illinois over roughly $5 million in disputed coverage tied to United's business interruption losses from the July 19, 2024 outage.¹ It is among the first publicly reported insurer-versus-insured coverage fights to emerge from that event, and it shows how “double recovery” limitations, self-insured retentions, and passenger-compensation obligations interact inside a large corporate cyber program.

The Outage and United's Claim

On July 19, 2024, a defective update to CrowdStrike's Falcon security software crashed millions of Windows-based computers around the world, disrupting airlines, banks, hospitals, broadcasters, and retailers.² Within the U.S. Fortune 500 alone, one widely cited industry study placed direct financial losses at roughly $5.4 billion, with airlines among the hardest-hit sectors.³ United says the outage forced it to cancel more than 1,600 flights — about 12 percent of its schedule — and stranded more than 200,000 passengers during one of the busiest travel weekends of the summer.⁴ According to the pleadings, United's systems were not fully restored until the morning of July 22, 2024.

United submitted a claim under its cyber insurance program in June 2025, nearly a year after the outage, supported by a spreadsheet summarizing its losses.⁵ The airline's total claimed loss came to $113,670,277, an amount that included both lost revenue from cancelled flights and the cost of compensating stranded passengers. United's complaint frames the contested portion narrowly, as $20,423,430 in passenger-compensation costs covering meals, hotel stays, ground transportation, cash reimbursements, frequent-flyer mileage awards, and electronic travel credits.⁶ Homesite describes the dispute more broadly, placing two loss categories in dispute: those customer-claim payments and United's method for calculating downstream revenue losses.⁷

A Layered Cyber Insurance Tower

United's program illustrates how large corporations structure catastrophic risk. According to the pleadings, United carried up to $200 million in cyber coverage above a $50 million self-insured retention it must absorb before any policy responds.⁸ A primary policy issued by Lexington Insurance Company, an AIG excess and surplus lines affiliate, sits just above the retention with a $15 million limit and includes a Civil Aviation Endorsement addressing passenger-compensation losses. Above that sit several excess layers. Homesite, an excess cyber liability insurer in the American Family Insurance group better known for its homeowners lines, occupies the fourth excess layer, sharing a $10 million layer on a 50/50 basis with Indian Harbor Insurance Company. Homesite's complaint describes that layer as attaching above $45 million.⁹ That $45 million measures underlying insurance rather than total loss: because the Lexington primary policy and the excess layers beneath Homesite all sit on top of the $50 million retention, roughly $95 million of loss must be absorbed before Homesite's layer is reached. Homesite's policy is a follow-form policy, meaning it generally adopts the coverage terms of the underlying Lexington policy, including the Civil Aviation Endorsement.

According to United's complaint, seven insurers across six layers of the tower — including Indian Harbor, which shares Homesite's own layer on identical terms — reviewed the same claim, applied the same policy language, and paid their full limits. Homesite alone declined to pay its $5 million share, which is why the airline frames Homesite as an outlier among an otherwise cooperative insurance panel.¹⁰

Homesite's Declaratory Judgment Complaint

Homesite moved first, filing a complaint on July 20, 2026 asking the court to declare that it owes United nothing on the claim.¹¹ First, it argues that United's passenger-compensation payments do not qualify as covered losses because they were, in Homesite's words, “voluntary,” “discretionary,” and “gestures of goodwill” rather than payments the airline was legally required to make. Homesite contends United has not identified the specific law or regulation that compelled the payments, and that the airline issued many of them without the insurers' prior written consent, as the policy requires.

Second, Homesite challenges United's method for calculating downstream revenue losses. The airline, according to the complaint, sought recovery for flights that operated on schedule once systems were restored, applying a flight-cancellation valuation method Homesite says was meant only for cancelled flights, and never tested that assumption against actual data from the later flights.

Third, and most significant for the broader industry, Homesite raises what it frames as a double-recovery problem. The complaint alleges, on information and belief, that United already recovered some outage-related losses from third parties and then applied those recoveries toward satisfying its $50 million self-insured retention rather than subtracting them from the total loss before submitting its claim. Homesite points to policy language stating that no loss “shall be paid hereunder to the extent an Insured has collected such Loss or part of Loss from an Outsource Provider or any other third party.” If United used third-party recoveries to erode the retention instead of reducing the claimed loss, Homesite argues, the practical effect is that United would recover the same dollar of loss twice — once from the third party and once from the cyber tower. Homesite also alleges United never delivered a final report from the forensic accountant the parties had agreed would quantify the loss.

United's Breach of Contract and Bad Faith Suit

United filed its own complaint the following day, July 21, 2026, asserting breach of contract and bad faith and demanding a jury trial.¹² The airline's central argument is that its passenger-compensation payments were, in fact, legally required. United points to U.S. Department of Transportation directives requiring airlines to care for stranded passengers after mass cancellations, and to civil penalties of up to $75,000 per violation that DOT may impose under its passenger-protection rules for airlines that fail to do so.¹³ United contends that across 1,600 cancelled flights, its potential regulatory exposure for noncompliance ran into the hundreds of millions of dollars, which is precisely the kind of exposure the Civil Aviation Endorsement was designed to cover. That endorsement, which appears in the underlying AIG/Lexington policy and which Homesite's excess policy follows, is quoted in United's complaint as expanding covered “Loss” to include “any Civil Aviation Fines or Passenger Compensation that the Insured is legally liable to pay in respect of a Flight Cancellation or Delay,” with “Civil Aviation Law” defined by reference to 14 C.F.R. Part 259.¹⁴ The regulation carries less weight than that framing suggests. Part 259 imposes no freestanding duty to provide meals, hotels, or ground transportation after a cancellation: the food-and-water obligation applies only during a lengthy tarmac delay, and the customer service plan rule requires a carrier merely to identify the services it offers to mitigate inconvenience from cancellations and misconnections.¹⁵ Whether Part 259, read together with a carrier's own contract of carriage and customer service plan, makes these payments ones United was “legally liable to pay” is precisely what is contested here.

United also disputes Homesite's reading of the retention provision, arguing that the policy allows recoveries obtained as an additional insured under other parties' policies to be applied against the $50 million retention — the same interpretation, United says, that seven other insurers in the tower accepted without objection. The airline characterizes Homesite's coverage positions as “pretextual and meritless” and its overall conduct as “vexatious and unreasonable,” language drawn from the Illinois statute under which United seeks penalties, attorneys' fees, and costs in addition to the disputed $5 million.¹⁶

The Double Recovery Question at the Center of the Dispute

The double-recovery dispute is most likely to resonate beyond these two parties. Anti-double-recovery language of the kind Homesite cites — barring payment for loss already collected from a third party — reflects the indemnity premise that runs through Illinois insurance law. The Illinois Supreme Court has described subrogation and indemnification as “devices for placing the entire burden for a loss on the party ultimately liable or responsible for it.”¹⁷ An insurer that pays succeeds to its insured's remedies rather than acquiring a claim of its own,¹⁸ and Illinois courts apply setoff for a related reason, to keep a claimant from collecting twice for a single injury.¹⁹ No reported Illinois decision appears to address the question these two complaints raise, so what follows is analysis rather than settled law: a clause barring payment of loss already collected from a third party sits uneasily with a reading that lets those same third-party dollars erode the retention, because the policyholder would then be credited with the recovery twice. The complication in a mass technology-failure event is that losses and recoveries do not arrive in a clean, one-to-one sequence. A policyholder like United may receive partial compensation from CrowdStrike, from other counterparties, or from its own carriers well before the ultimate scope of the loss, or its allocation among those sources, is known.

How a self-insured retention interacts with those recoveries is a genuinely difficult question: does a dollar recovered from a vendor reduce the loss subject to the retention, reduce the retention itself, or do something in between depending on when and how it was received? Homesite's position is that only the first approach is consistent with the policy language; United's is that its approach — using recoveries to satisfy the retention — is both textually permissible and consistent with how the rest of the tower treated the same recoveries. The interpretive question could in principle be answered on the policy language alone, but it does not stand alone: the parties also dispute what United actually recovered, when, and how those dollars were applied, and Homesite pleads its double-recovery theory only on information and belief. That mix makes resolution on the pleadings unlikely and points toward summary judgment after discovery. A ruling either way is likely to be cited in future cyber and property coverage disputes involving third-party recoveries from technology vendors.

Part of a Broader CrowdStrike Litigation Landscape

The July 2024 outage has already generated substantial litigation on multiple fronts. Delta Air Lines, which cancelled roughly 7,000 flights and estimated its own losses at approximately $500 million, sued CrowdStrike directly in Georgia state court in October 2024, alleging computer trespass, breach of contract, gross negligence, and related claims; CrowdStrike countersued, arguing that Delta's own IT recovery failures were largely to blame for the length of its disruption.²⁰ In May 2025, Judge Kelly Lee Ellerbe of the Fulton County Superior Court narrowed that case, allowing gross negligence and computer trespass to proceed while dismissing Delta's fraudulent inducement claim — the court found Delta had failed to state a claim for fraudulent inducement as to any alleged misrepresentation predating the parties' June 30, 2022 subscription agreement — and reading that agreement to cap recoverable damages well below the half-billion-dollar figure Delta pleaded.²¹ Passenger litigation has fared worse than early coverage suggested. The Fifth Circuit on May 20, 2026 summarily affirmed, without opinion, the dismissal of a proposed class action against CrowdStrike itself — a dismissal that rested on Airline Deregulation Act preemption applied to a technology vendor rather than a carrier. Rehearing en banc has not been granted.²² Passengers suing an airline directly did somewhat better: in Bajra v. Delta Air Lines, the Northern District of Georgia allowed some plaintiffs to press refund-based contract claims and others to proceed under the Montreal Convention, but dismissed the remainder, including claims it held preempted.²³

What distinguishes the Homesite-United matter is that it is not a dispute about who caused the outage or bears primary responsibility for the technology failure — CrowdStrike is not even a party to either suit. It is a dispute about how a policyholder and its own risk-transfer program allocate losses after the failure, including how the tower treats money recovered from outside sources. As more companies work through outage-related claims against their own cyber and business-interruption programs, this case may become an early reference point for how courts read anti-double-recovery and retention-erosion provisions.

Practical Considerations for Policyholders and Insurers

For companies managing large cyber or property towers, this dispute offers lessons worth adopting before the next mass technology-failure event. First, policyholders should map, when a claim is submitted, exactly how any third-party recoveries are being applied — toward the retention, toward the claimed loss, or held separately — and be ready to justify that allocation against the policy language rather than industry practice. A good-faith allocation can still draw a challenge from one insurer in an otherwise cooperative tower.

Second, insureds relying on regulatory compliance to characterize payments as legally required should document the specific legal basis for each category of payment when it is made, since after-the-fact characterization invites the “gesture of goodwill” argument Homesite raises here.

Third, parties negotiating follow-form excess policies should watch how retention-erosion and anti-double-recovery clauses interact, since ambiguity between two provisions that can both touch the same recovered dollars is what produced this litigation.

Fourth, parties on both sides of a large tower should recognize that uniformity among most insurers does not resolve a dispute with the layer that disagrees; each policy, even a follow-form policy, requires its own textual analysis, and a holdout's position may be validated or rejected independent of what the rest of the tower did.

Finally, companies with technology-dependent operations should revisit their proof-of-loss protocols, including the use of agreed-upon forensic accountants, before an outage occurs, since disputes over the completeness of that documentation — as Homesite has raised here — can complicate an otherwise strong coverage position.

Looking Ahead

Homesite's declaratory judgment action is assigned to Judge Franklin U. Valderrama and United's suit, No. 1:26-cv-08627, to Judge Jorge L. Alonso, and a reassignment entry appeared on the Homesite docket on July 23, 2026 — the mechanism by which related cases end up before a single judge. The first date certain is October 5, 2026, when a joint initial status report is due in the declaratory judgment action; non-binding mediation held on April 21, 2026 failed, according to United's complaint.²⁴ Nothing filed so far has tested the anti-double-recovery clause against the retention language, so every reading described above remains a pleading rather than a holding. The amount at stake is modest against the industry-wide losses from the July 2024 outage, so the significance lies less in the dollar figure than in the framework a federal court may set for how anti-double-recovery and retention provisions apply when one loss is compensated from multiple, overlapping sources. Companies with layered cyber or property towers, and the insurers that write into them, should watch this case closely.

This article was written by Arnold D. Lee, an attorney in the Phoenix, Arizona office of Spencer Fane. For more information, visit spencerfane.com.