U.S. economy could lose billions if attack shut down major cloud providers, report says

The U.S. economy could lose an estimated $15 billion if a major cloud provider were to suffer a major cyberattack that disabled it for a few days, according to a report published Tuesday by Lloyd’s, the London-based specialist insurance market, and AIR Worldwide, a risk modeler.

With large and small business increasingly relying on cloud services, the report was written to explain the potential impact if a major cloud provider such as Amazon Web Services, Google or Microsoft became inoperable. The report doesn’t tie the $15 billion figure to any particular cause of cloud downtime — it could be a natural disaster, structural failure or human error, not just an attack.

The authors do emphasize, though, that large-scale cyberattacks are an emerging risk.

“Cyber criminals are becoming increasingly sophisticated, attacks are happening on a larger scale and are harder to stop, and the ever-expanding internet of things is broadening the range of possible targets,” it says.

The report is based on predictions of  outages at the 15 largest cloud providers, representing 70 percent of the market share. The $15 billion figure is the estimate for an “extreme” incident whereby the largest cloud provider studied would be down for three to six days. In a “very extreme” six- to 11-day incident, the estimated losses are nearly $20 billion.

“In the event of sustained downtime of a top cloud service provider, simultaneous damage for all its clients and dependents could lead to catastrophic financial losses,” the report says.

The report does not name the specific companies tied to each estimate, but cites examples of incidents in last several years that resulted in outages in services by companies such as Amazon, Google, Verizon, Microsoft and Salesforce.

Small businesses, classified in the report as companies outside the Fortune 1000, would be at the highest risk, potentially bearing 63 percent of the economic losses, the report estimates.

“A major cloud failure would significantly impact the insurance industry, and our research has shown that such an event is plausible,” said Scott Stransky, assistant vice president at AIR Worldwide, in a statement about the report. “We hope the report will help raise awareness across the industry as to how significant losses could be, how likely they are, and provide an opportunity for insurers to better understand and manage cyber risk.”