Cyber insurer Homesite Insurance Company has asked a federal judge to rule it owes United Airlines Holdings nothing for the July 2024 CrowdStrike outage. Homesite filed the complaint on July 20, 2026, in the US District Court for the Northern District of Illinois, Insurance Business Magazine reported. The insurer says United is trying to collect twice for losses it already recovered from third parties.
Homesite provides excess coverage inside United’s cyber insurance program, sitting above a primary policy from Lexington Insurance Company. The dispute centers on a business interruption claim tied to the outage, which took down United’s computer systems for several days in July 2024. United filed its own competing lawsuit against Homesite in the same Illinois court this week, according to legal trade press.
Homesite’s $5 Million Excess Layer Sits Above A $50 Million Retention
Homesite’s excess follow-form policy carries a $5 million limit. It takes a 50% share of a $10 million layer that sits above $45 million in coverage. Beneath that sits the primary Lexington policy, which carries a $15 million limit and a $50 million retention that United must absorb itself before any coverage applies.
The complaint says a faulty CrowdStrike Falcon update took down United’s systems on or about July 19, 2024. United faced several days of disruption, including cancelled flights and an inability to process payments at airports. The filing states United was fully back online by the morning of July 22, 2024, with only one flight cancelled that day.
United submitted its claim on or about June 18, 2025, using a spreadsheet to summarize its losses, Homesite alleges. The insurer says it never received the final report from the forensic accountant that both sides had approved to quantify the loss.
The July 2024 outage traced back to a single flawed content update CrowdStrike pushed to its Falcon Sensor security software. The update caused roughly 8.5 million Windows systems to crash worldwide, in what is widely described as the largest IT outage in history. Airlines were hit especially hard because check-in, dispatch, and crew-scheduling systems all depend on the same underlying software layer.
United was not alone among major US carriers that day. Delta Air Lines suffered the worst disruption, cancelling roughly 7,000 flights over five days, while American Airlines and United both recovered more quickly. That contrast matters for this case, since Homesite’s complaint leans on United’s comparatively fast recovery to question the size of the airline’s claimed losses.
Homesite’s Core Argument: United Is Seeking Double Recovery
Homesite’s central claim is that United already recovered money from third parties for its outage losses. The insurer alleges United then tried to count those recoveries against its $50 million retention instead of subtracting them from the claim itself. Homesite says its policy blocks this approach directly.
The policy language cited in the complaint states that no loss shall be paid if an insured has already collected that loss from an outsource provider or any other third party. Homesite argues this bars United from applying third-party recoveries toward its retention while still billing insurers for the same losses. The allegations have not been tested in court, and no judge has ruled on the matter.
Two Loss Categories Are Under Dispute
The complaint identifies two specific areas of disagreement between the insurer and the airline:
- Customer claim payments: United issued electronic travel certificates described as “gestures of goodwill,” along with cash payments, hotel stays, meals, ground transportation, frequent-flyer mileage awards, and minor in-flight food and beverage costs. United argues these were legally required and qualify as covered “Passenger Compensation.”
- Downstream revenue losses: United claimed lost revenue on later flight segments that ultimately operated as scheduled once systems recovered. Homesite says United used an agreed flight-value method meant only for cancelled flights, without testing that assumption against actual data.
Homesite disputes that any law or regulation required the “gestures of goodwill” payments United issued. The insurer also says United issued several of these payments without obtaining the insurers’ prior written consent, a requirement Homesite argues the policy demands.
Comparing This Fight with Other CrowdStrike Litigation
The Homesite dispute is one of several ongoing legal fronts stemming from the same July 2024 outage. In a separate case, passengers stranded by the outage asked the Fifth Circuit Court of Appeals to revive negligence claims directly against CrowdStrike. A lower court had ruled the claims were preempted by the Airline Deregulation Act, since they related too closely to airline services.
CrowdStrike’s attorney argued in that appeal that cybersecurity services are “core to the provision of airline services,” supporting preemption. Passengers’ counsel countered that the claims involved general software development duties, not airline-specific conduct, since CrowdStrike’s product is used across many industries beyond aviation.
A separate securities case also stemmed from the same event. A federal judge in Texas dismissed a CrowdStrike shareholder lawsuit over statements made before the outage, ruling investors failed to show the company intended to mislead them. Unlike the passenger and insurance disputes, that case focused on CrowdStrike’s public disclosures rather than the operational damage the outage caused.
An earlier passenger class action against CrowdStrike was also dismissed at the trial court level on the same ADA preemption grounds now under appeal. That court held that suing CrowdStrike directly, rather than the airlines themselves, does not avoid the preemption issue, since the underlying claims still relate to airline services. Together, these parallel cases show CrowdStrike and its corporate customers facing outage-related litigation on three separate fronts: passenger claims, shareholder claims, and now business-interruption coverage claims between an airline and its own insurers.
What Happens Next in the Illinois Case
Homesite’s complaint asks the court for a declaratory judgment, a ruling that would settle the coverage question without awarding damages either way. United’s competing lawsuit, filed separately in the same district, is expected to argue the opposite position. Both filings remain in early stages, and no hearing date has been set.
For claims professionals watching the case, the dispute touches several recurring cyber-coverage issues at once. These include how retention erosion interacts with double recovery, what counts as legally required passenger compensation, whether goodwill gestures qualify for coverage at all, and how strictly proof-of-loss requirements apply after a major outage.