On Friday, 13 November 2026, our office ran as normal. Email worked. Documents opened. Our systems sit on a different platform from the one that failed, so we felt very little of the outage directly.
The effect came from the other side. Many of our clients and counterparties run on Microsoft. Their replies stopped, and the work that depended on them stalled. By mid-morning there was little left to progress.
That is a mild outcome. For a business whose own systems were down, the consequences can be contractual. This article covers what an SME can do technically, and where the legal exposure sits in both directions: against your suppliers, and from your own customers.
1. Not the First, Unlikely to Be the Last
- 19 July 2024, CrowdStrike. A faulty security software update crashed about 8.5 million Windows devices. Airlines, hospitals and banks were hit. Delta Air Lines later sued, alleging breach of contract and negligence and claiming losses above US$500 million. CrowdStrike replied that Delta’s own slow recovery made matters worse.
- Late October 2025, AWS. A latent fault in DNS management at a major cloud provider disrupted a wide range of services.
- 18 November 2025, Cloudflare. A bot-management configuration file grew past a hard-coded limit and crashed traffic handling across the network. It was the company’s worst outage since 2019.
- 12 to 13 November 2026, Microsoft 365. Outlook, Teams and Copilot failed across dozens of countries. Singapore’s Government Technology Agency confirmed that government email was down. Microsoft said the cause was technical, not a cyberattack.
None was an attack. Each began with a routine change inside a supplier with serious repercussions for customers. The legal question that follows is who bears the loss.
2. What an SME Can Do Technically
Technical resilience supports your legal position. When you rely on force majeure or defend a late delivery, the other side will ask what did you do to prepare. A business with a tested fallback stands in a stronger place than one who says they did not do anything or that nothing could be done. Possible technical steps include:
- Keep a second, independent messaging channel for staff and clients, on a different provider from your main one.
- Hold offline copies of live contracts, key client files and an up-to-date contact list.
- Keep backups outside your main platform, and test a restore.
- Keep emergency administrator access that does not depend on the platform that may be down.
- List your critical suppliers, and find out which of them rely on the same underlying provider.
- Write a one-page continuity plan: who decides, who calls clients, and in what order.
Email is usually the first casualty, so look at an email continuity service. These run alongside your main mail system. Inbound mail is queued at a secondary server and delivered once the main system returns. Many also give staff a web portal to read recent mail and send from your own domain during the outage. Some only queue and redeliver, with no portal. Compare how long mail is queued, how many days of mail the portal holds, whether staff can send as well as receive, and whether the service runs independently of your main provider’s infrastructure. Some require a change to your DNS mail records, so test the failover before you rely on it. Match the spend to the cost of downtime.
Watch staff behaviour too. During an outage, people reach for personal email and messaging apps to keep work moving. That can breach client confidentiality and expose personal data under the Personal Data Protection Act. Decide in advance which fallback channels are approved.
3. Claims Against Your Provider
Start with the contract. Most SMEs buy cloud services on standard terms that are not open to negotiation, and the usual provisions favour the provider:
| Clause | Typical effect |
|---|---|
| Availability commitment with service credits | Credits are often the only remedy for downtime. |
| Liability cap | Total liability limited to fees paid over a set period, commonly twelve months. |
| Exclusion of indirect or consequential loss | Lost profits and lost business are often excluded. |
| Force majeure | The provider is excused for events beyond its control. |
| Claim deadlines | Credits lapse unless claimed within a short window. |
| Foreign governing law | Local protections may not apply. |
For an outage of some hours, the realistic recovery is a service credit. A claim for lost profit will usually meet an exclusion, a cap, or both, and remoteness of damage is a further hurdle.
Can the exclusions be challenged? In Singapore, the Unfair Contract Terms Act 1977 (UCTA) controls some of them. A term excluding liability for negligence, other than for death or personal injury, must be reasonable (section 2(2) of the UCTA). So must a term in written standard terms that limits liability for breach of contract (section 3 of the UCTA). The party relying on the term must prove it is reasonable (section 11(5) of the UCTA). Courts typically weigh bargaining strength, whether the customer had a real choice, and whether the customer knew of the term.
Three limits apply. First, the UCTA may not help where a foreign law governs the contract. Second, Courts are slow to rewrite bargains between commercial parties, particularly a cap tied to fees paid. And third, the UCTA does not create liability; you still need a breach or negligence. Treat it as an argument to run, not a plan to rely on.
After an outage, keep time-stamped records of the disruption and your losses. Check the claim deadline and lodge for credits in time. Then read your insurance. Business interruption and cyber policies vary: some carry waiting periods, and some respond only to failures of your own systems, not a supplier’s. Ask your broker before the next incident, not during it.
4. Claims Against You
Your customers will not care that your supplier failed. If you promised a delivery date, a response time or a level of availability, a miss is your breach unless the contract excuses it. Your recourse against your own supplier is separate and, as section 3 shows, usually thinner. The gap between what you promised and what you can recover is where SMEs lose money.
Expect claims for breach of contract over missed deadlines or service levels, service credits or liquidated damages, termination for repeated or material breach, and negligence where you owed a professional duty, such as a missed filing or payment instruction. If personal data or client confidences moved through an unapproved fallback channel, add confidentiality and data protection claims.
Force majeure is the first defence most people reach for, and it depends wholly on the wording of the relevant clause. A clause that lists floods and strikes but says nothing of supplier or infrastructure failure leaves you arguing about events “beyond reasonable control”. Courts read these clauses by their words, and many require prompt notice and reasonable steps to avoid or reduce the effect. Expect the other side to ask why you had no backup. CrowdStrike made the same point against Delta. Frustration is rarely available for an outage of hours. What remains are the ordinary limits on damages: remoteness, mitigation, and any cap in your own terms.
Notice provisions carry a quieter risk. Contracts often require notices by email. If the recipient’s email is down, a deemed-delivery clause may still treat the notice as received. Time-limited steps, such as exercising an option, terminating, or disputing an invoice, can then be lost on either side. Use a second method of service when a deadline is close.
5. Managing the Risk in Your Own Contracts
Review your standard terms before the next incident.
Force majeure. Expressly cover failure of third-party infrastructure, telecommunications and cloud services. Require prompt notice and reasonable mitigation from yourself.
Availability promises. Commit only to what you can deliver. Exclude scheduled maintenance and third-party failures, and make service credits the sole remedy for downtime. Avoid marketing lines such as “always on”; an unqualified statement can ground a misrepresentation claim.
Limits on liability. Exclude indirect and consequential loss and loss of profit, and cap liability by reference to fees. Your terms face the same reasonableness test described above, so a proportionate cap survives better than a sweeping one.
Back-to-back terms. Align what you promise with what your suppliers promise you. Where you cannot, price the gap or insure it.
Notice. Provide a second method of notice for when email is unavailable.
Incorporation. Terms bind only if brought to the customer’s attention before the contract is made. Terms in a website footer that no one was shown may not count.
When an outage hits, tell customers early and stick to facts. Avoid admitting fault before you know the cause. A short, accurate message often prevents a dispute.
6. Planning Before the Next Outage
The next failure will come from a supplier you do not control. Your contracts, insurance and a tested fallback decide who carries the loss. If you would like your standard terms, supplier contracts or continuity plan reviewed, contact our team at OTP Law Corporation.
