Closed exercises conducted for insurance companies in New York showed that American critical infrastructure and the insurance market are not ready for a cyberattack that simultaneously knocks out thousands of water utilities. The simulation, which placed a hypothetical July 2027 at the center of the scenario, demonstrated how a "digital bomb" planted in life-support systems could trigger cascading destruction — from power grids and telecommunications to hospitals and pharmaceutical production. The exercise was organized by Joshua Korman, a former strategist at the U.S. Cybersecurity and Infrastructure Security Agency (CISA), who deliberately created a condition of resource scarcity to test how insurance algorithms, which are usually the first to finance the remediation of cyber incidents, perform under conditions of a national emergency.
The "Digital Bomb" Scenario: What Was Modeled in New York
The simulation was based on a scenario in which, against the backdrop of rising geopolitical tensions around Taiwan, hackers simultaneously attack 5,000 U.S. water utilities. By the organizers' design, this leads not to a simple shutdown of pumps, but to physical damage to equipment and ruptured water mains — that is, to consequences that cannot be reversed by a simple software restart. This approach reflects the tactics that, according to security experts, are used by the Chinese hacker group Volt Typhoon: unlike classic espionage, the goal here is not to steal data, but to covertly plant malicious software in a system so that, at the right moment, it can simultaneously undermine the operation of power grids, water utilities, and telecommunications.
Cascading Failure: From Water Utilities to Hospitals
By the second day of the simulated conflict, adjacent industries began to fail, vividly illustrating the chain-reaction effect. The shutdown of water-cooling systems led to mass failures of data centers and cloud services. In healthcare, thousands of hospitals were left without functioning heating, ventilation, and air conditioning (HVAC) systems, which, amid the summer heat, required the immediate evacuation of patients. In parallel, the halt in water supply froze the production of pharmaceuticals and led to a shortage of life-saving drugs, notably insulin. When allocating a limited number of incident-response specialists, participants faced a choice between saving human lives, supporting the economy, and meeting military needs.
The Insurance Market Was Unprepared
The key takeaway from the exercises — the initial attempt to prioritize clients by revenue size demonstrated the unsuitability of standard commercial approaches during a national emergency. Moreover, the exercises highlighted the main legal and financial problem: such large-scale cyberattacks are effectively uninsurable. This means that even with policies in place, coverage for cascading losses affecting multiple industries and regions at once may prove insufficient or entirely unavailable, shifting the burden of consequences onto the state and the private sector, which, by the end of the simulation, proved unprepared for such a scenario.
Volt Typhoon: A Hidden Threat Without Active Sabotage
Despite the fact that no active destructive actions by Volt Typhoon have been recorded to date, security experts confirm: the group has been penetrating American civilian and military facilities for more than three years and continues to quietly entrench itself in the networks of both small and large U.S. cities, retaining the potential for large-scale destabilization. It is precisely this "quiet" presence, rather than the hypothetical 2027 scenario, that is, in essence, the main subject of concern: the bomb has already been planted, and the exercises merely showed how vulnerable response and insurance mechanisms are when it is triggered.
