Earlier this year, a group of insurance executives convened in Times Square to simulate a chilling scenario: a cyberattack by the Chinese hacking group Volt Typhoon that incapacitated 5,000 U.S. water utilities simultaneously. This closed-door war game, which gained insights from WIRED’s senior writer Andy Greenberg, revealed startling implications regarding national security and cyber preparedness.
Volt Typhoon is a state-sponsored Chinese hacker group that has not only engaged in traditional espionage but has also been systematically infiltrating U.S. critical infrastructure, laying the groundwork for potential disruptive attacks. Greenberg described his experience exploring the group’s capabilities and highlighted the alarming fact that they have been targeting civilian infrastructure—not just military facilities. This offensive could sow chaos and potentially destabilize the U.S. in a time of crisis, such as a potential conflict over Taiwan.
The war game posed urgent questions about response strategies following such an attack. Participants were prompted to consider whom to inform about the water utility outages—only affected customers, all customers, or remain silent until inquiries were made. Additionally, the way insurance companies prioritized their responses loomed large. Initially, many executives considered who brought in the most revenue, but the complexities of saving lives quickly emerged. With hospitals needing water for HVAC systems and essential medicines like insulin in jeopardy, decisions about resource allocation turned fraught with moral weight.
As the simulation progressed, tensions escalated. They learned that their standard protocols would likely overwhelm their resources, underscoring a frightening truth: the current insurance frameworks may not suffice in the face of a large-scale cybercatastrophe. Executives openly debated whether claims could be contested based on governmental definitions of “acts of war” similar to those after significant past cyberattacks.
Ultimately, the war game highlighted the severe limitations of the insurance industry to respond effectively to a catastrophic cyber event. The conclusion—should Volt Typhoon or similar entities trigger an attack—revealed a worrying lack of preparedness and reliance on a system that may crumble under the weight of such a crisis. The final takeaway was profound: if insurance companies are not ready to support a national cyber crisis, then the nation itself may be perilously underprepared.
For more in-depth coverage, you can check Greenberg’s piece on the war game and the risks posed by Volt Typhoon here.
