War Game Reveals Insurers' Nightmare Scenario: Chinese Hackers Targeting US Water Infrastructure
A recent closed-door simulation organized by insurers explored what might happen if China-linked Volt Typhoon hackers targeted America's water supply infrastructure—and the results painted a troubling picture of cascading failures and systemic vulnerability.
The Scenario
The war game, known as "Volt Typhoon," put participants in the shoes of responding to a coordinated attack on water systems across multiple US cities. As the simulation unfolded, realistic failure modes emerged: water mains burst under pressure fluctuations, hospitals had to be evacuated, and the interconnected nature of utility systems meant that failures in one area quickly propagated to others.
Why Water Systems Are Vulnerable
Water utilities present attractive targets for several reasons:
- Legacy systems: Many water treatment and distribution systems rely on aging industrial control systems that were not designed with cybersecurity in mind
- Interconnected infrastructure: Water systems connect to power grids, transportation networks, and healthcare facilities
- Geographic spread: Pipelines and treatment facilities span vast distances, making comprehensive security monitoring difficult
Implications for Risk Assessment
The exercise highlighted gaps in how the insurance industry models cyber-physical risks. Traditional actuarial methods struggle with scenarios where physical damage stems from digital intrusions, particularly when nation-state actors are involved. Insurers are now grappling with questions about coverage limits, war exclusions, and systemic risk accumulation.
Broader Context
Volt Typhoon has been identified by US intelligence agencies as a Chinese state-sponsored hacking group focused on pre-positioning within critical infrastructure networks. While not confirmed to have executed disruptive attacks, security researchers warn that the group has gained persistent access to numerous essential service networks.
The war game's findings underscore growing concerns among cybersecurity experts and policymakers about the vulnerability of critical infrastructure to state-sponsored actors.