A cybersecurity war game set in July 2027 simulated a Chinese military cyberattack on 5,000 US water utilities, leading to cascading failures across critical infrastructure. The exercise, led by former Cybersecurity and Infrastructure Security Agency strategist Joshua Corman, unfolded in a Times Square office tower and involved dozens of insurance executives role-playing emergency response decisions. In the scenario, hackers not only disrupted IT systems but also triggered physical damage, including burst water mains, cutting off water pressure to downstream areas. Within 24 hours of in-game time, food refrigeration systems failed at cold storage warehouses, insulin production stalled due to halted water-dependent manufacturing, and data centers went offline as cooling systems collapsed.
The most severe impact hit healthcare: 2,000 hospitals lost water, disrupting patient care and forcing some to evacuate as HVAC systems failed under July heat. Corman, acting as the game's narrator, intensified the pressure by showing a looping video of a ruptured pipe and denying participants restroom breaks, stating, "There are no breaks in real incident response." The executives, playing the role of insurance companies, faced a 15-minute deadline to decide how to allocate incident responders and funds. They had to weigh business relationships against public harm and consider whether military facilities should take priority if the attack was linked to a Chinese invasion of Taiwan.
The scenario raised high-stakes questions about insurance liability, particularly whether carriers would invoke an "act of war" exclusion to avoid payouts, potentially leaving clients uncompensated. Corman warned the participants, "You ready? It's about to get harder," as he introduced worsening conditions. The game emphasized how water systems underpin nearly every sector, with one statement driving the point home: "Everything depends on water." No actual cyberattack occurred, and the event was strictly a simulation designed to stress-test response protocols among private-sector insurers.
The war game assumes a Chinese cyberattack on US water systems without presenting evidence that such a plot exists. It positions insurance companies as moral gatekeepers during national disasters despite their primary duty being profit, not public safety. No Nigerian or African tech infrastructure is involved, and the scenario offers no direct implications for the continent. The exercise reveals more about American crisis imagination than about imminent global cyber threats.
Editorial note: AI-assisted opinion, not established fact. Full disclaimer →
