What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out

In a high-rise office tower overlooking the neon-lit expanse of Times Square, a group of senior insurance executives recently confronted a scenario that blurred the lines between a tabletop role-playing exercise and an existential national crisis. The simulation, designed to model a catastrophic and coordinated cyberattack on United States water utilities, served as a stark diagnostic tool for the nation’s readiness to handle large-scale digital sabotage. Led by Joshua Corman, a former strategist for the Cybersecurity and Infrastructure Security Agency (CISA), the exercise forced participants to navigate the collapse of critical services, the depletion of emergency resources, and the impossible ethical dilemmas that arise when the digital and physical worlds collide.

The scenario was not a work of pure fiction but a grounded projection based on current geopolitical tensions. Set in late June 2027, just days before the Independence Day holiday, the game imagined a world where 5,000 water utilities across the United States were simultaneously compromised by state-sponsored hackers. As the "dungeon master" of the simulation, Corman presented a narrative where the initial digital disruption quickly cascaded into a humanitarian disaster. Within 24 hours of game time, the secondary effects became unmanageable: refrigeration systems at food warehouses failed, chemical manufacturing for essential drugs like insulin halted, and cooling systems for data centers went offline, triggering widespread cloud service outages. Most alarmingly, the simulation reported that 2,000 hospitals were left without water, forcing evacuations and endangering patient care as HVAC systems failed during a brutal summer heatwave.

The Reality of the Threat: From Espionage to Pre-positioning

The foundation of this war game rests on a very real and documented threat known as "Volt Typhoon." In May 2023, a joint advisory from Microsoft, the National Security Agency (NSA), and CISA revealed that a sophisticated hacking group linked to the Chinese military had successfully infiltrated U.S. critical infrastructure. Unlike traditional state-sponsored hacking, which typically focuses on the theft of intellectual property or political espionage, Volt Typhoon’s activities were categorized as "pre-positioning."

According to intelligence reports, these actors were not looking for data to steal; they were looking for "access points" to hold. The goal, as identified by security analysts, is to develop the capability to disrupt critical communications and infrastructure during a future conflict, specifically a potential invasion of Taiwan. By embedding themselves in the networks of power grids, telecommunications, and water systems, these hackers effectively placed "digital explosives" within the backbone of American society, waiting for the order to detonate.

The scope of these intrusions is vast. While high-profile targets like military installations in Guam and Hawaii were primary focuses, the hackers also hit small-scale municipal targets, such as the Littleton Electric Light & Water Departments in Massachusetts—a town of just 10,500 residents. The targeting of such small entities suggests a strategy designed to create "societal chaos" rather than purely military disadvantage. As former CISA executive director Brandon Wales noted, the intent appears to be the erosion of American domestic stability and the will to engage in overseas conflicts.

Technical Sophistication: The "Living off the Land" Method

One of the most troubling aspects of the Volt Typhoon threat is the "living off the land" (LotL) technique utilized by the hackers. Traditional cyberattacks often rely on custom malware that can be detected by antivirus software or endpoint protection systems. In contrast, LotL attacks involve hijacking legitimate administrative tools and functions already present within a network’s operating system.

Because the hackers are using authorized tools to perform seemingly normal tasks, their presence is incredibly difficult to distinguish from the activities of a legitimate system administrator. This stealthy tradecraft allows intruders to remain undetected for months or even years. For municipal water utilities, many of which operate on shoestring budgets with minimal cybersecurity staff, detecting these "ghosts in the machine" is nearly impossible. Threat intelligence analysts, including those from firms like Dataminr, confirm that these efforts are ongoing, with hackers continuing to probe the U.S. electric grid and water systems for fresh vulnerabilities.

The Insurance Sector as a First Responder

The decision to run this simulation for insurance executives was highly strategic. In the event of a major cyberattack, insurance companies often act as the de facto first responders. When a company or utility is breached, their first call is typically to their insurance carrier to unlock the funds necessary to hire specialized law firms and cybersecurity incident response providers like CrowdStrike, Mandiant, or Dragos.

However, the simulation revealed a terrifying bottleneck: resource scarcity. In the "July 2027" scenario, Corman introduced a "die-roll" mechanic that determined the availability of these responders. The participants quickly learned that in a mass-casualty digital event, the top-tier response firms would be immediately overwhelmed, leaving thousands of utilities to fend for themselves or rely on unvetted, smaller contractors.

This scarcity forced the insurance teams into a series of agonizing decisions. With limited incident responders and finite funds, they had to decide who to save first. The options were bleak:

• Prioritize by Revenue: Helping the largest corporate clients first to minimize the insurer’s financial liability.
• Prioritize by National Security: Heeding government requests to focus on "dual-use" infrastructure that supports military mobility.
• Prioritize by Human Life: Focusing on restoring water to hospital-dense urban centers, even if those utilities were not their most profitable clients.

The "Act of War" Dilemma and Financial Contagion

A central tension in the simulation involved the legal and financial survival of the insurance industry itself. In the face of a state-sponsored attack that causes billions of dollars in damage, insurance companies might be forced to invoke "act of war" exclusions. These standard clauses exempt carriers from liability when damage results from armed conflict or state-on-state aggression.

If the industry invokes these exclusions, they risk a total collapse of trust and could leave the national economy in ruins as businesses fail without the promised safety net. If they do not invoke them, the sheer scale of a Volt Typhoon-style attack could bankrupt the world’s largest insurance carriers. This has historical precedent; the 2017 NotPetya attack, attributed to Russia, led to years of litigation between companies like Merck and their insurers over whether the attack constituted an act of war.

Mark Camillo, CEO of CyberAcuView, suggested that the simulation proves such cataclysmic events may be "uninsurable" under current models. He argued for the potential necessity of a government-backed fund, similar to the Terrorism Risk Insurance Act (TRIA) established after the 9/11 attacks, to provide a federal backstop for cyber disasters that exceed the private market’s capacity.

Statistical Context: The Vulnerability of U.S. Water Systems

The vulnerability of the water sector is exacerbated by its extreme decentralization. There are approximately 151,000 public water systems in the United States, ranging from massive metropolitan utilities to small rural districts. Unlike the energy sector, which has consolidated into larger, more regulated entities with robust cybersecurity requirements, the water sector remains a patchwork of local governance.

Data presented during the exercise highlighted a staggering lack of coordination:

• Membership Gap: Only 0.3% of the nation’s 151,000 water utilities are members of cybersecurity information-sharing organizations.
• Funding Disparity: While federal agencies like CISA provide guidance, there is currently no federal mandate or dedicated funding stream for cybersecurity upgrades across all municipal water systems.
• Staffing Crisis: Many small utilities have no dedicated IT staff, let alone cybersecurity specialists, making them "soft targets" for state actors.

Conclusion: Shifting from Response to Prevention

The simulation concluded not with a victory, but with a sobering realization. Joshua Corman noted that the goal of the exercise was to "surface and shatter assumptions." The primary takeaway was that the U.S. cannot "respond" its way out of a coordinated attack on its infrastructure; the only viable path is prevention.

For the insurance industry, this means moving beyond the role of a financial backstop and becoming a driver of security standards. Insurers have the unique leverage to require that their clients implement basic "cyber hygiene"—such as patching known vulnerabilities in VPNs and firewalls—as a condition of coverage. For the government, it means recognizing that the "backbone of American society" is currently unshielded.

The warning from intelligence officials remains clear. As former NSA director Rob Joyce recently wrote, the digital explosives are already in place. The Times Square simulation demonstrated that if those explosives are ever detonated, the resulting cascade of failures will challenge the very definition of national resilience. The winning move, as the simulation suggested, is to harden the target before the clock runs out.