Earlier this year, in a conference room high above Times Square, roughly 30 insurance executives gathered around a table to confront a scenario that most Americans would prefer to believe belongs in fiction: a Chinese cyberattack knocking out 5,000 water utilities across the United States all at once. The exercise, part of a closed-door war game designed by a former cybersecurity strategist, was built around a countdown clock and a terrifying premise — that after three years of quiet, methodical preparation, the state-sponsored hacking group known as Volt Typhoon might finally decide to detonate the digital explosives it has already planted inside America’s most critical infrastructure.
WIRED senior correspondent Andy Greenberg received a rare invitation to observe this simulation, and what he witnessed was not merely a technical exercise but a stark revelation about the fragility of the systems that keep American society functioning. The result, as the war game made clear, could include burst water mains, evacuated hospitals, and insulin shortages — cascading failures that would ripple through communities with little warning and even less preparation. The scariest part, as Greenberg later explained, might not be the hack itself, but what it revealed about who is actually in charge when the water stops flowing.
A Hacking Group Built for War, Not Espionage
Volt Typhoon represents a departure from the standard playbook of Chinese state-sponsored cyber operations. Most Chinese hacker groups focus on espionage — stealing intellectual property, monitoring government communications, and gathering intelligence on military capabilities. Volt Typhoon does something fundamentally different. Rather than quietly extracting data, it has spent the last three years breaking into American infrastructure and planting malware designed for one purpose: disruption.
When Volt Typhoon first came to public attention in 2023, the initial headlines focused on its targeting of electric grids and telecommunication networks in the continental United States and Guam. The pattern suggested a military objective, specifically the preparation for a potential Chinese invasion of Taiwan. The theory, widely accepted among national security analysts, was that China wanted the ability to delay or degrade a US military response by striking at the infrastructure that supports American forces in the Pacific. But as investigators dug deeper, a more alarming picture emerged. Volt Typhoon was not limiting itself to military targets. It was breaking into electric utilities, water treatment plants, and other civilian critical infrastructure across the entire country.
The scale of the operation became clear when Greenberg interviewed the chief information security officer of the water and electric utility in Littleton, Massachusetts — a town of 10,000 people that had somehow found itself in the crosshairs of Chinese state hackers. The security officer had no idea why his small-town utility would be targeted. But the intrusion suggested a broader strategic calculus. China, it appears, is not just preparing to disrupt the US military. It is laying the groundwork to cause widespread societal chaos, using civilian infrastructure as a lever to create distraction and confusion during a potential crisis.
Digital Bombs Strapped to American Infrastructure
Rob Joyce, the former director of cybersecurity at the National Security Agency, has described Volt Typhoon’s activity in terms that are difficult to forget. He calls it the planting of “digital bombs strapped to our infrastructure.” The metaphor is not hyperbole. Over the course of three years, the group has systematically compromised networks that control water treatment, electricity distribution, and telecommunications — systems that, if disrupted, would cause immediate and severe consequences for public health and safety.
The war game that Greenberg observed put this scenario to the test in the most concrete terms possible. Insurance executives, the people who would ultimately be responsible for underwriting the financial fallout of such an attack, were asked to simulate their response to a coordinated assault on 5,000 water utilities. The exercise was designed not just to test technical preparedness, but to expose the gaps in accountability, coordination, and decision-making that would determine whether a crisis spirals out of control. What emerged was a portrait of an infrastructure system that is deeply vulnerable — not just to the initial hack, but to the cascading failures that follow when no one is certain who has the authority to act.
What Is Volt Typhoon and Why Should Americans Be Worried?
Volt Typhoon is a Chinese state-sponsored hacking group that has spent three years infiltrating US critical infrastructure with the apparent goal of gaining the ability to disrupt it at will. Unlike traditional espionage groups, Volt Typhoon focuses on pre-positioning malware inside systems that control essential services like electricity, water, and telecommunications. The group’s activities were first publicly identified in 2023, and since then, investigators have confirmed intrusions into both military-related infrastructure and purely civilian systems, including utilities in small towns like Littleton, Massachusetts. The primary concern among national security officials is that Volt Typhoon could be used to create widespread societal chaos during a geopolitical crisis, such as a Chinese invasion of Taiwan, by disabling infrastructure that Americans rely on for daily life.
From Espionage to Sabotage: A Strategic Shift
What makes Volt Typhoon so significant is not just its technical capability, but the strategic shift it represents. Chinese cyber operations have long been characterized by a cautious approach — stealing secrets, mapping networks, and maintaining access without causing visible damage. The logic behind this restraint has been straightforward: overt attacks would provoke retaliation and escalate tensions in ways that benefit no one. But Volt Typhoon suggests a willingness to cross a line that China has historically avoided. The group is not just mapping networks; it is positioning itself to break things.
The implications of this shift extend far beyond the technical realm. For years, the cybersecurity community has warned that critical infrastructure is dangerously exposed, but the abstract nature of those warnings has made it easy for policymakers and the public to ignore them. Volt Typhoon makes the threat concrete. It is not a hypothetical vulnerability or a theoretical risk. It is an active, ongoing intrusion campaign that has already compromised systems that Americans depend on for water, electricity, and communication. The only question is whether the attackers will ever choose to flip the switch.
The Taiwan Connection: A Geopolitical Trigger
The most widely accepted theory for Volt Typhoon’s activities ties directly to the geopolitical tension surrounding Taiwan. China has made no secret of its ambitions to bring the island under its control, and the possibility of an invasion has been a central concern for US defense planners for years. In such a scenario, the ability to disrupt US military operations in the Pacific would be invaluable to Beijing. By planting malware in infrastructure that supports American bases in Guam and elsewhere, Volt Typhoon could delay or degrade the US response long enough for Chinese forces to achieve their objectives.
But the targeting of civilian infrastructure suggests a more complex strategy. If China can cause chaos on the US mainland — turning off power in some regions, disrupting water supplies in others, and sowing confusion across the country — it could divert attention and resources away from the Pacific theater. The theory is that a sufficiently disruptive attack on American soil would force US leaders to prioritize domestic stability over foreign intervention. Whether that calculus is correct is a matter of debate, but the fact that China appears to be preparing for the possibility is a sobering reality.
How Does Volt Typhoon Infiltrate US Infrastructure?
Volt Typhoon uses a combination of techniques to gain access to critical infrastructure networks. These include exploiting known vulnerabilities in internet-connected devices, conducting spear-phishing campaigns against employees with network access, and leveraging compromised credentials to move laterally through systems once inside. The group has shown particular skill at maintaining persistent access over long periods, allowing it to map networks and identify the most damaging targets. In many cases, the intrusions go undetected for months or years because the malware is designed to remain dormant until activated. This strategy of pre-positioning gives the group the ability to strike quickly and simultaneously across multiple targets when the order is given.
The Water Utility War Game: What the Simulation Revealed
The war game held in the Times Square conference room was designed by a former cybersecurity strategist who recognized that the technical aspects of an attack are only part of the story. The exercise brought together insurance executives because they represent the financial backbone of the infrastructure system — the people who would be responsible for covering the costs of a massive, coordinated attack. What they discovered was deeply unsettling.
When the simulation began, the participants quickly realized that no single entity had a clear picture of what was happening. Water utilities are owned and operated by a patchwork of public and private entities, each with its own security protocols, communication channels, and decision-making hierarchies. There is no centralized authority that can coordinate a response across 5,000 utilities. There is no playbook for restoring service when a third of them are simultaneously compromised. The exercise exposed a fundamental governance problem: the systems that Americans depend on for survival are not designed to withstand a coordinated, intelligent attack at scale.
The simulation also highlighted the cascading effects that would follow a water utility attack. Hospitals would lose access to clean water for sterilization and patient care. Insulin production, which requires precise water quality standards, would be disrupted. Firefighting capabilities would be compromised. The economic damage would run into the billions of dollars, and the human toll — measured in lives lost to preventable conditions — would be impossible to calculate in purely financial terms. The insurance executives in the room were confronting a risk that their actuarial models had never fully accounted for, and the uncertainty was paralyzing.
Three Years of Pre-Positioning: What Has Volt Typhoon Already Achieved?
Since its activities first came to light in 2023, investigators have confirmed that Volt Typhoon has compromised networks across multiple sectors and geographic regions. The group has targeted electric utilities, telecommunications providers, and water treatment facilities. It has breached both large urban systems and small municipal utilities, suggesting a broad, systematic campaign rather than a targeted operation. The intrusions have been detected in the continental United States, in Guam, and potentially elsewhere, though the full extent of the compromise remains unknown.
The three-year timeline is significant. It indicates that Volt Typhoon is not operating under time pressure. The group has been willing to invest years in gaining access, maintaining persistence, and expanding its foothold. This level of patience is characteristic of state-sponsored operations that are preparing for a specific geopolitical trigger — an event that may be years away or that may never come. But the longer the pre-positioning continues, the more extensive the compromise becomes, and the harder it will be to fully expel the intruders.
What Are the Risks of Volt Typhoon’s Digital Bombs?
The primary risk posed by Volt Typhoon is the possibility of a coordinated, simultaneous attack on multiple infrastructure targets. Because the group has spent years pre-positioning malware, it has the ability to activate its payloads across many systems at once, overwhelming response capabilities and maximizing chaos. The consequences would include power outages, water supply disruptions, telecommunications failures, and the cascading effects that follow when essential services are unavailable. Hospitals, emergency services, and other critical functions would be severely impacted. The risk is not limited to the initial attack; the secondary effects — including economic disruption, public panic, and loss of life — could persist for weeks or months after the immediate incident is resolved.
The Accountability Gap: Who Is in Charge When Infrastructure Fails?
Perhaps the most disturbing finding from the war game was not about the technical vulnerability of infrastructure, but about the governance vacuum that exists when something goes wrong. The United States does not have a centralized authority for coordinating the response to a cyberattack on water utilities. There is no single agency, no designated leader, and no established protocol for making decisions when thousands of utilities are simultaneously compromised. The responsibility is diffused across federal agencies, state governments, local authorities, and private companies, each with its own priorities, capabilities, and constraints.
During the simulation, this fragmentation became the central obstacle. Participants struggled to determine who had the authority to shut down systems, who could order a restart, and who would be liable for the consequences of those decisions. The legal and regulatory framework for critical infrastructure cybersecurity has not kept pace with the threat, and the exercise exposed gaps that no amount of technical hardening can fix. Even if every utility in the country upgraded its security tomorrow, the response to a coordinated attack would still be hamstrung by confusion about roles, responsibilities, and authorities.
This accountability gap is not unique to water utilities. It exists across much of the critical infrastructure sector, where ownership is fragmented among thousands of entities, regulation is inconsistent, and the federal government has limited authority to compel action. Volt Typhoon, by targeting this fragmentation, has identified a vulnerability that goes far beyond software vulnerabilities and network misconfigurations. It has exposed a structural weakness in how American society manages its most essential systems.
Littleton, Massachusetts: Why a Town of 10,000 People Ended Up in the Crosshairs
The intrusion into the Littleton, Massachusetts water and electric utility offers a window into the scope of Volt Typhoon’s operations. Littleton is not a strategic military hub. It is not home to a major government facility or a critical national asset. It is a small town of roughly 10,000 people, the kind of place that would never appear on a traditional target list. But there it was, compromised by a Chinese state-sponsored hacking group that had no obvious reason to be interested in its systems.
The Littleton breach suggests that Volt Typhoon is casting a wide net, targeting infrastructure regardless of its apparent strategic value. The logic may be that even small utilities, when disrupted in large numbers, can contribute to the overall chaos that China wants to create. Alternatively, the group may simply be opportunistically compromising as many systems as possible, knowing that the accumulation of access will give it more options when the time comes to act. Either way, the message is clear: no utility is too small to be a target.
The Insurance Industry’s Awakening
The fact that insurance executives were the participants in the war game is itself revealing. The insurance industry is often the first sector to recognize emerging risks, because it is the one that will ultimately have to pay for them. The exercise in Times Square was designed to force the industry to confront a scenario that its models had not adequately captured — a scenario in which the losses are not measured in millions or tens of millions, but in billions, with cascading effects that defy conventional actuarial analysis.
What the executives discovered is that the current insurance framework for cyber risk is poorly suited to a Volt Typhoon-scale event. Traditional policies exclude many types of infrastructure disruption, and the coverage that does exist is often capped at levels that would be exhausted within hours of a major attack. The war game demonstrated that the financial sector is as unprepared as the infrastructure sector for the reality of state-sponsored cyber sabotage. The implications extend beyond insurance premiums; they affect investment in infrastructure, the cost of capital for utilities, and the overall economic resilience of the country.
A Strategy of Deterrence, Not Just Defense
As the threat from Volt Typhoon has become clearer, the conversation in national security circles has shifted from pure defense to deterrence. The logic is straightforward: if the United States cannot guarantee that it can prevent an attack, it must ensure that the cost of launching one is prohibitively high. This means developing the capability to respond not just in cyberspace, but across the full spectrum of national power — including economic sanctions, diplomatic isolation, and military action.
The challenge is that deterrence requires credibility, and credibility requires demonstrated willingness. The United States has been reluctant to publicly attribute cyberattacks to state sponsors in ways that invite escalation, and the line between espionage and sabotage has historically been treated as a red line that, once crossed, would justify a proportional response. Volt Typhoon, by pre-positioning for sabotage without actually committing it, is testing the boundaries of that red line. The group is creating the capability to cause catastrophic damage while stopping just short of triggering a response. Whether this strategy of strategic ambiguity will succeed depends on whether the United States can develop a deterrence framework that addresses the threat before it materializes.
The Precedent of Quiet Infiltration
Volt Typhoon is not the first example of a state-sponsored group pre-positioning in critical infrastructure, but it is by far the most extensive and the most brazen. Previous incidents, such as the Russian intrusion into Ukraine’s power grid in 2015 and the NotPetya attack in 2017, demonstrated that nation-states are willing to use cyberattacks as instruments of coercion and disruption. What sets Volt Typhoon apart is the scale of the pre-positioning, the diversity of the targets, and the apparent patience of the operators. Three years of quiet infiltration, across hundreds or thousands of systems, represents an investment that suggests Beijing considers this capability essential to its strategic objectives.
The lesson for the United States is that the time for preparation is running out. Every month that Volt Typhoon remains undetected in a utility’s network is a month that brings the possibility of activation closer. The infrastructure sector, the insurance industry, and the federal government are all racing to catch up with a threat that has been developing for years. The war game in Times Square was a wake-up call, but wake-up calls are only useful if they lead to action.
The digital bombs are already in place. The only remaining question is whether the United States can develop the governance structures, the technical defenses, and the deterrence capabilities to ensure they are never detonated. The answer to that question will determine not just the security of American infrastructure, but the shape of geopolitical competition in the decades to come.
