Silence.
It’s been twenty-four hours of game time since the hackers struck five thousand US water utilities.
The room in midtown Manhattan, hovering above Times Square, has gone quiet.
Disturbingly quiet.
Joshua Corman, a former CISA strategist acting as dungeon master for this afternoon’s catastrophe simulation, stands at the front. His audience is a group of insurance executives. They aren’t smiling.
“You ready? It’s about to hurt,” Corman warns.
The real danger isn’t the code. It’s what happens after.
It is still just another April afternoon. But in the simulation, second-order effects are cascading. Cold storage warehouses are warming up, rotting food supplies. Pharmaceutical manufacturing bottlenecks, creating insulin shortages. Data center cooling systems fail, dropping cloud services.
The hospitals?
Two thousand of them have no water.
With HVAC systems shutting down and July heat baking the facilities—remember, the game is set just before Independence Day, 2027, some are forced to evacuate patients.
It gets worse.
Corman projects a looping video of a burst water main on the screen.
Hackers didn’t just disrupt software.
They caused physical destruction.
Repairs will take weeks. Maybe months.
“Everyone downstream loses pressure,” Corman says, emphasizing the simplicity of it all. “Everything depends on water.”
No one is peeing.
Corman denied restroom breaks at the start. “No breaks in real incident response” is his motto.
If you go, you might miss the world ending.
So they stay put.
Their job? Decide who gets help.
Insurance executives rarely play these war games. But their role is pivotal. When a hack happens, victims call insurers first. Those companies then unlock the wallets for lawyers and cybersecurity incident responders.
Corman brought these folks because they have skin in the game.
Financial incentive to be accurate. No hyping. No downplaying.
Today, their puzzle is moral arithmetic.
Who do they save?
Big corporate clients who pay high premiums?
Or the hospitals saving lives?
What if the attack comes from the Chinese military, aimed at blinding US defenses during a hypothetical Taiwan invasion?
Do insurers pivot to keep military facilities running?
Or do they invoke the “act of war” clause?
A standard exclusion.
Zero liability.
Zero payment.
If they pull that lever, they survive financially. They also become villains in the court of public opinion.
Fifteen minutes. That’s their clock.
Most cybersecurity experts agree the clock for this scenario started ticking three years ago.
Volt Typhoon. Living Off The Land.
May 2023. Microsoft, the NSA, and CISA dropped a bombshell: Volt Typhoon.
A hacking group tied to the Chinese PLA had breached critical US infrastructure. Electric grids. Telecom. Manufacturing. Even Guam.
But this wasn’t standard espionage.
Spying is one thing. Disruption is another.
Microsoft called it “pre-positioning.”
They weren’t stealing secrets.
They were building a weapon.
They are laying the groundwork for attacks to hamper US military response in a crisis.
The goal? Create access points. Wait. Pull the trigger when needed.
As investigators dug deeper, the scope widened.
It wasn’t just major targets.
It was a water utility in Hawaii.
Ports. Oil pipelines.
And Littleton, Massachusetts.
A town of 10,50 people.
“Why hack the local light and water department?” asked Brandon Wales, a former CISA executive director, in early 2026.
“Societal chaos,” he said. “Influencing our freedom of action. Our will to fight.”
Joe Slowik, now leading threat research at Dataminr, notes that Volt Typhoon—or its evolved forms—are still there.
They use “living off the land” tactics.
No malware drops. No flashy scripts.
Just hijacking legitimate network functions.
It is excellent tradecraft.
It works perfectly against municipal utilities with tiny security budgets who have no idea they’ve been breached.
The Tip Of The Iceberg
Would we see 5,000 simultaneous water outages?
Probably not.
At least, not today.
Jen Easterly, former CISA director who led the initial response, admits the scale in the wargame is extreme.
But she offers a sober warning regarding artificial intelligence.
Over the next few years, offensive AI might outpace defensive AI.
Mass-sabotage becomes easier.
Easterly now runs RSA, but she hasn’t softened on the threat.
China’s intent remains clear.
They are deliberately embedding access in our civilian backbone.
Rob Joyce, ex-NSA director of cybersecurity, put it best recently.
He wrote that China has essentially strapped “digital explosives” to America.
And they are just sitting on it.
Quietly waiting.
Here is the rub:
Volt Typhoon has never actually pulled the trigger.
Not once.
There are no confirmed incidents of disruptive attacks yet.
We are fighting ghosts.
Imagination exercises.
That’s why you are reading this.
We needed to simulate the worst-case scenario because history offers no blueprint.
Day One. July 2027
Corman begins the game.
Shall we play? he quotes WarGames.
The setting is grim.
NYT headlines scream of impending Chinese invasion of Taiwan.
Cybercrime rangers have consumed a third of incident response capacity.
New firewall vulnerabilities are being exploited left and right.
Then, the gun goes off.
Federal advisory: Thousands of water utilities breached. Controls dead. Physical damage reported.
The insurance execs huddle.
First decision: Do they tell everyone?
One voice objects.
Don’t you think? Let clients come to us.
They vote.
The nay-sayer loses.
Alert the customers.
Corman wanders the room. He lands at my table.
Rolls a twenty-sided die.
Bad roll.
Dragos? Unavailable. CrowdStrike? Busy. Mandiant? Occupied.
The big guns are out of stock.
The team has to beg the government. Or scrape by with small shops.
“Perfect,” says one executive, staring into the void.
Who gets first dibs on the limited response resources?
They agree on size. Revenue first.
Other tables argue different philosophies. First come, first served?
Some vague sense of “National Security” dictated by the White House? (No one knows who is speaking there yet).
Where is CISA?
Absent. No Senate-confirmed director in fifteen months. Staff bleeding out.
The Human Cost
Day two arrives.
Water mains break everywhere.
A man-made drought sweeps hospitals and data centers.
Then comes the curveball.
Corman plays a video of a fictional military official.
He speaks of protecting “military mobility.”
The word China enters the chat for the first time.
The question changes.
Prioritization logic fails.
Revenue no longer matters.
Do they save hospital-dense cities?
Do they protect economic hubs?
Or do they heed the call to aid the military in its response to a geopolitical crisis?
The room stays human.
For the most part.
All fifteen minutes later, the consensus holds firm.
Save lives.
That is the answer.
But no one knows how.
There is no manual for choosing between hospitals. No algorithm for triage when the entire map is red.
They voted. They chose.
And the water is still off.
