An eastward shift in tornado alley is coinciding with the buildout of data centers in places like Northern Virginia, Texas, Illinois and Georgia, risk experts revealed during a recent reinsurance industry seminar.

A particularly eye-catching slide presented during a recent Casualty Actuarial Society meeting showed a map of the U.S. with the middle of the country colored red and labeled “Traditional Tornado Alley.” A neighboring dark yellow section of similar width and length just to the east labeled “New Tornado Alley” was dotted with large blue bubbles to indicate locations with 100 or more data centers planned or constructed.

But secondary perils aren’t the only ones reinsurers need to watch as insurers expand their appetites to provide coverage for data centers, according to Maryam Haji of TransRe and Daniel Raizman of Aon, who called out fire as the No. 1 operational risk and described “blind” risk aggregations across multiple cedents on sprawling campuses during their presentation titled “Watts, Water, and Wildcards: The Unique Perils of Data Center Risk,” at the Casualty Actuarial Society’s Seminar on Reinsurance in June.

“Did they drive you around on a golf cart?” moderator Christian Hauprich, a vice president and associate actuary with TransRe, asked Raizman at one point, alluding to the scale of some centers under construction.

“I drove around on a bus,” responded Raizman, who introduced a discussion of risk aggregations by noting that he had visited a hyperscaler site the size of Manhattan. “There were roughly 300 backhoes actively working. It was the most incredible infrastructure project I’ve ever witnessed,” reported Raizman, a managing director and global head of client engagement within Aon’s Climate Risk Advisory, specializing in risk assessment for data center and digital infrastructure clients.

Unlike Raizman, who has had an up-close view of massive data center sites, 93% of the actuaries who attended the session said they know little-to-nothing about risks associated with providing insurance and reinsurance coverage for data centers of any size, which Haji explained encompass more than the largest hyperscale facilities being built by Amazon, Meta, Google and Microsoft for AI and cloud computing that are dominating the headlines.

“I read the headlines but haven’t worked on it,” roughly half the actuaries said when polled about their familiarity with data center risk, with most of the rest split between professing limited or no knowledge of the subject. Only 7% of the actuaries polled said they have working knowledge of data center risks.

Types of Data Centers and Risk Aggregations

Haji, a global head of research and catastrophe management at TransRe, started the session with some basics—explaining the different types of data centers and their evolution from design, budgeting and hardware procurement all the way through construction and operations.

The hyperscalers, she said, make up only about 10% of the total global data centers but provide more than 50% of the capacity. And they are growing significantly, she said. (Related sidebar: Growth of Data Centers”)

The smallest and oldest data centers are “edge data centers,” usually are tied to telecom and 5G infrastructure supporting low-latency applications like gaming, streaming and the Internet of Things.

Next are enterprise data centers, owned and operated by individual organizations, like banks, government entities and corporations. “They hold sensitive data that cannot be on a public cloud. That’s why most of the time they are on premises or very close to the core operation,” Haji said.

Other data centers are colocation facilities, operated by specialists who rent space, power and connectivity. These activities come with potential third-party liability risks and business interruptions across multiple tenants, she said, hinting at one type of risk aggregation that might not be readily apparent to a reinsurer. Raizman would later reference accumulation management complications that arise when data center shells (the outside of the buildings) and tenant-owned compute are insured but only building owner identities appear in exposure files.

Across various types of data centers, Raizman described both horizontal and vertical aggregations. “Think of that as sites that are close together,” he said, referring to the horizontal category. “You might already be on risk in Abilene, Texas at one site and then there’s a new campus that’s being built 20 miles away,” introducing worries about a tornado event that could impact both, he said.

Explaining vertical aggregation, Raizman referred to the existence of many different policies across multiple lines at the same address. “And in the case of reinsurers, it can be sort of blind aggregation where there’s actually exposure across multiple carriers, multiple cedents at the same property as well,” he said.

Fire and Water

During her description of the evolution of data centers, Haji highlighted other potential loss accumulations. “Think about site selection, permitting delays, design defaults,” she said, describing the earliest design stages. “All of these can generate a large amount of rework costs or delay the project,” she said, adding that design flaws can amplify losses later in a data center’s life cycle. “Just think about E&O type of coverages that can be impacted by this,” she said.

“We’re talking about E&O and liability risk at the beginning all the way through environmental liability” at the last (decommissioning) stage, she said, identifying the breadth of coverage that could be applied to the data center life cycle. “The majority of P/C lines of businesses can be affected,” she said, offering business interruption, catastrophe, builders risk, equipment breakdown, cyber and other coverages as she described the intermediate stages.

For the budgeting and logistics, Haji highlighted supply chain disruptions. “These facilities use very critical hardware equipment. We’re talking about chips, generators, cooling systems,” she reported, going on to note the potential for supply chain disruptions to delay the next phase—construction—along with physical damage perils, equipment installation issues, and contractor-related risk.

Once a data center is operational, risks of power and cooling failures, fire, natural catastrophes and cyber incidents all arise. Among these, “fire poses the biggest risk,” according to Haji.

“It’s an operational hazard,” she said, noting that data facilities have “very dense and packed server racks,” complex cooling systems and cabling, and large lithium-ion battery systems that are used for backup power. “They all generate intense heat. The minute a cooling system fails and that heat starts resulting in the ignition of the fire, the fire can spread very fast.”

“The biggest challenges in these types of facilities are fire protection and fire suppression challenges because too little means a catastrophe fire spread. Too much also means water damage and chemical material suppressant damage to the critical equipment.”

Referring to what polled actuaries in the audience viewed as the biggest risk for data centers—power outages—Hauprich asked whether insurance underwriters are covering them.

“Different insureds have service level agreements where they’re guaranteeing a certain rate of uptime, right? To the extent that something goes down, how often is that a covered cause of loss?” Hauprich asked.

Related articles: Read more about SLA Insurance and the demand for it in these articles: Lack of Proper Insurance Coverage for Data Centers Presents Pitfalls (Insurance Journal); Viewpoint: Risk Segmentation to Cover Large Data Centers (Insurance Journal); Viewpoint: Boom in Hyperscale Data Centers Puts Insurers to the Test (Carrier Management)

Based on what she’s seen in the market, Haji said: “Everybody’s focusing to mostly cover the shell. Most contracts are not including coverage for power outage.”

Haji also said that in the few coverage cases she recalled so far, rulings granted coverage only in cases where the outage was tied to physical damage. Later, she showed a slide with statistics from the Uptime Institute 2025 Global Data Center Survey revealing that 45% of outages result from power-related causes that have no physical damage trigger—issues such as uninterruptible power supply failure, transfer switch failure or generator failure, according to the text of the Uptime Institute report.

Related articles: “When the Cloud Goes Dark: Data Center Claims And Specialized Adjusting Expertise” (Claims Journal) and “Lack of Proper Insurance Coverage for Data Centers Presents Pitfalls” (Insurance Journal)

She went on to describe the interconnections between fire and outage with the example of the NorthC data center fire in the Netherlands in May. While the fire didn’t get to the main hall where server racks were sitting, firefighters shut down power to prevent further damage or explosion, she reported. The shutdown impacted a nearby university, health care system and public transport—all of which relied on the data center, Haji said, noting potentially widespread business interruption consequences of data center fires.

Haji’s description of a different fire incident at data center in South Korea illustrated intertwined property, liability and operation impacts. That fire was caused by the explosion of a battery system. More specifically, unqualified contractors attempted to move the system but failed to take proper precautions, ultimately resulting in charges of professional negligence. Reuters reported that the fire “crippled some government online services,” putting agencies ranging from police and fire to customs authorities offline.

Raizman agreed with a premise offered by Hauprich that increasing “rack density” (power consumed by the equipment in single data rack, or kilowatts per rack) compounds concentration issues associated with fires by putting more servers (and compute value) in one place, while Haji mentioned problems associated with retrofitting data centers that were not built as AI computing facilities.

“We are seeing aggressive retrofitting to accommodate for liquid cooling, denser racks and battery storage systems for backup,” she said, noting increased problems of electrical faults, “thermal runways,” and “human error, especially during the upgrade phase.”

“We are also facing water damage, not only based on fire suppression,” she added, concluding her discussion of fire-related perils. “Cooling pipes, just if they burst, can generate significant water damage or also even overheating. So, you could have water damage and a fire following,” she noted.

Secondary Perils

Haji, who began her insurance industry career as a catastrophe model developer, then turned her attention to the ominous map of a moving Tornado Alley. While data centers aren’t being built on top of earthquake faults or in hurricane-prone coastal areas, the majority of catastrophe losses in the last five years have come from secondary perils and data center growth now overlaps the regions experiencing severe convective storms, she said.

A new study on the behavior of severe convective storms finds that events usually associated with middle corridor of U.S., extending up from Texas, are shifting eastward, she said, adding that Northern Virginia, Texas, Illinois and Georgia are U.S. locations targeted for data center expansion. “All of these hubs now are sitting in the footprint of the higher risk for severe convective storm: severe flash flooding.”

Even though data center shells might be engineered to withstand property damage, power outages associated with SCS events impacts “critical uptime for these facilities, which have zero tolerance for any downtime.”

“It’s not the first effect. It’s the second and third effect down the chain that impacts customers and generates dependency concentration.

Construction Type: Retrofits, Tilt-up Concrete and Wedding-Style Tents

Still, Hauprich worried aloud that data center builders are starting to experiment with new types of construction. “How does that change the cat risk landscape?” he asked.

Is Tornado Alley Moving?

Although Haji did not identify the specific study about shifting SCS behavior during the CAS seminar, CM located these citations online:

• “Spatial trends in United States tornado frequency” by Vittorio A. Gensin and Harold E. Brooks, published Oct. 17, 2018 by npj Climate and Atmospheric Science ( https://doi.org/10.1038/s41612-018-0048-2)
• “A Comprehensive Analysis of the Spatial and Seasonal Shifts in Tornado Activity in the United States” by Timothy A. Coleman, Richard L. Thompson, and Gregory S. Forbes published June 24, 2024 by Journal of Applied Meteorology and Climatology (https://doi.org/10.1175/JAMC-D-23-0143.1)

An abstract of the 2018 research says, “Negative tendencies of tornado occurrence have been noted in portions of the central and southern Great Plains, while robust positive trends have been documented in portions of the Midwest and Southeast United States.”

The abstract for the 2024 publication says, “We show that since 1951, by critical measures (tornadogenesis events, tornado days, and tornado pathlength), tornado activity has shifted away from the Great Plains and toward the Midwest and Southeast United States.”

Haji responded first by reporting a problem with catastrophe modeling platforms: None of them are providing specific vulnerability curves for these specialized occupancies. “They are still considering it under the commercial or industrial facility type of risk,” she said.

With modeling platforms, “we always see [a] wave of the catching up” to properly assess emerging risks. Until the gap closes, “we probably will be understating this type of property risk,” she stated.

Raizman offered a distinction between well-engineered hyperscaler facilities—typically constructed with tilt-up concrete—and “small startup companies that decided to start putting server racks together in Bitcoin mining facilities. Many of those constructions are very concerning,” he said, alluding to a shortage of power that prompts the transition of Bitcoin mining warehouse-like structures into AI data centers. (See next section for discussion of power gaps.)

“We’ve also seen some ‘wedding-tent-style’ staging areas” for large data center construction projects. “When things arrive on site, and in some cases, this is hundreds or even a thousand trucks delivering materials per day, how materials are staged [for] constructions can vary,” he said, referring now to hyperscalers.

While the hyperscaler sites are well constructed, “the primary concern of these people is not insurance, right? The first thought in their head is not will this be insurable in 10 years or how is an underwriter going to treat my risk. The primary concern is how do I get online as fast as possible with the least amount of downtime.”

Several technology publications have reported that Meta has been building some data centers in tents. (See for example, Meta steals a tactic from Tesla and builds data centers in tents, TechCrunch, June 4, 2026 and “Inside Zuckerberg’s AI Playbook,” July 15, 2025, The Information. In a July 2025 interview, Meta’s CEO Mark Zuckerberg told The Information: “I wanted [the infrastructure team] not to take four years to build these concrete buildings. So, we pioneered this new method where we’re basically putting up these weatherproof tents, and building out networks and GPU clusters inside them,” further stating that they are “hurricane-proof” tents. (Another Meta executive gave a similar account of a tour of a data center site in New Albany, Ohio on LinkedIn last year.)

Building Where the Risks Are—and the Power Isn’t

While data center growth is expanding into the new tornado alley, future power generation is misaligned with planned growth in these states.

“It’s worth noting that Georgia, Virginia and Ohio have demand roughly five-times the planned power growth in those areas,” said Raizman, referring to a map graphic with states color-coded to indicate levels of future power generation across U.S. grids and numbers indicating the megawatts of power needed for planned data centers superimposed over each state. The graphic shows that Texas and California showing the strongest levels future power generation by 2030.

(A footnote on the slide indicates that data sources include U.S. Environmental Information figures on planned capacity and McKinsey’s data center supply model, among others.)

“It’s only part of the picture,” Raizman said, noting that “behind-the-meter power” from on-site gas turbines or other means of generating without connections to the grid will help hyperscalers get around this limitation.

Build vs. Compute

Asked what levels of capacity will keep insurers relevant in the market right now, speakers noted that growing reliance on external financing and lender requirements is driving demand for larger insurance towers.

“We’ve placed two $8.5 billion insurance towers” with a lot of participation,” Raizman said, also noting competitive pricing on the builders risk side. Raizman also described a London facility that Aon has developed for smaller and mid-market projects, providing $3.5 billion of pre-arranged capacity for construction all risks, delay in startup and operational property damage and business interruption coverage. (Editor’s Note: A media statement released by Aon in April also noted that this “Data Center Lifecycle Insurance Program” also includes cyber and technology E&O coverage up to $400 million, third-party liability up to $200 million, and project cargo and transport insurance up to $500 million.)

Related article: Aon Is Expanding Its Data Center Lifecycle Insurance Program Capacity to $3.5B

“Increasingly innovative ways to get really, really large sums of capacity” are needed for larger projects, Raizman said.

“As they go operational, particularly if there are lender requirements asking for total replacement cost, that’s going to be a whole different challenge,” he said.

An actuary in the audience asked about insurance for GPUs that process data for AI, suggesting that these were more valuable than the data center buildings.

Raizman agreed that GPU value “is basically 2-3X the build CapEx. So, if you say it’s a $10 billion investment in the build to get the white space, to get the core and shell, it could be another $20 billion of GPU value.”

Haji, weighing in on the insurance part of the question, noted that insurers and reinsurers are avoiding GPU coverage. “First, you have to completely understand the risk and be able to price it technically to be able to cover it… Because these are new and there is no claim history to back it up, it’s very difficult,” she said.

“Everybody is more comfortable to focus on builders risk.” And for data centers that are operational, “they only go for the shell,” she said, offering the view of the “majority of the insurers” that TransRe is talking with, as well as reinsurers themselves.

She continued: “This is definitely an emerging concept that’s coming. Everybody’s trying to get their head around it, but the complete information is not there and people are very, very hesitant to put a price to it right now and cover it.”

The audience questioner paraphrased the two responses. In other words, “the hyperscalers will be retaining almost two-thirds of the value net because we don’t have losses to price it?” he said.

“Historically, they’ve retained 100% of the risk for these data centers,” Raizman said. It’s only as they’ve started looking for external financing that hyperscalers have started to think they need to buy insurance. “Or they’ve been mandated to,” the Aon executive said.

Colocation and ‘Hidden Risk’

Haurich questioned Raizman about reinsurance issues related to smaller colocation facilities. “How can a reinsurer with a diversified portfolio adequately manage accumulations given the colocation owners are listed as the owners of the building and that makes it difficult to identify who are the tenants, the associated values, and how it all accumulates through a treaty or portfolio?” he asked.

Raizman confirmed that tracking real estate and the owners of 9,000 data centers built or in the pipeline globally is doable. “Where the chips land, where the compute actually goes, is a much, much harder challenge” outside of those who own and operate their own data centers. “For example, we have high confidence about where Meta’s compute is going. It’s going into their own data centers. But when it comes to developers and colocation players, where you could have a colocation site with 20 different tenants, that’s very hard to know where it is” unless it’s coded in your exposure file. “If you’re an insurance carrier, you’re tracking to an address or a campus.”

He said Aon is flagging data centers within property schedules to help manage building accumulations. “The gap we have—and [what] we need to come together as an industry to solve—is how are we going to better map where that compute actually lands. That is a hidden risk.”

Right now, it’s not a concern given that “the bulk of this really large value is still being built” and not yet operational.

“The future is going to look very different from what we have today.”

Today looks different than yesterday, he suggested, reflecting on the what’s happened since he started working in digital infrastructure and data centers a bit over a year ago. “A billion-dollar project was really big. Now we’re talking in $50, $100 billion campuses.”

Featured image: AI-generated (ChatGPT)