The US Has Known About This Chinese Hacking Campaign for Three Years. A War Game for Insurers Suggests the Defenses Aren't There

Volt Typhoon has been a public fact for thirty months. The Chinese state-linked hacking group, named in a joint CISA, FBI, NSA, and Five Eyes advisory in February 2024, has spent the years since quietly embedding inside US civilian infrastructure, water, energy, transportation, communications, using "living off the land" techniques that hide inside legitimate system tools and do not show up on a routine scan. A second advisory, AA23-144a, documented that tradecraft. A third, AA24-038a, named the targets.

The threat is no longer breaking. The question is what has changed in the interval.

Earlier this year, about 30 insurance executives sat in a Times Square conference room and ran the drill the federal government has not. The exercise, designed by a former cybersecurity strategist and observed by WIRED senior writer Andy Greenberg, simulated a coordinated Volt Typhoon strike that would knock out 5,000 US water utilities at once under a countdown clock. The 5,000 figure is a scenario input, the worst case the designer thought plausible, and the 30 executives were a stand-in for the insurance and security community that would be writing checks and issuing advisories in the first 72 hours. The point was not to predict an attack. The point was to find out who is ready for one.

The room's answer, by Greenberg's reporting, was that the gap was wide. Insurance carriers do not yet have a working model for cascading-failure coverage across thousands of small water utilities, most of them small enough to lack a dedicated security staff. Federal incident-response playbooks assume a level of pre-coordination with state and local operators that the operators themselves have never practiced. The public-private information sharing that Volt Typhoon's living-off-the-land tradecraft demands, real-time, not quarterly, is still moving at the pace of quarterly briefings.

The 5,000-utility scenario is useful precisely because it is not a prediction. It isolates the question the federal advisories have not yet answered: if the foothold is already there, the same foothold CISA has been describing since 2024, what happens when the group decides to use it? The war game did not pretend the defenders had to find the intruders. It assumed the intruders were already inside, as the public record says they are, and asked how long the country could absorb a coordinated strike before the cascading failures stopped being containable. The answer, per Greenberg's reporting, was measured in hours, not days. Recovery was measured in weeks, with most of the cost falling on carriers and ratepayers who had never priced a coordinated strike against civilian water systems into their models.

The metaphor the original WIRED reporting reaches for is "digital bombs," not literal payloads, but footholds already wired into civilian systems, waiting on a switch. That framing is useful as long as it is taken as a description of posture, not a prediction of timing. The advisory record already establishes the footholds, and the war game describes what happens when they are used. The missing layer is operational.

Posture problems respond to specific levers. Mandatory reporting timelines for water utilities above a size threshold would close the visibility gap that living-off-the-land tradecraft exploits. Federal funding tied to baseline detection capability would force the long tail of small operators to meet the standard the advisories already describe. An insurance market that prices cascading cyber risk in a way that makes preparation cheaper than recovery would turn underwriting into a forcing function. None of that is impossible. All of it is expensive, and none of it moves without a public verdict that the current posture is not enough.

The US has known about Volt Typhoon for three years. The country has not yet absorbed the blow. The distance between those two sentences is the work.