For years, cybersecurity officials have warned that Chinese state-sponsored hackers have burrowed into the networks that run American water utilities, power grids, and transportation systems. Now, a closed-door war game staged in a Times Square office tower has shown just how badly the country would cope if those hackers ever flipped the switch.

The War Game That Exposed a Nightmare Scenario

The exercise was organized by CyberAcuView, an insurance industry cybersecurity group, and led by Joshua Corman, a former strategist at the Cybersecurity and Infrastructure Security Agency. Around 30 insurance executives were split into teams and asked to respond to a simulated attack in which Chinese military hackers, known as Volt Typhoon, disrupted 5,000 water utilities across the country.

The scenario unfolded over two days of game time. Hospitals lost water pressure and had to evacuate patients as summer heat overwhelmed their cooling systems. Data centers went dark. Insulin production slowed because water-dependent drug manufacturing ground to a halt. Water mains burst, causing physical damage that would take much longer to repair than a simple software fix.

Corman denied participants organized bathroom breaks to keep the pressure realistic. “There are no breaks in real incident response,” he told the group.

The insurers, who typically approve the funding and cybersecurity responders that hacking victims rely on, had to decide who would get help first. Some teams chose to prioritize the largest clients. Others proposed a first-come, first-served approach. When Corman introduced a fictional military official demanding that water be restored to protect national defense operations, the group could not agree on how to balance saving lives against following government orders. As one participant put it, “There’s not going to be a consensus.”

By the end, Corman said the point was not to see who could win. The exercise was designed to “overwhelm” the players and force them to question their assumptions about how prepared the country really is.

China’s Real-World Capabilities

The war game was built around a genuine and growing threat. Since 2023, Microsoft, the National Security Agency, and CISA have tracked Volt Typhoon hackers breaking into critical infrastructure networks across the country, including telecommunications systems in Guam, ports, pipelines, and small utilities like the Littleton Electric Light and Water Departments in Massachusetts.

According to a threat assessment from the New Jersey Cybersecurity and Communications Integration Cell, Chinese groups including Volt Typhoon, APT41, and Salt Typhoon are laying groundwork to disrupt communications, energy, water, and transportation systems during a future conflict, most likely one centered on Taiwan. These hackers favor a technique called living off the land, meaning they hijack legitimate administrative tools already inside a network instead of installing detectable malware, which lets them linger for months or years without being noticed.

Jen Easterly, who led CISA when Volt Typhoon was first discovered, said the full scope of China’s preparations remains unclear, but its intentions do not. “What we found was really just the tip of the iceberg,” she said. Former NSA cybersecurity director Rob Joyce described the threat even more bluntly, writing that China has effectively strapped “the digital equivalent of explosives” to American infrastructure and is simply waiting.

A Senator Sounds the Alarm

Senator Sheldon Whitehouse of Rhode Island, the ranking member of the Senate Environment and Public Works Committee, has repeatedly warned that the nation’s water systems are unprepared. At a February hearing, he said flatly that “all water utilities without adequate cyber security are at risk, regardless of size.”

Whitehouse noted that hackers linked to Russia, China, Iran, and North Korea have already struck small municipal water systems in Texas, Pennsylvania, and Massachusetts, and that Rhode Island alone has suffered at least six cyberattacks on its facilities in six years, costing hundreds of thousands of dollars. He pointed out that fewer than a quarter of water utilities nationwide conduct annual cyber risk assessments. “Just imagine the consequences of a coordinated nationwide hit,” he said. “Clearly, we are not ready.”

The Resource Gap on the Ground

Jake Braun, a former Biden administration cybersecurity official who now runs DEFCON Franklin at the University of Chicago, has spent the past year trying to help small utilities close that gap. His initiative has worked with utilities in Indiana, Oregon, Utah, and Vermont, but Braun acknowledged the effort cannot scale on its own. “It will be extremely difficult to scale these efforts organically across 50,000-plus U.S. water systems,” he said, adding that meaningful progress will require significant government funding.

Braun also pointed to a cultural obstacle: many small water utility operators are wary of outside help, no matter how qualified. Overcoming that distrust, he said, is as important as fixing the technology itself.

Corman, who separately founded the nonprofit UnDisruptable27, described water as uniquely exposed compared with the heavily regulated electric grid. “Water is unguarded,” he said, warning that a loss of water pressure could force hospital evacuations within hours, especially during extreme heat.

Together, the war game, the intelligence assessments, and the warnings from officials like Whitehouse and Braun paint a consistent picture: China has the access and the intent to disrupt American water systems, and the country’s patchwork of underfunded, under-monitored utilities may not be ready to stop it.