Secret War Game Simulates Catastrophic Cyberattack on US Water Supply by China’s Volt Typhoon

A high-stakes, closed-door role-playing game recently simulated a catastrophic cyberattack on the United States’ water utilities, orchestrated by China’s notorious Volt Typhoon hacking group. The exercise, designed to test response protocols, unveiled a nightmarish scenario with far-reaching consequences, underscoring the growing threat posed by state-sponsored cyber warfare targeting critical infrastructure.

The simulation, observed by WIRED, unfolded over 24 in-game hours. In this fictional timeline, hackers disrupted 5,000 water utilities across the nation. Joshua Corman, a former strategist for the Cybersecurity and Infrastructure Security Agency (CISA) serving as the game’s “dungeon master,” narrated the escalating crisis to a group of insurance executives. Their teams were tasked with allocating limited resources—cybersecurity incident responders and funds—to mitigate the damage.

Cascading Failures and Societal Chaos

The simulated attack rapidly triggered widespread second-order effects. Food refrigeration systems in cold storage warehouses began to fail, leading to spoilage. Bottlenecks in water-dependent manufacturing, such as drug and chemical production, resulted in critical shortages, including insulin. Data centers experienced cooling system failures, causing cloud service outages.

The most critical impact, however, was on healthcare. Approximately 2,000 hospitals lost access to water, severely hampering patient care and forcing evacuations. As HVAC systems shut down in the simulated July heat of 2027, facilities became dangerously hot. Corman amplified the grim reality by playing a video of a burst water main, illustrating that the hackers had achieved not just IT disruption but also physical destruction, significantly extending repair timelines.

The game’s participants, acting as insurance companies, faced the agonizing decision of prioritizing clients for assistance. Their choices were complicated by potential business relationships, the need to minimize overall harm, and the geopolitical context. The simulation suggested the attack was a Chinese military effort to impede a US response to an invasion of Taiwan. This raised questions about invoking “act of war” clauses in insurance policies, potentially leaving clients with no coverage and insurers facing reputational ruin.

Volt Typhoon: A Persistent Threat

Cybersecurity experts have long warned about the capabilities of Volt Typhoon. Discovered in May 2023 by Microsoft, CISA, and the National Security Agency, the group has been linked to the Chinese military. Their intrusions into US critical infrastructure, including manufacturing, telecommunications, and the electric grid, were particularly concerning because they appeared to go beyond traditional espionage.

Microsoft noted that Volt Typhoon was “pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.” Advisories from CISA and the NSA in early 2024 described this as “pre-positioning” – laying the groundwork for broad cyberattacks to cripple US military operations during a strategic moment, potentially coinciding with an invasion of Taiwan.

Beyond military targets, Volt Typhoon’s scope extended to civilian infrastructure. Breaches included the IT systems of a water utility in Hawaii, multiple US ports, and an oil and gas pipeline. The group also targeted smaller entities, such as the Littleton Electric Light & Water Departments in Massachusetts, a town of just under 10,500 residents. Brandon Wales, CISA’s former executive director, stated in early 2025 that such targets were aimed at creating “societal chaos in the United States—to influence our geopolitical freedom of action, our willingness to fight.”

Ongoing Intrusions and Evolving Tactics

Even years after Volt Typhoon’s initial discovery, threat intelligence analysts report that China’s efforts to prepare for US civilian infrastructure disruption persist. Joe Slowik, a former cybersecurity researcher at Los Alamos National Labs, noted that Volt Typhoon or its evolved successors continue to target US electric grids and water utilities.

These intrusions are sometimes detected, but many go unnoticed. This is attributed to the minimal security budgets of many municipal utilities and the hackers’ sophisticated “living off the land” technique, which involves hijacking legitimate network functions rather than deploying distinct malware. Slowik described this as “pretty good tradecraft,” highlighting the stealthy and adaptive nature of the threat.

Key Facts

The implications of such a coordinated cyberattack are profound. For the US, it represents a significant national security threat, capable of paralyzing essential services and undermining public trust. For the cybersecurity industry, it highlights the urgent need for enhanced defense strategies, greater investment in critical infrastructure security, and clearer protocols for responding to state-sponsored cyber warfare. The simulation served as a stark reminder that the digital battleground now extends to the very infrastructure that sustains daily life, with AI playing an increasingly central role in both offensive and defensive capabilities.

Source: Wired AI – What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out – https://www.wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhoon/