The data-center boom is building a cat aggregation reinsurers can't see

Howden's Insuring the Data Centre Supercycle report matches the operational US data-center footprint against NOAA severe weather records and finds a geography that is heavily concentrated: twenty locations account for around 80 percent of the data-center floor space struck by severe tornadoes and hailstorms over the past ten years, even though sites in 155 locations took hits. Howden's analysis of 451 Research by S&P Global puts the annual revenue generated by data centers in those twenty locations at roughly $16 billion, and the broker sizes that book next to the global cyber insurance market because both concentrate value in ways a single event can reach, which should interest a cat desk more than the headline number does.

Stuart Adam, who heads natural resources at Howden US, points out that developers pick these sites for access to power and space despite their extreme weather exposure, and the way those choices collect in a handful of hail-prone markets is what turns a siting decision into a reinsurance problem. "That creates a litany of new exposures that developers, investors, and insurers need to understand long before breaking ground," he said, though the pattern survives because no single program sees enough of the map to catch it. The direction of travel compounds the hazard: 64 percent of US data-center capacity under construction in 2026 sits outside traditional hubs such as Northern Virginia, according to separate FM data, pushing new projects into interior markets where tornado, hail, and convective storm losses are denser—the build is moving toward the hazard.

Aggregate covers and industry-loss triggers do not separate a hyperscale campus from a distribution warehouse that shares its footprint, and the value per square foot in these markets has little in common with warehouse value, so a portfolio that carries this as ordinary commercial property is likely holding an accumulation it has never measured. The defensible position for a property-cat writer is to price data-center schedules as accumulation business, against the whole exposed portfolio and not the individual site, and the retro layer behind those writers is where that concentration ultimately lands.

That concentration now has a second, man-made form. On March 1, Iranian Shahed drones struck two Amazon Web Services data centers in the United Arab Emirates, and a third AWS facility in Bahrain was hit; independent accounts from Fortune, Georgia Tech researchers and TechPolicy.Press confirmed the strikes as the first known deliberate wartime targeting of commercial data centers, with further hits in Bahrain and Dubai in the weeks after. Howden frames those events as a symptom rather than an anomaly, and the supporting number explains why: the data-center footprint within 10 to 15 kilometers of active conflict zones grew more in 2025 alone than in the previous five years combined, per the broker's reading of Uppsala Conflict Data Program records and 451 Research data.

The January discipline test this publication has argued for is supposed to be set in specialty lines, wherever the next loss lands, and a book of $16 billion in storm-exposed revenue across twenty locations in tornado and hail country—with 64 percent of the 2026 build headed into the same convective belt—is as good a candidate as any for where January's pricing gets set.