I have a lot to say about insurance involvement in data centers but that will come in the future. Today will be another short note on current events. Namely, what happens if Iran decides to attack data centers?
You can see here (and in the image below) there are many, many data centers in the Middle East. They are concentrated in Israel, Saudi Arabia, and the UAE.
Given Iran is targeting high value locations like major hotels, why wouldn’t they turn to data centers? If they really want to provoke the Saudis and Emiratis to demand the US end the war, what better way than blowing up their prized data centers?
I’m obviously not advocating for this (I don’t think anyone in Iran is reading this!) but our job as risk managers is to imagine unlikely scenarios.
So, what are the risks? Well, the first thing people would probably say is “there must be war exclusions“.
That sounds reasonable, but are there? I don’t know. I would guess there are in Israel but Saudi Arabia and UAE have rarely faced inbound fire. Maybe there are exclusions for known adversaries like the Houthis but would it include Iran given there has been no recent conflict?
Let’s assume, for the moment, there is a war exclusion. Is it universal or does it only apply to structural damage and BI? Would the chips themselves be excluded too?
Because if not, I’ve got news for you. The chips are more valuable than the building that houses them.
Now, if there is no exclusion, then we’ve got questions about how big are the BI limits and for how long do they extend? Because it might take a few years to get a new facility up and running plus the new chips from Nvidia.
Also, what about contingent BI? Is that even offered and, if so, what exclusions does that have? It’s not hard to imagine attacks that take out power which leave the centers inoperable.
Or what about risks on centers in development? If the materials are stuck on a ship trying to enter the Gulf and the project can’t proceed, is there any exposure to that? What if said ship is blown up by the Houthis and your supplies are lost? Is the boat owner’s marine policy going to make you whole?
I could keep going, but hopefully you get the point. Insuring data centers in the Middle East is probably not the best idea. I’m not even sure it’s a good idea in the US, but it seems like more risk than reward in the Middle East.
Iran has already attacked an AWS datacenter in the region
What if data loss occurs due to attack on data centres and backup recovery is not possible? Will cyber data loss protection trigger for impacted companies…..(If there is a coverage for that)…complex risks evolving in future.
Good question. Not sure if those ancillary coverages are included as part of the data center “package” or if you have to buy that separately and if cyber writers would exclude losses triggered by a property claim. There’s a lot to learn about these coverages.