The data center building boom has a geography problem. A new analysis from Howden finds that just 20 US locations account for around 80 percent of the data center floor space hit by severe tornadoes and hailstorms over the past 10 years. Sites in 155 locations were struck, but the damage concentrated heavily in a small cluster of hubs that happen to be among the country's most active build markets.
Howden's Insuring the Data Centre Supercycle report maps operational US data centers against National Oceanic and Atmospheric Administration (NOAA) severe weather records. The data centers in those 20 high-risk locations generate roughly $16 billion in annual revenue, according to the broker's analysis of 451 Research by S&P Global data. That figure is comparable in scale to the global cyber insurance market, and it sits in locations the broader insurance market has not fully modeled for aggregate exposure.
The finding is not simply about weather. Sixty-four percent of US data center capacity under construction in 2026 sits outside traditional hubs such as Northern Virginia, according to separate data from FM, pushing new projects into interior markets with elevated tornado, hail, and convective storm exposure.
Stuart Adam, head of natural resources at Howden US, said that despite their extreme weather exposure, these sites are often chosen for access to power and space.
As data center construction spreads into secondary weather-exposed markets, the clustering of exposure across a small number of locations becomes harder to see from any single program in isolation. "That creates a litany of new exposures that developers, investors, and insurers need to understand long before breaking ground," Adam said.
The second finding concerns conflict, and it was confirmed before the report published. On March 1, Iranian Shahed drones struck two Amazon Web Services data centers in the United Arab Emirates. A third AWS facility in Bahrain was also hit.
Independent accounts from Fortune, Georgia Tech researchers, and TechPolicy.Press confirmed the strikes as the first known deliberate wartime targeting of commercial data centers. Additional strikes on facilities in Bahrain and Dubai followed in subsequent weeks. Howden frames those events as a symptom rather than an anomaly.
Data center footprint within 10 to 15 kilometers of active global conflict zones grew more in 2025 alone than in the previous five years combined, according to the broker's analysis of Uppsala Conflict Data Program records and 451 Research by S&P Global data. Digital infrastructure is expanding into conflict-adjacent geographies faster than the insurance market has recalibrated for it.
The March strikes exposed a structural coverage problem. Physical damage to a data center in a conflict zone can simultaneously trigger property losses, business interruption, and widespread digital outages. Standard property policies typically exclude war, while standard cyber policies typically exclude physical damage.
Physical damage and digital outage arrived as a single event, but coverage sat in separate silos. Multiple AWS availability zones went offline simultaneously, defeating the redundancy models that insurers had priced on the assumption those zones would not fail together.
The third risk is less dramatic than a drone strike but may prove more persistent. Major data center lawsuits and arbitrations tripled globally, from four in all of 2021 to 14 in the first half of 2026 alone, according to Howden's review of court records, industry reporting, and NGO case trackers.
The driver is not construction defects or data breaches. Of the 14 cases in the first half of 2026, seven related to community complaints about noise from cooling systems, power equipment, and computing hardware. Only two such complaints appeared in the entire 2018-2025 period combined.
Of nine noise disputes tracked by Howden, only one has been resolved, and it ended in a data center closure. Planning, zoning, environmental, and noise disputes together account for 78 percent of the growth in liability cases over the past three years. Hyperscale campuses have moved into communities that had no framework for coexisting with them, and the result is a body of unresolved litigation still accelerating.
Edward Howland Jackson, chief commercial officer of global specialty at Howden, said the risks are wide-ranging and increasingly complex. "The opportunity for the insurance market is not simply to provide more capacity, but to use data, specialist advice and risk transfer to help clients identify these exposures early and build greater resilience as the sector expands," he said.
The three risks Howden identifies share a common structural feature: each is easier to see in aggregate data than in any individual insurance program. A single property placement does not surface nat-cat exposure across 20 weather-concentrated locations. A standalone cyber policy does not anticipate physical strikes that disable cloud availability zones.
A general liability program does not price for a noise complaint wave tripling faster than the asset class it covers. Howden's report is a broker's market positioning document, but its underlying data, drawn from NOAA records, UCDP conflict data, and public court records, is specific and verifiable.
