A hyperscale campus is not a point on the map

A great deal of time has been spent by the insurance market asking if a tornado could destroy a data centre campus worth either $20 billion or $30 billion.

That isn't exactly the right question. A hyperscale campus isn't a single building; it can extend for kilometres and have its halls, substations, transformers, generators and cooling plant separated by roads and open land. Likewise, a tornado isn't a point hazard; it's a moving swath.

If you combine the two geometries then a counter-intuitive result occurs: spreading out the campus reduces the severity of a catastrophic loss but increases the number of damaging encounters.

The tail drops, the middle of the loss curve may rise, and expected loss remains almost unchanged.

That is important since most of the insurance talk on these campuses begins by referring to the maximum possible loss; tornado risk, on the other hand, begins one step sooner by looking at the size of the target.

What the market already knows

Four ideas now coexist in the market:

1. Very little data is available regarding operating losses. According to FM's fifteen-year study of data center loss claims, wind and hail account for 6.1% of the total loss cost, whereas fire accounts for 42.3% [32]. In late 2025 Munich Re stated that, to its knowledge, no data centre had so far suffered a direct hit from a tornado [33]. Swiss Re notes that empirical loss experience is limited [21].

   Construction has already given a warning: Zurich says that a tornado at a data centre site was a major cause of losses in its 2025 Builders Risk portfolio [7].

2. The damage from a direct hit could be massive. Commentary on the market has considered a tornado loss reaching into the tens of billions [34], and companies with hardened facilities advertise that their buildings can withstand winds of EF4 or EF5 strength [3]. It follows that attention is focused on the building envelope.

3. The principle of separation is to contain maximum loss. A campus may have a very high total value even if the individual buildings are situated hundreds of metres apart. This is one of the reasons why insurance schemes are increasingly using the estimated maximum loss rather than the full replacement value [6].

   Swiss Re explicitly deals with the exception of tornadoes: a tornado path is capable of passing through separate buildings and thus causing a loss that exceeds the amount expected from the maximum probable loss at a single location [21].

4. As long as the exposure data is available, catastrophe models can show the campus. Nowadays, the various platforms can manage exposures for more than one building. The real issue is whether the insurer actually possesses the footprints, the coordinates, the values and the information about the components rather than having just one address and one total insured value.

   Moody's has given the most clear-cut example of this, showing that when a point representation is replaced by individual building footprints in the case of a hypothetical Dallas-Fort Worth data centre, the expected tornado losses remain broadly the same but tornado volatility is reduced by about 38 per cent [37].

The result is significant since it shows that the footprint does not eliminate the risk but rather spreads it out, and our figures indicate the extent of this redistribution.

What we modelled, and how we checked it

We looked at 16 operating and announced campuses in Texas, Oklahoma, Louisiana, Kansas and Illinois, their estimated values ranging from $0.35 billion to $10 billion [V]. The tornado event set includes 4 million simulated years, with an individual track, peak wind speed and width for each event.

Hyperscale campusesData halls · Power · Cooling

Rather than treating each campus as a single location with a single total insured value, we distributed its value over the actual area it occupies and allowed each tornado swath to intersect whatever part of the campus happened to be in its path.

The value was divided among the hardened building, the power and cooling equipment, and the equipment located in the hall, each having its own damage function. In the case of the experiment on a campus scale, the value was distributed over footprints ranging in width from 550 metres to three kilometres.

Checking the hazard against the standard

The tornado maps in ASCE 7-22 are based on a NIST hazard model according to which tornado wind speeds depend on the size of the target: the bigger the facility, the higher the probability of a strike [15][38].

For a building-sized target in Oklahoma and Louisiana, our event set has a median wind speed that is within 2 mph of the NIST figures at the 3,000- and 10,000-year return periods shown below. At a return period of 100,000 years the median is lower: 175 mph as compared to NIST's 186 mph [38][V]. The example provided by the ASCE for a hospital in Tulsa is 107 mph; our event set gives 109 mph [15][V].

Building-sized target

Tornado hazard, checked against NIST.

NIST · behind ASCE 7-22Vayuh · campus median

ASCE 7-22 worked example · Tulsa hospital [15][V]

107 mph ASCE109 mph Vayuh

Checking the damage functions against the record

In cases where the documented losses indicated that our assumptions had been too optimistic, we adjusted the damage functions. All of the engineered buildings we were able to identify that experienced EF4 winds were deemed a total loss, so modelled damage at EF4 and EF5 was increased [43]. The value was then reallocated using Turner & Townsend's cost index, according to which the shell and architecture account for 9 to 14% of a data centre and the mechanical and electrical systems account for three quarters [40].

None of these adjustments changed the direction of the findings below. The hall's share of the loss decreased.

Three things to keep in mind

• It is an accumulation experiment, not a digital twin. Actual campuses do not distribute value evenly and real tracks do not always extend across the entire site. A site plan would move individual results up or down based on how the buildings align with the track.

• Campus-scale strike frequencies are conservative. We list them exactly as they appear in the event set, without making any adjustments, and the NIST tables indicate a more significant rise in the probability of a strike as the size of the target increases than is shown in our event set. However, the geometry effect itself is not dependent on this level: it remains valid across all the width and vulnerability sensitivities we tested.

• All the losses here are due to physical damage. Business interruption, utility outages, delays and supply-chain losses are excluded, and all the sources we found expect the larger loss to come from those excluded categories.

What the numbers say

1. Footprint is a hazard variable, not just exposure information.

For a compact 550 metre target, a tornado reaches the sites in the main study once in every 400 to 1,500 years, the exact figure depending on location and the assumption regarding width [V].

If the same level of value is spread over a three-kilometre area, then the site will be reached three to four times as often.

For instance, at the Louisiana site the interval estimated by the model drops from around 400 years to about 130. At Fort Worth it falls from approximately 850 to about 260. And across all the width sensitivities the frequency multiplier stays remarkably steady [V].

The reason is already included in the building regulations; a larger target will intercept more tracks and insurance exposure should therefore treat the campus dimensions in the same manner.

2. A bigger campus trades severity for frequency.

The other aspect of geometry is just as significant. A tornado which hits a compact campus can affect a large part of its value. One which reaches a campus three kilometres in extent generally cannot.

In all the sites and under all the width assumptions that we tested, the average tornado covers about 6% to 14% of a three kilometre campus and results in a physical loss equivalent to about 0.7% to 1.7% of value [V].

On a campus valued at $10 billion, the amount involved is somewhere between $70 million and $170 million. The campus is not completely destroyed but only partly damaged. Partial losses occur more often precisely because the target is larger.

3. Separation causes the loss curve to bend. It doesn't just lower it.

The outcome that is most important for PML is this: when a campus is extended from 550 metres to three kilometres, the 1-in-10,000-year loss decreases—by about 5 to 45 per cent depending on the campuses and the width assumptions [V].

That is the advantage of having the sites separated. However, in all the cases that we tested, loss increases with campus size at the 1-in-1,000-year return period [V].

The expected annual loss in the spread-footprint experiment remains practically the same as the footprint increases.

The value is likewise being redistributed along the loss curve, with fewer extremely large shares of campus value and more frequent small shares.

According to Moody's independent modelling, spatial disaggregation had no significant effect on the expected tornado losses although it did reduce the volatility [37].

To ask whether achieving building separation "reduces the PML" is incomplete without specifying which PML and at what return period.

Distance is not a single credit; it alters the shape of the curve.

4. The tornado needn't overcome the wall in order to cause the loss.

Most of the engineering focus is on the building shell, even though it accounts for only a small amount of the modelled loss.

According to Turner & Townsend's US cost benchmark, core, shell and architecture account for 14% of the cost of constructing an air-cooled data centre, as compared to 76% for the mechanical and electrical systems [40]. For liquid-cooled facilities, the figure for shell and architecture drops to 9%.

Our vulnerability sensitivities show the same pattern. On the basis of different assumptions the shell accounts for about 4% to 17% of the expected tornado losses [V]. The remainder is located in the equipment, both inside and outside the building.

Where the loss sits

Equipment carries most of the loss.

Base modelAfter validation

The winds falling within the EF0 to EF2 range are responsible for about half of the expected loss at the campus [V].

This is less surprising than it sounds. There are large regions of reduced wind speed around the most damaging core of violent tornadoes. Historically, NIST found that roughly 80% of insured tornado property loss was caused by tornadoes of EF3 strength or lower [43].

Which winds do the damage

About half the loss comes from EF0–EF2 winds.

The example of the Joplin tornado is the most clear-cut physical analogy. At St John's Regional Medical Center, NIST found that the main structural system had suffered no damage, but the hospital did lose its substation, its emergency-generator building and its chiller plant, lost power and thus became non-functional. The insured loss amounted to about $600 million [43].

The idea is not that hardening has no effect; in our model a hardened hall still performs about two to three times better than an ordinary building [V].

The point is that the wall safeguards only a portion of the balance sheet.

5. The insurance limit might not be the deciding factor when it comes to tornado-related physical damage.

A great deal of effort has been invested by the market in increasing insurance capacity for data centres; Aon's lifecycle programme currently provides as much as $5 billion [22], and Marsh's Stratus exchange gives access to as much as $10 billion of operational property capacity [23].

In contrast to those figures, our figures for physical damage caused by tornadoes alone are striking. For a campus covering three kilometres, even very remote tornado losses generally consume a minority of the total campus value [V]. It becomes all the more difficult to suffer a total physical loss of the entire campus since the tornado has to actually pass through the area of value rather than just reach the address.

This does not establish that a $5 billion or $10 billion programme is sufficient for a data centre. It means tornado-related physical damage is unlikely to be the reason it is inadequate.

Coverage basis, business interruption, technology values, construction risks, contingent dependencies and other perils can be much bigger questions.

The more urgent issue with regard to tornadoes is whether the loss curve has been based on the correct representation of exposure to begin with.

6. The figure relating to physical damage might mark the start of the loss, not its conclusion.

The physical damage calculation stops when the wind stops, but the consequences for the business continue.

In today's market a large power transformer takes about 2.5 to 3 years to obtain, and as long as five years in the case of some extra-high-voltage units [27], while generator lead times are roughly a year or more [28].

A tornado doesn't have to destroy a hall to cause a prolonged outage; it can do so by knocking out the wrong transformer, switchgear, cooling train or generator yard.

The grid is also a concentration, and so are common cooling systems, fibre routes, water supplies and construction schedules.

A tornado is only one part of the risk associated with severe convective storms. Hail and straight-line winds happen much more often. According to Swiss Re, over a quarter of US data centre capacity is located in areas that on average have at least three days of large hail each year, and about 40% is situated in areas classified as having significant to very high tornado days [21].

The tornado model therefore has to deal with a more limited question than the insurance programme eventually does. That difference is important.

What changes in practice

For underwriters and exposure managers

The exposure should be measured on a campus basis, but the data should be gathered for each component. Each hall, transformer yard, generator bank, cooling plant and substation should be recorded together with its coordinates and values. If you only include one latitude, one longitude and one TIV, you will lose the information that tells you whether an event is a miss, a partial loss or a multi-building loss.

For reinsurers and portfolio managers

For the tornado PML it is necessary to include two dimensions: the return period and the footprint representation. "One building damaged" refers to a scenario, not the return period. Tornadoes with return periods of 250 years, 1,000 years and 10,000 years tell very different stories regarding the benefits of separation.

For owners and developers

Don't regard distance as the conclusion of the resilience calculation. It is useful in that it reduces extreme concentration, but it also results in a bigger target, and the transformers, generators, chillers, switchgear and other vital systems end up being scattered throughout the tornado's path.

The next resilience dollar should therefore be tested against the entire system rather than being automatically used to make an already-strong wall stronger.

Geometry is part of the risk

We did not find any publicly documented instances of a direct hit on an operating hyperscale campus during our review. The fact that no such case was found is not a risk metric.

The engineering standard already takes into account the fact that the probability of a tornado varies with the size of the target. Similarly, the insurance market now acknowledges that campuses have to be modelled as campuses.

The remaining question is whether the exposure data, the PML assumptions and the resilience decisions have caught up.

A hyperscale campus isn't located at a single point on the map, since its shape and size are part of the risk.

The figures indicated by [V] are the outcomes of internal studies based on documented assumptions. Only physical damage is included; any losses due to business interruption, delay, utility outages and supply-chain problems are excluded. The campus values and extents are estimates derived from public information.