A hyperscale campus is not a point on the map

The insurance market has spent considerable time asking whether a tornado could destroy a data centre campus worth $20 billion or $30 billion.

That question misses an important feature of the risk. A hyperscale campus can extend for kilometres, with halls, substations, transformers, generators and cooling plant separated by roads and open ground. A tornado also has a footprint: it moves across the landscape as a swath.

Put those two geometries together and a trade-off emerges: spreading out the campus reduces the severity of a catastrophic loss but makes a damaging encounter more likely.

In our model, the most extreme losses fall, losses at less extreme return periods can rise, and expected annual loss remains almost unchanged.

Much of the insurance discussion starts with the maximum possible loss. Understanding tornado risk also requires looking at the size of the target.

What the market already knows

Four ideas now coexist in the market:

1. Operating loss history is limited. In FM's fifteen-year study of data centre claims, wind and hail account for 6.1% of loss cost, compared with 42.3% for fire [32]. In late 2025, Munich Re said that, to its knowledge, no data centre had suffered a direct tornado hit [33]. Swiss Re also describes empirical loss experience as limited [21].

   Construction has already given a warning: Zurich says that a tornado at a data centre site was a major cause of losses in its 2025 Builders Risk portfolio [7].

2. A direct hit could cause an enormous loss. Market commentary has contemplated tornado losses in the tens of billions [34], while hardened facilities advertise resistance to EF4 or EF5 winds [3]. That naturally focuses attention on the building envelope.

3. Building separation is intended to contain maximum loss. A campus can hold a very high total value while placing individual buildings hundreds of metres apart. This is one reason insurance programmes increasingly use estimated maximum loss rather than full replacement value [6].

   Swiss Re highlights an exception: a tornado swath can cross several separated buildings, producing a loss larger than a single-location maximum probable loss assumption would suggest [21].

4. Catastrophe models can represent a campus if the exposure data describes it. Modern platforms can handle multiple buildings. The practical question is whether the insurer has building footprints, coordinates, values and component details, or just one address and one total insured value.

   Moody's provides a useful example. For a hypothetical Dallas-Fort Worth data centre, replacing a point representation with individual building footprints left expected tornado loss broadly unchanged but reduced tornado volatility by about 38 per cent [37].

The footprint changes how loss is distributed, even when expected loss stays similar. Our study examines that redistribution in more detail.

What we modelled, and how we checked it

We modelled 16 operating and announced campuses in Texas, Oklahoma, Louisiana, Kansas and Illinois, with estimated values ranging from $0.35 billion to $10 billion [V]. The tornado event set contains 4 million simulated years, with an individual track, peak wind speed and width for each event.

Hyperscale campusesData halls · Power · Cooling

Instead of representing each campus as one location with one total insured value, we spread its value across its extent and let each tornado swath intersect the parts in its path.

We divided value between the hardened building, power and cooling equipment, and equipment inside the hall. Each had a separate damage function describing how damage changes with wind speed. To test the effect of campus size, we spread the same value across footprints from 550 metres to three kilometres wide.

Checking the hazard against the standard

The tornado maps in ASCE 7-22 use a NIST hazard model that accounts for target size. A larger facility has a higher strike probability, which changes the wind speed associated with a given return period [15][38].

For a building-sized target in Oklahoma and Louisiana, our event set's median wind speed is within 2 mph of NIST at the 3,000- and 10,000-year return periods shown below. At 100,000 years, the median is lower: 175 mph versus NIST's 186 mph [38][V]. The ASCE worked example for a Tulsa hospital gives 107 mph; our event set gives 109 mph [15][V].

Building-sized target

Tornado hazard, checked against NIST.

NIST · behind ASCE 7-22Vayuh · campus median

ASCE 7-22 worked example · Tulsa hospital [15][V]

107 mph ASCE109 mph Vayuh

Checking the damage functions against the record

Where documented losses showed that our assumptions were too optimistic, we adjusted the damage functions. Every engineered building we identified that experienced EF4 winds was written off, so we increased modelled damage at EF4 and EF5 [43]. We also revised the value split using Turner & Townsend's cost index: shell and architecture account for 9 to 14% of a data centre, while mechanical and electrical systems account for about three quarters [40].

None of these adjustments changed the direction of the findings below. The hall's share of the loss decreased.

Three things to keep in mind

• It is an accumulation experiment, not a digital twin. Actual campuses do not distribute value evenly and real tracks do not always extend across the entire site. A site plan would move individual results up or down based on how the buildings align with the track.

• Campus-scale strike frequencies are conservative. We report the frequencies directly from the event set, without adjustment. The NIST tables show a stronger increase in strike probability with target size than our event set does. The geometry effect nevertheless persists across all the width and vulnerability sensitivities we tested.

• All the losses here are due to physical damage. Business interruption, utility outages, delays and supply-chain losses are excluded, and all the sources we found expect the larger loss to come from those excluded categories.

What the numbers say

1. Footprint is a hazard variable, not just exposure information.

For a compact target 550 metres wide, the modelled average interval between tornado encounters ranges from 400 to 1,500 years, depending on location and the assumed track width [V].

Spread the same value across a footprint three kilometres wide, and the modelled encounter frequency increases three to four times.

At the Louisiana site, the modelled interval falls from about 400 years to about 130. At Fort Worth, it falls from about 850 to about 260. The frequency multiplier remains similar across the track-width assumptions we tested [V].

The building standard already recognises the reason: a larger target intercepts more tracks. Campus dimensions therefore belong in the insurance exposure data.

2. A bigger campus trades severity for frequency.

A tornado that reaches a compact campus can affect a large share of its value. The same swath usually crosses a smaller share of a campus three kilometres wide.

Across the sites and track-width assumptions we tested, an average tornado encounter covers about 6% to 14% of a campus three kilometres wide and produces physical damage of about 0.7% to 1.7% of its value [V].

For a campus valued at $10 billion, that is about $70 million to $170 million in physical damage. These partial-campus losses occur more frequently because the target is larger.

3. Separation changes the shape of the loss curve.

The key result for probable maximum loss (PML) is that separation has different effects at different return periods. Expanding a campus from 550 metres to three kilometres reduces the 1-in-10,000-year loss by about 5 to 45 per cent, depending on the campus and track-width assumption [V].

At the 1-in-1,000-year return period, however, loss increases with campus size in every case we tested [V].

The expected annual loss in the spread-footprint experiment remains practically the same as the footprint increases.

Spreading the same value changes the loss distribution: losses affecting a large share of campus value become less frequent, while losses affecting smaller shares become more frequent.

Moody's independent modelling points in the same direction: representing individual building footprints left expected tornado loss broadly unchanged while reducing volatility [37].

To assess whether building separation reduces PML, we need to specify the return period and how the campus is represented.

Separation changes the shape of the loss curve; its benefit cannot be captured by one reduction applied to every return period.

4. Equipment can drive the loss even when the structure survives.

Most of the engineering focus is on the building shell, even though it accounts for only a small amount of the modelled loss.

Turner & Townsend's US construction cost benchmark puts core, shell and architecture at 14% of an air-cooled data centre's cost, compared with 76% for mechanical and electrical systems [40]. For liquid-cooled facilities, shell and architecture fall to 9%.

Our vulnerability sensitivities show the same pattern. Depending on the assumptions, the shell accounts for about 4% to 17% of expected tornado loss [V]. Equipment inside and outside the building accounts for the rest.

Where the loss sits

Equipment carries most of the loss.

Base modelAfter validation

Winds in the EF0 to EF2 range account for about half of the expected loss at the campus [V].

Violent tornadoes contain large areas of lower wind speed around their most destructive core. There is also a separate historical finding: NIST attributed roughly 80% of insured tornado property loss to tornadoes rated EF3 or lower [43].

Which winds do the damage

About half the loss comes from EF0–EF2 winds.

The Joplin tornado provides a useful physical analogue. At St John's Regional Medical Center, NIST found no damage to the main structural system. Yet the hospital lost its substation, emergency-generator building and chiller plant, leaving it without power and unable to operate. The insured loss was about $600 million [43].

Hardening still matters. In our model, a hardened hall performs about two to three times better than an ordinary building [V].

The point is that the wall safeguards only a portion of the balance sheet.

5. The insurance limit may not be the main constraint for tornado damage.

The insurance market has expanded capacity for data centres. Aon's lifecycle programme offers up to $5 billion [22], and Marsh's Stratus exchange provides access to as much as $10 billion of operational property capacity [23].

Our tornado-only physical damage results put those limits in perspective. For a campus three kilometres wide, even losses at very long return periods generally consume a minority of total campus value [V]. A full-campus loss becomes harder to produce because the tornado must intersect the distributed assets, rather than simply reach the address.

This does not establish that a $5 billion or $10 billion programme is sufficient for a data centre. It means tornado-related physical damage is unlikely to be the reason it is inadequate.

Coverage basis, business interruption, technology values, construction risks, contingent dependencies and other perils can be much bigger questions.

For tornado risk, the first question is whether the loss curve represents the campus and its assets accurately.

6. Physical damage can be the start of a longer loss.

The physical damage calculation stops when the wind stops, but the consequences for the business continue.

The cited procurement estimates put large power transformer lead times at about 2.5 to 3 years, reaching five years for some extra-high-voltage units [27]. Generator lead times are roughly a year or more [28].

A tornado doesn't have to destroy a hall to cause a prolonged outage; it can do so by knocking out the wrong transformer, switchgear, cooling train or generator yard.

Shared dependencies can extend the disruption: the grid, common cooling systems, fibre routes, water supplies and construction schedules can all link otherwise separate buildings.

Tornado is only one part of severe convective storm risk. Hail and straight-line wind occur much more frequently. Swiss Re estimates that over a quarter of US data centre capacity sits in areas averaging at least three large-hail days a year, while about 40% sits in zones with significant to very high tornado-day frequency [21].

This tornado model addresses one part of the loss. An insurance programme has to account for other perils and the consequences of an outage as well.

What changes in practice

For underwriters and exposure managers

Assess exposure at campus level and collect data for each component. Record each hall, transformer yard, generator bank, cooling plant and substation with its coordinates and value. One latitude, one longitude and one total insured value (TIV) leave out the geometry that determines whether an event misses the campus, causes a partial loss or affects several buildings.

For reinsurers and portfolio managers

Specify both the return period and the footprint representation for a tornado PML. "One building damaged" describes a scenario, not its probability. Losses at 250-year, 1,000-year and 10,000-year return periods tell different stories about the benefit of separation.

For owners and developers

Include shared systems in the resilience calculation. Separation reduces extreme concentration, but it also creates a larger target. Transformers, generators, chillers, switchgear and other critical systems remain exposed across the site.

Test the next resilience investment against the whole system, including the equipment that keeps a hardened hall operational.

Geometry is part of the risk

Our review found no publicly documented direct hit on an operating hyperscale campus. That absence does not measure the risk.

The engineering standard already recognises that strike probability changes with target size. The insurance market also increasingly recognises the need to model a campus as a collection of buildings and equipment.

The remaining question is whether the exposure data, the PML assumptions and the resilience decisions have caught up.

A hyperscale campus is not a point on the map. Its shape and size are part of the risk.

Figures marked [V] are results of internal studies under documented assumptions. They cover physical damage only. Business interruption, delay, utility outages and supply-chain losses are excluded. Campus values and extents are estimates based on public information.