S&P warns data-center cyber risk is growing against $2 trillion of assets and $10 billion of premium

S&P says one attack could hit every tenant at once

On November 13, S&P Global RatingsPVT$123B — S&P Global Ratings, private, latest valuation $123B published a report↗ whose title is the finding: "Data Center Cyber Risk Is Increasing And Underrecognised" ¹. One successful attack on a large facility or its supply chain could strike many tenants at once, across banking, healthcare and public services, analyst Cristina Polizu writes, with "potentially extensive financial and operational impacts" ¹.

Two trillion of assets, ten billion of premium

The exposure compounds on the same curve as the build-out. S&P counts capital spending by Amazon▼−1.16% — Amazon, down 1.16 percent today, Microsoft▼−0.28% — Microsoft, down 0.28 percent today, Alphabet▼−1.54% — Alphabet, down 1.54 percent today, Oracle▼−2.86% — Oracle, down 2.86 percent today, Meta▲+2.23% — Meta, up 2.23 percent today and SpaceX▼−2.57% — SpaceX, down 2.57 percent today at about $470 billion in 2025, roughly $870 billion this year and more than $1.3 trillion in 2027, much of it into data centers ¹.

Hyperscale sites, the largest class of data center, should generate about $10 billion of new insurance premium in 2026, while insurable data-center assets pass $2 trillion next year ¹. S&P publishes no measure of whether that premium is adequate, so the pairing marks the scale of the exposure, not a tested shortfall ¹.

The plumbing is the attack surface

The weak part is structural. Cooling, power distribution, backup generators and fire suppression once ran as isolated systems; they are now managed remotely on wider corporate networks ¹. The SANS Institute, a cybersecurity research body, found 58% of 2025 attacks on operational technology entered through compromised IT, and threat researcher Cyble counted more than 2,400 control-system vulnerabilities disclosed by 152 industrial vendors that year ¹.

Landlords and regulators already price tenant credit

The repricing began before the note landed. Applied Digital▼−8.14% — Applied Digital, down 8.14 percent today, a data-center developer, caps the capacity it leases to junk-rated neoclouds, startups that rent out AI computing, such as CoreWeave▼−8.55% — CoreWeave, down 8.55 percent today, and chief executive Wes Cummins says he prefers a mix of 70% investment-grade tenants ².

CoreWeave pays about $1.83 million per megawatt a year at its Polaris Forge campus in North Dakota, roughly 10% above the rate investment-grade hyperscalers pay, while its unsecured bonds yield about 16% ³. Tenant credit has become a number in the rent.

Power follows. Wisconsin's regulator ruled in May that large customers rated below A- must post financial security↗, which left Oracle, whose rating falls short, facing a letter of credit above $7 billion, more than $100 million a year; it sued in June and dropped the suit in August ².

NiSource▲+0.52% — NiSource, up 0.52 percent today, an Indiana utility parent, has placed five gigawatts of generation in a separate unit whose big customers, among them Amazon, Google and Microsoft, fully fund the plants that serve them, outside household rates ²⁴. Barclays▲+0.13% — Barclays, up 0.13 percent today counts $300 billion to $320 billion of bond issuance this year from the hyperscalers, the largest cloud and AI operators ².

The builders say the contracts already hold the risk

The other camp answers with contract terms. CoreWeave's 15-year lease at Polaris Forge is take-or-pay, meaning it pays whether or not it uses the capacity, and since March parts of it sit in a subsidiary rated A3 with a parent guarantee behind it ³⁵.

Microsoft energy director Jeff Riles calls his company "committed to paying our own way" ⁴, Oracle calls its commitment to pay for its own Wisconsin power "unwavering" ², and New York Fed President John Williams expects "a decade of high, strong growth" from the AI boom ⁶.

Those instruments answer for a tenant walking away, not for a facility going dark, and S&P itself says banks' recovery processes cannot fully remove third-party and concentration risk ¹.

Three dates will settle what the risk costs

The Fed meets on December 8 and 9, with futures markets pricing quarter-point increases there and at the January and March meetings, after core prices rose 0.3% in October for a third straight month ⁶⁷. PJM, the largest US grid, auctions capacity next month; its monitor forecasts data centers will add $5 billion to $10 billion↗, after $29.4 billion locked in across four earlier auctions ⁸.

Applied Digital reports in January, its first full quarter with 250 megawatts live at Polaris Forge ³. By then, tenant credit will have been priced in rent, collateral and coupon; the cyber risk S&P describes still has no line item anywhere.