Insurance
Home›Insurance›Industry & Deals›TRIA stress test models a cyber-terror attack with $14…
TRIA stress test models a cyber-terror attack with $14.6B insured losses
The US Treasury modeled a Virginia data-centers scenario where 88.0% of $14.6 billion in insured losses came from cyber, implying a $4.85 billion federal payment under the program.
The Terrorism Risk Insurance Act, which has been reauthorized five times since Congress created it in November 2002, has never paid a claim, but US officials say that record can be misleading in today’s threat environment.
According to Morningstar DBRS and a US Treasury statutory review, the Treasury’s 2026 Report on the Effectiveness of the Terrorism Risk Insurance Program analyzed a hypothetical hybrid cyber and kinetic terrorism event targeting data centers in Virginia, with cyber effects cascading into cloud operations supported by those centers.
In the modeled scenario, total insured losses were approximately $14.6 billion, with 88.0% tied to cyber and a modeled federal payment under the Terrorism Risk Insurance Program (TRIP) of approximately $4.85 billion. The remaining roughly $9.75 billion would be absorbed by insurers and reinsurers within their deductible and copay layers.
The analysis also highlights coverage uncertainty specific to cyber terrorism, including attribution delays that can take months or years, while TRIA requires the Treasury Secretary to certify an act of terrorism. It further notes that TRIA was not originally designed as a comprehensive catastrophic cyber backstop, given policy wording and certification challenges in coverage categories that Congress did not have in mind when the act was written.