The Data Centre Boom: Growth, Opportunity And Emerging Risk For The Insurance Industry

Data centres are critical infrastructure assets, referring to the physical facilities that house computer servers and other IT infrastructure supporting cloud computing, telecommunications and a wide range of digital operations. 

The push for greater data centres has been powered by the surge in Artificial Intelligence over recent years and has increasingly become a strategic priority for governments, investors and businesses seeking to support growing computing demands and the continued expansion of the global digital economy.

In 2024, Australia was the leading investment location for data centres, behind only the United States. Data centres in Australia are also attracting increasing regulatory attention as governments seek to manage their growing energy demands and infrastructure impacts. Most recently, the New South Wales Government introduced the Electricity Infrastructure Investment Amendment Bill 2026, while the Federal Energy Minister has proposed reforms aimed at ensuring data centres contribute to the network infrastructure costs they create or accelerate. 

This heightened regulatory focus reflects the increasing importance of data centres to the Australian economy and underscores the need to understand the associated risk exposures, including property damage, third-party liability and business interruption claims.

Climate risks 

One of the primary insurance considerations stems from the physical location of these facilities. Given their significant land, power and cooling requirements, data centres are often situated in remote areas, many of which are exposed to severe weather events, including bushfires, floods and storms. To that end, a recent study undertaken by First Street estimated that nearly 80% of data centres globally are exposed to extreme climate hazards. 

There is also the added potential for accumulation risk, caused by numerous multinational tenants operating in the same data centre, or data centres clustered in the same zones, where the insurance leads are often the same handful of underwriters and a single large event can create correlated losses across multiple sites.

It is therefore prudent that insurers and reinsurers are mindful of the risk engineering that goes into the construction and operation of data centres to ensure data centres are configured to mitigate climate-related risks specific to their location.

Business interruption 

On a related point, data centres house critical infrastructure for businesses for which time-sensitivity is paramount. As a result, any disruption caused by property damage, power outages, equipment failure or natural catastrophe events can have significant downstream consequences for customers, potentially leading to substantial business interruption (BI) losses and liability claims. 

Whilst tradition BI typically needs physical damage at the insured premises to trigger, data centre losses can result from prolonged external power outage, a utility failure or offsite damage that still forces downtime, increasing the risk exposure for insurers. 

To mitigate business interruption risk, it is recommended that data centre operators should invest in and have robust redundancy measures, including backup power, cooling systems, network connectivity and disaster recovery capabilities.

Cyber risk and third-party data breaches

Cyber risk is another key consideration for data centre operators. Given the volume of sensitive information processed and stored within these facilities, cyber incidents such as ransomware attacks, data breaches and network outages can disrupt operations and result in significant financial losses for both operators and their customers. 

While these exposures are typically addressed through specialist cyber insurance rather than general liability policies, robust cybersecurity controls remain an important component of an organisation's overall risk management framework. 

To that end, we also note that Cyber threats may give rise to significant BI losses. A ransomware attack may disrupt critical services and lead to prolonged downtime for customers that rely on uninterrupted access to data and applications.

Data centre operators may also be held liable for third-party breaches and service disruptions depending on their contract terms, service-level agreements and proof of negligence. Insurers should therefore ensure that any liability coverage is considered in light of the potential risks and their knock-on effects.