When asked about the kinds of things that keep a data center insurer up at night, Darren Tasker, North America’s head of construction at insurer Allianz, starts his response unexpectedly.

“I would say tornadoes,” he declares. “An EF5 tornado that has good accuracy that hits one of our facilities without a significant spread of risk.”

While it is well-known that data centers have to stare down all manner of threats, including fire, long lead times for key infrastructure, workforce shortages, permitting issues, and even terrorism, the inclusion of tornadoes into this rogue’s gallery of issues might come as a surprise.

But it stands to reason that insurers, which make a profit from correctly pricing risk, are worried about tornadoes – especially the “EF5” kind – it might be time to start wondering whether data center developers have to worry as well.

So what is the chance that a data center gets hit by a tornado? What happens if a data center gets hit by a tornado? And how much will an insurer like Allianz have to cough up if that happens?

Mapping the storms

On average, there are about 967 recorded tornadoes per year in the US, according to data provided by the US National Oceanic and Atmospheric Administration (NOAA).

Most of these tornadoes form in the eastern portion of the continental US, and they are most common in the states that constitute Tornado Alley – a collection of states in the central US – and Dixie Alley, which covers several southeastern states traditionally considered part of the American South.

On a state-by-state basis, Texas sports the highest average number of tornadoes recorded per year at 133, followed by Kansas, Oklahoma, Illinois, Missouri, Alabama, and Florida, respectively. All of these states are located in either Tornado Alley or Dixie Alley.

Of those ~1,000 tornadoes, a large majority – around 60 percent – are extremely weak. In the US, tornadoes are rated using the Enhanced Fujita scale, which grades on a scale of 0 to five based on the damage they cause. This is usually correlated with wind speeds, and EF5 tornadoes – the strongest and the rarest – can range between 200-230 mph (321-370 km/h).

EF5 storms have the ability to devastate cities, leveling houses and other structures. The costliest tornado in US history, which hit the city of Joplin, Missouri, in May 2011, destroyed about a quarter of the city, leveling around 8,000 buildings, including homes, businesses, and hospitals.

One could assume that climate change has worsened tornadoes. But the number of tornadoes and the frequency of strong storms have actually remained constant, and the only thing that seems to have changed is their chronological distribution, according to Professor Jana Houser, a meteorologist at The Ohio State University.

This means that there will be fewer tornado days, but more tornadoes on the days when a storm does strike.

Strong tornadoes are uncommon, and catastrophic ones – like the EF5 described by Allianz’s Tasker – are rare. According to NOAA data, the average number of EF3-EF5 tornadoes per 10,000 sqm (108,000 sq ft) per year is 0.1. The highest frequency is found in Mississippi and Tennessee at 0.5, and Alabama, Kansas, and Oklahoma come in at a narrow second of 0.4. Texas, funnily enough, is benchmarked at the national average of 0.1, owing to its large size.

Does this map onto data center developments, both new and existing? Sort of.

The data center story in the age of artificial intelligence should be familiar by now. Demand for AI has driven up demand for AI data centers, which are bigger, costlier, and use more energy. These factors – especially the last – have driven developers to set up shop in states that offer certain perks, like tax incentives, cheap land, and fast power.

Some of these states sit squarely in tornado land.

Texas is a prime example. The Lone Star State is home to one of the US’ largest concentrations of data centers, and it has been famously friendly to the industry – the state government offered $1 billion worth of data center subsidies in 2025, according to non-profit Good Jobs First.

OpenAI’s first Stargate facility, with a planned capacity of up to 1.2GW, is being built in Abilene, a town on the southern edge of Tornado Alley that was hit by seven EF2 tornadoes in May 2019 that left 400 properties damaged.

Tennessee and Louisiana, both of which offer substantial data center tax abatements and lie within Dixie Alley, are home to xAI’s existing Colossus and Meta’s upcoming Hyperion data center developments, respectively.

Colossus is located southwest of Memphis, which weathers a higher number of strong and violent tornadoes than the national average. “Tornadoes are found to pose a significant threat to the area,” according to NOAA.

While no large-scale data center campus has yet been directly hit by a tornado, the dynamics of the AI boom have changed the risk profile somewhat.

More data centers mean more targets, increasing the chance that any one data center gets struck. A quick glance at the total capex – around $700bn – planned by the hyperscalers indicates that there will be even more facilities to come.

Bigger data centers also mean bigger targets for tornadoes. AI data centers are larger because AI workloads require substantially more processing power, and hyperscalers flaunt this fact by referencing Greek mythology – the term Colossus (of Rhodes) refers to a large statue, and Hyperion is named after the Greek Titan of light. In press releases, developers and governments talk of gigawatt projects measured in the hundreds or thousands of acres.

Unfortunately, data centers and tornadoes both like large, flat spaces.

The former need copious amounts of real estate to accommodate their size, and the latter, in the words of Timothy Marshall, a forensic engineer for Haag Engineering who helped develop the Enhanced Fujita scale, “love large open spaces.”

“They love to grind up,” he adds.

So what are the chances that a data center makes it through a tornado unscathed?

Brace, brace

In December 2021, a tornado hit an Amazon warehouse in Edwardsville, Illinois. The storm, later rated an EF3, hit the western face of the warehouse and caused it to collapse inward. Other walls followed suit, and the roof was ripped off by the winds, leaving six workers dead and injuring four others.

This incident was brought up in three separate interviews conducted by DCD with tornado experts, all of whom held up the Amazon warehouse incident as an example of what would happen if a powerful tornado hit a data center.

According to Marshall, both data centers and warehouses tend to be built using pre-cast, concrete, tilt-up wall panels, with a roof diaphragm placed on top. This kind of construction method is fast and cheap, which is why it appeals to developers of “big box” structures that are designed for commercial and not residential use.

“The goal here is to get to the minimum design for a building code,” Marshall adds.

All buildings have to be compliant with building codes, the laws that set standards for how different structures should be designed and constructed. Although the implementation of these codes falls under the purview of state and local governments, they are far too technical and dense to be written from scratch by those without specialist knowledge, and governments will rely on ‘model’ codes developed by a non-profit organization called the International Code Council (ICC).

States can then choose to tweak these ‘model’ codes, and whether they strengthen, weaken, or remove requirements depends on a variety of factors.

Marshall says that most states will legally require buildings to withstand wind speeds of up to 115 mph (185 km/h), but it is up to the developers to decide whether to make their buildings withstand higher speeds.

“The goal is to build to the minimum, right? Because if you build higher than that, then it’s going to cost money,” he says.

This means a data center would be at serious risk if it encountered any tornado above a moderate EF2, which can range between 111 to 135 mph (178-217 km/h). Wind speeds peaked at around 150 mph (241 km/h) in the case of the Edwardsville tornado.

“Wind flowing quickly over a building can decrease the air pressure above the roof and create a strong upward force. It’s the same principle that lifts airplanes into the air,” according to the US government’s National Institute of Standards and Technology.

“If that roof goes, you might actually experience wall collapse depending upon whether the roof has been well adhered to the other wall structures,” says Professor Houser.

"Data centers are probably the least safe commercial-type building. When you have these prefabricated wall structures, they tip over with nothing, like a matchstick does.”

It is hard to imagine that flimsier structures, like Meta’s tent-style data centers in Gallatin, Tennessee, would even stand a chance.

This is bad for data centers, which are especially vulnerable forms of infrastructure. The GPU chips used to power AI models are fragile, expensive, and difficult to replace. Even roof damage could disrupt cooling systems essential to preventing GPUs and electrical equipment from overheating, potentially causing a fire.

So how much more money does it cost to build over code?

This depends on how much more prepared a developer wants to be, but according to Professor Grace Yan, a professor in the Department of Civil, Architectural, and Environmental Engineering at the University of Missouri and a fellow of the American Society of Civil Engineers (ASCE), the cost difference is around 10 percent.

This is according to calculations done by the ASCE, which is one of the organizations that helps the ICC develop its building code.

Sam Martin-Ross, the CMO of TRG Datacenters – a company that specializes in building data centers in areas prone to hurricanes, not tornadoes – corroborates this estimate.

“We would estimate 10-15 percent overall premiums to do it right, with a material premium on building/land, and then a minor premium for building fault-tolerant infrastructure,” says Martin-Ross.

Although the risks posed by hurricanes are slightly different – the main thing being that hurricanes can be accompanied by large-scale flooding, whereas tornadoes will not – both hurricanes and tornadoes produce strong winds, and TRG’s expertise in hurricane-proofing a data center could be transferable.

Martin-Ross notes that wind engineering and roof design are important to hurricane-proofing a data center, and he says that the company’s data centers, located in the coastal city of Houston, Texas, have roofs that are designed to withstand winds up to speeds of 185 mph (297 km/h).

This would give data centers a better chance of getting through strong tornadoes unscathed, but it is worth mentioning that tornadoes will sport a higher wind speed than the worst hurricanes.

An EF5 storm – the kind of tornado feared by Allianz’s Darren Tasker – boasts speeds of more than 200 mph (321 km/h), whereas a category five hurricane – a famous example would be Hurricane Katrina – is defined as anything with wind speeds of more than 157 mph (252 km/h).

“An EF5 tornado is, by definition, a catastrophic event,” says Professor Houser. “This is where the entire data center is wiped off the map, literally. There would have to be underground shelters or specific safe spaces engineered to withstand that type of intense wind in order for people to survive.”

“There are very few buildings at all that are going to be able to withstand [an EF5 tornado]. So what engineers tend to do is they try to design for mid-range tornadoes. They say, ‘this building might not survive an EF5, but let’s build it to survive an EF3 at least, because the EF5s - let’s be real - they’re infrequent,” says Professor Houser.

From 1950 to 2024, approximately 10 percent of all tornadoes were rated EFU, meaning that there was no observable damage; 59 percent as an EF0; 22 percent as EF1; seven percent as EF2; two percent as EF3; and 0 percent (rounded down) as EF4 and EF5 respectively.

This presents a choice for the data center developer looking to build in a comparatively tornado-prone state. They know that their facility is unlikely to suffer a direct hit if a tornado forms (after all, there has not yet been a major incident). They also know that if a catastrophic EF5 tornado did strike, there is little that could be done to prevent it from wreaking havoc. The resulting dilemma asks if it’s worth constructing a data center above building code to withstand the more common strong, but not catastrophic, tornadoes, approximately within the EF2 to EF4 range, bearing in mind that this will incur an approximately 10 to 15 percent premium?

Bearing the cost

Consider the financial implications of saying yes.

Hyperscalers are already stretching themselves to the financial limit to get gigawatt-scale data centers up and running. Capex estimations between the hyperscalers for 2026 are hovering at the $700bn mark, and these tech behemoths – the most wealthy and valuable companies in the world – are increasingly funding these facilities with private debt, raising concerns about companies being over-leveraged. Google issued a hundred-year bond in February, the first of its kind since Motorola did the same in 1997 during the dot-com boom (and bubble).

Slapping a 10 to 15 percent premium on these already exorbitant costs in preparation for a disaster that may never come is not an attractive proposition, and it bears reiterating that this price would go beyond what a developer would legally be required to pay.

It would be prudent to build underground shelters for staff, as suggested by Professor Houser. But tornado-proofing the whole data center is unlikely to happen.

For now, insurers seem happy to pick up the bill. Insuring data centers against risk, including those posed by data centers, has been described as a once-in-a-lifetime opportunity by various professionals in the industry.

“I’m not sure that in my insurance working lifetime that there is anything comparable,” said David Hayhow, a partner on insurance broker Lockton’s construction team.

Last October, insurance broker Aon estimated that rising demand could generate over $10bn in new premium volume in 2026 alone.

But if a powerful tornado does hit, the financial consequences could be enormous.

Equipment losses and business interruption could run “into the billions”, says Ben Leonard, co-chair of law firm Covington’s insurance practice.

“One of the unique aspects of data centers is that losses can pile up very rapidly,” he explains. “If you have, for example, a failure of a cooling system, an HVAC system, and that shuts down a hyperscale data center, you can have what they call business interruption losses where you're losing income out of billions of dollars per day.”

The largest tornado-related insurance payout to date was the May 2011 tornado in Joplin, Missouri, which cost insurers around $4bn in today’s money. Meta’s Hyperion facility alone is reportedly valued at a minimum of $27bn.

If Hyperion was hypothetically wiped off the map, not all of that amount will need to be reimbursed, as these costs tend to include the value of the land purchase. But insurers will still take a ginormous hit: consider the cost of replacing GPUs, rebuilding the facility, and any business interruption claims.

Covington’s Leonard is also confident that the industry will manage. “The way the industry copes, whether it's Covid-19 or a huge hurricane, is through diversification,” he says. “It’s going to be many insurers picking up the loss.”

But come March, which heralds the beginning of tornado season, developers and insurers will be holding their breath, hoping that what is in Kansas remains in Kansas.