Infrastructure investor I Squared Capital has agreed to acquire data center assets from Cogent Communications for $225 million, according to a Reuters report dated May 25, 2026. The purchase anchors a new data center platform — reported at roughly $1 billion — that I Squared is positioning around artificial-intelligence inference, the day-to-day serving of AI models to users rather than the training of them.
Executive Summary
The transaction pairs a specific asset purchase with a bigger strategic wager. I Squared, a private-equity firm that specializes in infrastructure — roads, energy, and increasingly digital assets — is paying $225 million for facilities Cogent had been carrying on its books, and is using them as the foundation of a platform sized in press coverage at around $1 billion. The stated thesis is AI inference: the compute that answers queries, generates content, and runs AI features inside applications, which tends to sit closer to end users than the massive training campuses built by hyperscale cloud providers.
For Cogent, a company best known as a low-cost internet backbone and transit provider, the sale converts long-marketed real estate into cash. For the broader market, it is a data point that institutional capital now sees a distinct, investable asset class in smaller, distributed colocation sites — not just in the gigawatt-scale campuses that have dominated AI headlines. Whether inference demand materializes at these locations on the timeline investors hope is the open question the deal leaves unanswered.
Inference Is a Different Business Than Training
Most AI data center investment to date has chased training: enormous, power-hungry campuses where models are built, often in remote locations chosen for cheap land and available electricity. Inference — running the finished model every time a user asks a question — has a different profile. It is latency-sensitive, scales with user traffic rather than with model size, and in many architectures benefits from being distributed across metros closer to population centers. That is the logic behind putting inference capacity into smaller, geographically scattered facilities of the kind changing hands here.
The economics are also different. Training clusters are typically leased wholesale by a handful of very large tenants; inference capacity can, in principle, be sold in smaller increments to a broader customer base, which looks more like traditional retail colocation — renting secure, powered space to many customers. If that market develops, operators of distributed sites gain pricing power they have not had in years. If inference instead consolidates inside the hyperscalers’ own clouds, the thesis weakens. The release, as reported, does not settle which way demand is actually breaking.
A Payday for Cogent’s Conversion Thesis
Cogent acquired Sprint’s legacy wireline business from T-Mobile in 2023, a deal that brought with it a large portfolio of former telephone switching facilities across the United States. Management has spent the years since arguing that these buildings — hardened structures with existing power feeds and fiber connectivity — could be converted into sellable or leasable data centers. Skeptics noted that carrier hotels built for 1990s telecom gear are not automatically suited to modern high-density computing, and that monetization was slow to show up in reported results.
A $225 million sale to a sophisticated infrastructure buyer is the most concrete external validation of that thesis to date, though one transaction does not price the whole portfolio. It is worth being precise about what the deal does and does not prove: it shows a willing buyer at a real price for some assets, but the report does not disclose how many facilities are included, their capacity, or their condition — so extrapolating a value for Cogent’s remaining sites from this headline number would be premature.
Private Capital Moves Down-Market
I Squared’s entry continues a pattern of infrastructure funds treating digital assets — fiber, towers, and data centers — as core holdings alongside energy and transport. What is notable is the segment: rather than bidding on trophy hyperscale campuses, where competition from sovereign wealth funds and mega-funds has compressed returns, this platform targets the fragmented middle of the market. A reported $1 billion platform commitment suggests the firm intends to aggregate and upgrade additional sites, not simply hold what it bought.
The risks are equally clear. Retrofitting older facilities for AI-grade power density and cooling is capital-intensive, utility interconnection queues are long in many metros, and the platform will be competing for tenants against established colocation providers with existing sales channels and ecosystems. The strategy’s success likely depends less on the entry price than on execution: securing power upgrades, landing anchor customers, and timing capacity to a demand curve that remains genuinely uncertain.
Background
Cogent Communications built its business as an aggressive price competitor in internet transit, operating a global fiber backbone. Its 2023 acquisition of Sprint’s wireline business from T-Mobile brought hundreds of former telephone switching sites, and management has since pitched their conversion into data centers as a major source of untapped value — a claim the market has watched for proof in the form of actual sales or leases.
I Squared Capital is part of a wave of infrastructure private equity that has moved decisively into digital assets over the past decade, on the view that data centers, fiber, and towers offer the long-lived, contracted cash flows these funds seek. The AI boom has intensified that interest, first in massive training campuses and now, as this deal suggests, in the distributed facilities that may serve AI inference closer to end users.
Data Center Frontier profiled TeraWulf’s Lake Mariner campus in Barker, New York, in a May 25, 2026 feature framing the site as a prototype for the “AI factory” — a large-scale data center purpose-built for artificial-intelligence computing. The campus occupies the site of the retired Somerset coal-fired power plant on the shore of Lake Ontario, and the piece traces how TeraWulf, a company that began as a bitcoin miner, has been converting that inherited industrial infrastructure into high-performance computing capacity.
Executive Summary
The core story is one of conversion twice over: a coal plant site converted to digital infrastructure, and a cryptocurrency-mining operator converting itself into an AI-infrastructure landlord. Lake Mariner’s appeal rests on assets that are nearly impossible to recreate quickly — an existing high-capacity grid interconnection built for a power station, access to abundant water for cooling, zoned industrial land, and a regional grid in upstate New York that draws heavily on zero-carbon hydroelectric generation.
Why it matters: the binding constraint on AI data center construction has shifted from chips to power. Utilities in major markets are quoting multi-year waits for large new grid connections, so sites that already have them — like retired thermal power plants — jump the queue. If Lake Mariner works as a template, the industry gains a playbook for turning stranded fossil-fuel assets into AI campuses, with meaningful implications for former coal communities, grid planners, and the competitive map of the data center industry.
The Interconnection Is the Asset
A modern AI campus can require as much electricity as a small city, and the slowest step in delivering it is usually not construction but the grid interconnection — the physical and contractual link that lets a facility draw power from the transmission system. New requests in constrained markets can sit in utility study queues for years. A retired power plant inverts that problem: the wires, switchyard, and transmission rights were built to push hundreds of megawatts out, and much of that capacity can be repurposed to pull power in.
That is the essence of the Lake Mariner thesis. TeraWulf did not have to win a greenfield site fight; it inherited the Somerset plant’s industrial footprint and grid position. The same logic explains a broader industry pattern — operators across the market have been scouting retired or retiring thermal plants precisely because the interconnection, land, and water rights are already in place. In that sense the “prototype” label is apt: the question the site tests is whether coal-to-compute conversion can be repeated at scale, not whether it can be done once.
From Bitcoin Mine to AI Landlord
TeraWulf built Lake Mariner as a bitcoin mining facility, and that history matters more than it might appear. Bitcoin mining taught the company to energize large amounts of power-dense compute quickly and cheaply — but mining revenue is volatile, tied to cryptocurrency prices and periodic “halving” events that cut miner rewards. High-performance computing (HPC) hosting for AI customers offers something mining never could: multi-year contracted revenue from creditworthy counterparties, which is the kind of cash flow lenders and infrastructure investors will finance.
The catch is that the two businesses are less similar than the shared electrical infrastructure suggests. AI training clusters demand far higher reliability, denser cooling — increasingly liquid cooling delivered directly to the chips — and enterprise-grade operations that mining sheds never needed. The conversion is therefore a genuine re-engineering exercise, not a tenant swap, and execution on that transition is the fair test by which TeraWulf and its bitcoin-miner peers should be judged.
The Zero-Carbon Power Angle
Upstate New York’s grid is unusually clean by U.S. standards, anchored by large-scale hydroelectric generation. For AI customers under pressure to report the carbon footprint of their computing, siting workloads on a predominantly zero-carbon grid is a marketable advantage — and there is a certain narrative symmetry in AI compute replacing coal combustion on the same acreage.
The claim deserves precision, though. A clean regional grid is not the same as dedicated clean power, and every large new load consumes headroom that grid planners had earmarked for other purposes. The substantive questions for any site making a sustainability case are how the incremental demand is matched with generation, and what the facility’s water and community impacts look like — questions that apply to Lake Mariner exactly as they apply to every competing campus.
Winners, Losers, and the Watchlist Question
If the coal-to-AI conversion model scales, the winners include former plant communities that regain a tax base and jobs, utilities that get to reuse stranded transmission assets, and early movers holding converted sites when capacity is scarce. The pressure lands on operators pursuing greenfield builds in queue-constrained markets, who must wait for infrastructure that conversion players already own.
For investors treating TeraWulf as a watchlist company, the prototype framing cuts both ways. It signals genuine strategic differentiation — but prototypes, by definition, have not yet proven repeatability. The durable questions are contract quality (who the tenants are and for how long), financing cost for the heavy capital expenditure AI-grade buildings require, and whether the company can operate to the uptime standards hyperscale customers demand. A compelling site thesis is necessary but not sufficient.
Background
TeraWulf was founded to mine bitcoin using predominantly zero-carbon energy and developed Lake Mariner on the grounds of the retired Somerset coal plant in Barker, New York, drawing on the region’s hydro-heavy grid. As demand for AI computing surged and power became the industry’s binding constraint, TeraWulf — like several other large miners — began redeveloping its energized sites for high-performance computing tenants, betting that its grid position would be worth more serving AI than mining cryptocurrency.
The broader market context is a structural shortage of grid-connected capacity: AI’s growth has pushed utilities in major data center markets to years-long interconnection queues, elevating any site with existing power infrastructure — especially former power plants — into strategic real estate.
Nebius, the AI infrastructure company spun out of the former Yandex, has agreed to deploy up to 328 megawatts of Bloom Energy solid-oxide fuel cells to power its U.S. AI data center expansion, according to a report published May 24, 2026.
The arrangement positions on-site fuel cells as a bridge power source while Nebius scales GPU capacity in a market where utility interconnection timelines routinely stretch to five years or more.
Executive Summary
The 328 MW figure is significant. It is roughly the electrical draw of a mid-sized hyperscale campus, and it lands at a moment when AI-driven compute demand is outrunning the pace at which U.S. utilities can deliver new substations and transmission upgrades. By procuring behind-the-meter generation, Nebius is buying schedule certainty — trading potentially higher lifetime energy costs for the ability to energize racks on its own timetable.
For Bloom Energy, a Nebius commitment at this scale reinforces a thesis the company has pitched to Wall Street for two years: that fuel cells, historically a niche resiliency product, have found a mainstream buyer in AI. The deal also plants a flag for gas-fueled distributed generation in a segment often assumed to be dominated by renewables and long-duration storage.
Nebius is a watchlist name for infrastructure investors precisely because it is trying to establish itself as a Western pure-play AI cloud without the balance sheet of a hyperscaler. Power procurement is one of the clearest tests of whether that plan can scale.
Why Fuel Cells, Why Now
Solid-oxide fuel cells convert natural gas — or, in principle, hydrogen or biogas — into electricity through an electrochemical reaction rather than combustion. That makes them quieter than reciprocating engines, cleaner than diesel generators on criteria pollutants, and, crucially, deployable in modular blocks over months rather than the years it takes to build a substation. For an AI operator racing to install GPUs before the next model generation renders current capacity uncompetitive, that speed premium can justify a higher levelized cost of energy.
The economics still depend on assumptions the release does not spell out: gas prices at the delivery site, capacity factor, whether the fuel cells serve as primary power or bridge to a future grid tie, and how carbon is accounted for. Fuel cells emit CO2 when fed pipeline gas, even if they avoid the NOx penalties of engines. That matters for customers with science-based targets and for regulators in states tightening data center emissions rules.
The Nebius Growth Story Gets Its Power Test
Nebius has positioned itself as a neocloud — a category of GPU-first infrastructure providers, including CoreWeave and Crusoe, competing to rent Nvidia capacity to model developers and enterprises. The market rewards these names for signed capacity and rewards them further for capacity that is actually energized and generating revenue. Announcements of GPU orders without a credible power path have grown less impressive to investors over the past year.
A 328 MW behind-the-meter arrangement addresses that skepticism directly. It does not, however, resolve questions about financing structure, siting, or whether the megawatts are contracted, optioned, or contingent on further milestones. Investors will want to see how the commitment is reflected in Nebius’s capex guidance and whether Bloom is a supplier, a project partner, or both.
Winners, Losers, And The Grid Question
The clearest short-term winner is Bloom Energy, which converts a marquee AI reference into a validation point for future data center pursuits. Gas producers and midstream operators benefit indirectly if the pattern spreads. Utilities are more ambiguous: they lose a large potential load in the near term, but they also lose the political burden of finding transmission capacity for it.
The loser, if any, is the tidy narrative that AI infrastructure will be powered predominantly by new renewables plus storage. On-site gas generation is expedient, and expedient often wins when demand is measured in quarters. The counter-argument — that fuel cells can eventually run on hydrogen or biogas — is technically valid but depends on fuel supply chains that do not yet exist at scale.
Background
Nebius is one of a handful of pure-play AI infrastructure companies competing with hyperscalers to lease Nvidia GPU capacity to model developers. Its scale ambitions in the United States hinge on securing power quickly in a market where utility interconnection timelines have become the binding constraint on data center growth.
Bloom Energy has sold solid-oxide fuel cells for more than a decade, initially as resiliency and prime-power equipment for enterprises and utilities. Over the past two years the company has repositioned as a data center power supplier, arguing that its modular systems can be deployed years faster than new grid capacity.
RTO Insider reported on May 24, 2026 that grid researchers are examining the long-term future of natural gas plants built quickly to serve data centers — the generation category that has become the default answer to AI-driven electricity demand across U.S. power markets. The piece frames a question now central to utility and grid-operator planning: what happens to a fleet of fast-build gas plants over the decades after the immediate data-center crunch they were built to solve?
Executive Summary
The report, published by RTO Insider — a trade outlet covering regional transmission organizations (RTOs), the entities that run wholesale electricity markets and the high-voltage grid across much of the United States — captures a debate that has moved from the margins to the center of power-sector planning. Data-center developers facing multi-year waits for grid interconnection have increasingly turned to natural gas generation, often sited at or near the data center itself, because gas turbines can be permitted and installed faster than almost any other firm, dispatchable power source at comparable scale.
That researchers are now asking what becomes of these plants matters because the answer shapes who bears the cost. A gas plant is a decades-long asset being built to serve a demand surge whose duration nobody can guarantee. Whether these units become permanent baseload, transition into backup and peaking roles as cleaner firm power arrives, or end up underused, will determine outcomes for utilities, ratepayers, data-center operators, and the emissions trajectory of the AI build-out. The syndicated version of the article available to us carries only the headline, so the specific researchers, markets, and findings involved are not detailed here — but the question itself is well documented across the industry, and it deserves examination on its own terms.
Speed to Power Is the Whole Ballgame
The reason gas keeps winning data-center deals is not ideology or even, primarily, fuel economics — it is time. In several major U.S. markets, connecting a large new load or generator to the grid can take years of interconnection study and transmission upgrades. A hyperscale AI campus that needs hundreds of megawatts cannot wait that long when the competitive race in AI is measured in quarters. Gas turbines, including smaller aeroderivative and reciprocating-engine units, can often be deployed in a fraction of the time, sometimes ‘behind the meter’ — meaning on the customer’s side of the utility connection, serving the facility directly rather than flowing through the shared grid.
Nuclear cannot be built quickly; new large hydro is essentially unavailable; wind and solar are fast but intermittent, and pairing them with enough storage to run a 24/7 AI facility remains expensive at gigawatt scale. That leaves gas as the pragmatic default — which is precisely why researchers are scrutinizing what the industry is committing itself to by default rather than by design.
A Bridge Needs a Far Shore
Calling gas a ‘bridge fuel’ — a transitional energy source used until cleaner firm power scales up — embeds an assumption: that something is on the other side of the bridge. Candidates include advanced nuclear (including small modular reactors), enhanced geothermal, long-duration storage, and gas units retrofitted for carbon capture or hydrogen blending. All are promising; none is deployable today at the pace and price the AI build-out demands. If those technologies mature on schedule, fast-build gas plants can gracefully shift from running constantly to running occasionally, as peakers and reliability backstops. If they do not, the ‘bridge’ quietly becomes the destination, with the associated locked-in emissions and fuel-price exposure.
The honest answer — and likely part of why researchers are ‘pondering’ rather than concluding — is that both outcomes are live possibilities, and the difference is worth billions of dollars and a meaningful slice of U.S. emissions.
Who Holds the Asset Risk?
The economics hinge on who owns the plant and who pays if demand disappoints. When a data-center developer builds its own on-site generation, the stranded-asset risk — the danger of an expensive asset losing its economic purpose before it is paid off — sits largely with a private company that chose it. When a regulated utility builds gas capacity into its rate base to serve forecast data-center load, ordinary ratepayers can end up carrying the cost if AI demand forecasts prove inflated or if a customer leaves. Grid operators and state regulators are actively developing large-load tariffs, minimum-take contracts, and exit fees to allocate that risk more explicitly, and the research attention RTO Insider describes feeds directly into those proceedings.
Supply chains add another wrinkle: demand for heavy-duty gas turbines has surged worldwide, and lead times for new orders have stretched to several years. That erodes some of gas’s core speed advantage and pushes developers toward smaller, modular units — machines that are, conveniently, also easier to redeploy or run flexibly if the long-term role of these plants shrinks.
What It Means for the Data-Center Industry
For data-center operators and their customers, the takeaway is that power strategy is now inseparable from business strategy. Facilities powered by fast-build gas gain schedule certainty today but inherit questions about fuel-cost volatility, future emissions regulation, and the sustainability commitments of the tenants they serve — many large technology companies maintain public carbon-free-energy targets that on-site gas complicates. Operators that pair near-term gas with credible contracts for cleaner firm power, or that site where grid capacity genuinely exists, will have an easier story to tell enterprise customers, regulators, and communities. The infrastructure sector should welcome the scrutiny: a clear-eyed answer to ‘what happens to these plants in 2040?’ is better arrived at before the concrete is poured than after.
Background
After roughly two decades of flat U.S. electricity demand, the AI data-center build-out has triggered the fastest load-growth forecasts utilities have issued in a generation, with individual campuses now requesting hundreds of megawatts — and some multi-gigawatt projects proposed. Grid interconnection queues, transmission construction timelines, and generator retirements have collided with that surge, making ‘speed to power’ the defining constraint of the data-center industry. Natural gas, which already supplies the largest share of U.S. electricity generation, has emerged as the default fast answer, spawning a wave of proposed on-site and utility-scale gas projects. RTO Insider, the outlet behind this report, covers the regional transmission organizations and regulatory proceedings where the resulting cost, reliability, and emissions questions are being fought out.
Reuters reported on May 24, 2026 that Schneider Electric — the French energy-management and industrial-automation group — says its data center business in India is now growing faster than its core business, propelled by the country’s AI-driven data center buildout. The comment positions India as one of the standout markets in a global surge of demand for the electrical equipment that powers AI computing.
Executive Summary
The substance of the report is a growth signal, not a contract or a capacity announcement: Schneider Electric, one of the world’s largest suppliers of the switchgear, uninterruptible power supplies (UPS — the battery-backed systems that keep servers running through grid disturbances), and power-distribution equipment that data centers depend on, says demand from India’s data center sector is expanding faster than the rest of its business there.
That matters for two reasons. First, it is a read on where the AI infrastructure wave is spreading: hyperscale-style demand is no longer confined to the United States and a handful of established hubs. Second, it comes from the supply side. Data center operators announce ambitions; equipment vendors see purchase orders. When a major electrical supplier says one segment is outgrowing everything else it does in a market, that is a comparatively hard signal that capital is actually being spent.
The caveat is proportionality: “outpacing core growth” describes a rate, not a size, and the report as available does not quantify either. A fast-growing segment can still be a small one.
The AI Boom Is Really an Electrical Equipment Boom
Every AI data center is, underneath the servers, an electrical engineering project. Racks of AI accelerators draw several times the power of conventional servers, and that power has to be received from the grid, transformed, distributed, conditioned, and backed up — all with equipment from a fairly short list of global vendors, of which Schneider Electric is one of the largest alongside the likes of ABB, Siemens, Eaton, and Vertiv. This is why the AI cycle has been felt so strongly by electrical suppliers: compute demand converts almost directly into orders for switchgear, transformers, UPS systems, busway, and cooling infrastructure.
Schneider’s India comment extends a pattern the industry has watched for two years in the US and Europe: the constraint on AI capacity is increasingly power delivery, not chips alone. When equipment vendors describe data centers as their fastest-growing segment in a new geography, it signals that the buildout — and potentially the associated equipment lead-time pressure — is going global.
Why India Is the Market to Watch
India combines several ingredients that data center investors look for: a very large and growing base of internet users, data-localization rules that encourage storing Indian data in-country, comparatively low construction costs, and government interest in domestic AI capability. Global cloud providers and regional operators have all announced Indian expansion in recent years, concentrated around hubs such as Mumbai, Chennai, and Hyderabad.
For an equipment vendor, India offers something else: Schneider Electric has a long-established manufacturing and commercial presence there, so local data center demand can be served substantially from local operations. If AI-driven orders are now growing faster than the company’s traditional Indian business — which spans buildings, industry, and grid infrastructure — it suggests the data center segment is becoming a structural growth pillar rather than a side market.
Supply-Side Signals Deserve Attention — and Context
It is worth being precise about what this report does and does not establish. A vendor saying a segment is “outpacing core growth” is a directional claim about relative growth rates. As reported, it does not disclose the segment’s revenue, its share of Schneider’s India business, order backlog, or a forecast horizon. Growth from a small base can outpace a large core for years without changing the overall business mix, so the claim is credible but not yet quantified in the material available.
It is also a statement any vendor has an interest in making during an AI investment cycle: data center exposure is currently rewarded by investors. That does not make the claim wrong — Schneider’s global results through this cycle have consistently shown genuine data center strength — but buyers and investors should look for the numbers behind the narrative when the company next reports segment detail. For data center operators, the practical takeaway is less about Schneider specifically and more about the market it describes: if India’s buildout is accelerating, competition for equipment, grid connections, and skilled electrical contractors in that market will accelerate with it.
Background
Schneider Electric traces its roots to 1836 in France and has evolved from heavy industry into a global leader in energy management and automation. Its data center relevance deepened with the 2007 acquisition of APC, a leading UPS maker, and the company now supplies integrated power, cooling, and management systems to hyperscale and colocation operators worldwide. Throughout the current AI investment cycle, data centers have been among the strongest demand drivers across the electrical equipment industry.
India’s data center market has expanded rapidly since the country’s 2020s push on data localization and digital infrastructure, attracting investment from global cloud providers and domestic operators alike. The AI wave has added a second demand layer on top of that cloud-driven growth, with power availability widely viewed as the buildout’s key constraint.
On May 24, 2026, security trade publication Help Net Security published a distillation of lessons for organizations from the Verizon 2026 Data Breach Investigations Report (DBIR), Verizon’s long-running annual study of real-world security incidents and confirmed data breaches. The DBIR, published each spring since 2008, is one of the most widely cited empirical references in enterprise security planning.
The syndicated version of the article available to us carries the headline and framing but not the report’s underlying statistics, so this analysis focuses on what the DBIR is, why its annual release matters, and how enterprises should — and should not — act on it.
Executive Summary
Each year, the release of Verizon’s Data Breach Investigations Report triggers a wave of coverage translating its findings into advice for defenders, and Help Net Security’s May 2026 piece sits squarely in that tradition: lessons for organizations, drawn from breach data rather than vendor marketing. That evidence-first posture is precisely why the DBIR carries weight — it is built from incidents that actually happened, contributed by law enforcement agencies, incident-response firms, insurers, and security vendors, and coded into a common framework so patterns can be compared year over year.
It matters because most enterprises do not experience enough breaches firsthand to build their own statistical picture of how attacks really unfold. The DBIR substitutes for that missing experience: it tells a CISO — a chief information security officer, the executive who owns cyber risk — which attack paths are common enough to deserve budget and which are rare enough to deprioritize. For infrastructure operators and their customers, the recurring question each edition answers is blunt: are we defending against the attacks that actually occur?
The caveat, which applies to this year as to every year, is that a summary of a report is not the report. The specific 2026 figures — what grew, what receded, what changed in attacker behavior — are in the full document, and organizations should read it directly before repointing their defenses.
Why One Report Anchors an Industry’s Threat Model
The DBIR’s authority comes from its method. Incidents are classified using VERIS, an open framework Verizon created for describing security events in consistent terms — who acted, what they did, what asset was affected, and what was compromised. Because dozens of outside organizations contribute case data in that shared vocabulary, the report aggregates thousands of real incidents into comparable patterns rather than survey opinions or telemetry from a single product. In an industry saturated with marketing statistics, that structural discipline is rare, and it is why the report’s findings routinely end up in board presentations, insurance underwriting discussions, and regulatory commentary.
The practical function of the annual release is calibration. Security budgets are finite, and the perennial DBIR lesson — visible across many editions — is that breaches overwhelmingly begin with a small set of unglamorous entry points: stolen or reused credentials, phishing and other social engineering, exploited vulnerabilities in internet-facing systems, and errors or misuse involving people. A defense program aligned to those realities looks different from one aligned to headlines about exotic attacks.
From Statistics to Budget Lines
The recurring translation problem is turning percentages into decisions. Prior editions offer a template for what that looks like. The 2025 report, for example, found roughly a third of breaches involved ransomware — malicious software that encrypts or steals data for extortion — and documented sharp growth in attackers exploiting vulnerabilities in edge devices such as VPN appliances and firewalls, the equipment that sits directly on the internet at a network’s boundary. Findings like those support concrete changes: faster patch timelines for perimeter equipment, phishing-resistant multi-factor authentication, and tested offline backups, rather than another generalized tool purchase.
The 2025 edition also reported that third-party involvement in breaches had doubled year over year to around 30 percent — breaches that reach a victim through a supplier, software vendor, or service provider rather than a direct attack. If the 2026 data extends that trajectory, the lesson lands hardest on procurement and vendor management, functions that traditionally sit outside the security team. For buyers of infrastructure services — colocation, connectivity, cloud — it also sharpens the due-diligence questions worth asking any provider: how they patch, how they segment customers, and how quickly they disclose incidents.
Reading Breach Reports Critically
Even a rigorous report deserves scrutiny, and the DBIR’s own authors have historically been candid about its limits. The dataset reflects what contributors saw and chose to share, not a random sample of all attacks worldwide; breaches that were never detected or never reported are invisible to it. Year-over-year swings can reflect changes in the contributor mix as much as changes in attacker behavior. And Verizon is itself a commercial provider of managed security and network services, so its report doubles as credibility marketing — a common and legitimate practice, but one readers should recognize whenever a vendor publishes research. None of this undermines the DBIR’s value; it defines how to use it: as the best available directional evidence, checked against an organization’s own incident history and complementary sources such as Mandiant’s M-Trends or IBM’s Cost of a Data Breach study.
The same critical lens applies to coverage of the report. A trade-press distillation like this one is useful for reach but compresses hundreds of pages into a handful of takeaways chosen by an editor. The defensible sequence for an enterprise is to read the summary, then verify the numbers in the primary document, then map each finding to a control it would actually change.
Background
Verizon, one of the largest telecommunications and enterprise network providers in the United States, has published the Data Breach Investigations Report annually since 2008, growing it from an internal forensics study into a collaborative effort spanning dozens of contributing organizations worldwide. Recent editions have analyzed on the order of tens of thousands of incidents a year — the 2025 report drew on roughly 22,000 incidents, including about 12,000 confirmed breaches — coded in the open VERIS framework so patterns can be compared across years.
The report’s release has become a fixture of the security calendar: its findings feed board briefings, cyber-insurance underwriting, and vendor roadmaps, and its long-running themes — credentials, phishing, ransomware, human error, and increasingly third-party and edge-device exposure — form the de facto baseline threat model for enterprise defenders.
Engineering trade publication Electronics360 published an analysis on May 24, 2026 arguing that direct-to-chip (D2C) liquid cooling — circulating coolant through cold plates mounted directly on processors — has crossed from a design option to a practical requirement, driven by AI accelerator chips whose power draw has reached the multi-kilowatt range per device.
The piece frames this as the end of an era: air cooling, the default thermal strategy for data centers since the industry’s beginning, can no longer keep pace with the heat that flagship AI silicon produces in the small area of a single chip package.
Executive Summary
The core claim is thermodynamic rather than commercial: individual AI processors now dissipate thousands of watts each, and moving that much heat out of a dense rack with air alone requires airflow volumes and temperature differentials that become impractical or impossible at the densities AI clusters demand. Direct-to-chip liquid cooling, which places a liquid-filled cold plate against the chip itself, removes heat far more efficiently because liquids carry heat orders of magnitude better than air.
Why it matters: if D2C is genuinely mandatory rather than optional, every layer of the data-center stack changes — facility design, plumbing, power distribution, rack architecture, maintenance skills, and capital budgets. Operators of existing air-cooled facilities face retrofit decisions, and new builds are being designed liquid-first. For an industry that standardized on air handling for decades, this is a foundational transition, not an incremental upgrade.
Physics Ended the Debate Before the Market Did
Air cooling persisted as the default not because it was elegant but because it was cheap, simple, and universally understood. Its limitation is fundamental: air is a poor heat conductor, so cooling a hotter chip means moving more air, faster, across larger heatsinks. As AI accelerators pushed past one kilowatt per device — with roadmaps pointing well beyond — the heat concentrated in a few square centimeters of silicon began to exceed what any realistic airflow can absorb. Water and engineered coolants transfer heat dramatically more effectively, which is why cold plates bolted directly onto the chip package have become the pragmatic answer.
The word ‘mandatory’ in the source’s framing is worth taking seriously but precisely. Air cooling is not disappearing from data centers generally — the vast installed base of conventional enterprise and cloud workloads runs at rack densities air handles fine. The mandate applies to the frontier: dense AI training and inference clusters built around multi-kilowatt accelerators. That distinction matters for anyone budgeting a transition.
The Retrofit Question Splits the Market
Liquid-first design is straightforward in a new build: coolant distribution units, manifolds, leak detection, and higher floor loading are engineered in from day one. Retrofitting an existing air-cooled facility is harder. Piping must be routed through spaces never designed for it, water supply and heat-rejection capacity must be added, and operations teams must learn to manage a system where a leak — rare but nonzero — sits inches from expensive silicon.
This creates a divergence in asset value across the industry. Facilities that can economically accept liquid cooling — because of their power capacity, structure, and location — become more valuable as AI demand grows. Older facilities that cannot may be relegated to lower-density workloads. Colocation providers, hyperscalers, and enterprise operators are all making that assessment now, and the answers will shape which real estate wins the AI buildout.
A New Supply Chain Rises Around the Cold Plate
A shift of this scale redraws the vendor landscape. Demand moves toward cold plates, coolant distribution units, quick-disconnect fittings, dielectric and water-based coolants, leak-detection systems, and rear-door or facility-level heat exchangers — categories that were niche a few years ago. Established thermal-management and precision-cooling vendors are competing with newer specialists, and chip and server makers increasingly ship liquid-ready designs, effectively deciding the question for their customers.
There is also an efficiency dividend. Because liquid captures heat at the source, less energy is spent on fans and air handling, and the warm coolant leaves at temperatures useful for heat reuse in some settings. For operators facing scrutiny over data-center energy consumption, D2C offers a genuine efficiency story — though it introduces its own considerations around water use and coolant handling that deserve equally honest accounting.
Background
For most of computing history, data centers were cooled the same way: chilled air pushed through raised floors or ducts, across finned metal heatsinks, and back to air-handling units. That model worked because individual chips drew tens or hundreds of watts. The AI era broke the assumption — training and running large models rewards packing the most powerful accelerators as densely as possible, and each generation of AI silicon has raised per-chip power substantially, crossing the kilowatt mark and continuing upward.
Liquid cooling itself is not new; mainframes and supercomputers used water cooling decades ago before commodity air-cooled servers displaced them on cost. What has changed is that the physics that once made liquid cooling a supercomputing niche now applies to mainstream AI infrastructure, pulling a once-specialist discipline back to the center of data-center design.
Source: Multi-kilowatt chips make D2C cooling mandatory — Electronics360 analysis (May 24, 2026) on why multi-kilowatt AI processors are forcing data centers from air cooling to direct-to-chip liquid cooling.
Federal News Network reports that governments around the world increasingly assume offensive cyber operations will be a standing instrument of state power, on par with diplomatic, economic, and military tools. The framing marks a normalization of capabilities that were once treated as exceptional or covert.
The account, published 23 May 2026, does not announce a specific operation. Instead, it describes a doctrinal shift: offensive cyber is being written into how states plan to compete, coerce, and defend interests.
Executive Summary
The story matters because doctrine drives budgets, authorities, and targets. When offensive cyber moves from a niche capability to an assumed lever of statecraft, more governments build teams, more contractors sell tools, and more operations occur below the threshold of armed conflict.
For operators of critical infrastructure — data centers, fiber networks, cloud platforms, and the utilities that feed them — the practical consequence is a threat model that must assume patient, well-resourced, state-directed adversaries as a baseline, not an edge case.
The Federal News Network piece is a framing article rather than a disclosure of new incidents, so its value is directional: it signals where policy and procurement are headed, not which systems are already in the crosshairs.
From Exception To Instrument
For much of the internet era, offensive cyber operations were treated as sensitive, compartmented, and rare — the province of a handful of intelligence agencies. The shift Federal News Network describes is that governments now plan around the assumption that these tools will be used, much as they plan around sanctions or naval patrols. That reframing changes procurement priorities, legal authorities, and the willingness to conduct operations in peacetime.
The economic effect is a broader market for offensive capabilities: exploit brokers, red-team contractors, and specialist training. It also creates a larger surface for spillover, because tools developed for one target frequently leak, get repurposed by criminals, or hit unintended systems on shared infrastructure.
What Changes For Infrastructure Operators
Data center, connectivity, and cloud providers have long assumed criminal threats — ransomware crews, credential thieves, DDoS extortionists. A doctrine that normalizes state offensive cyber pushes a different profile to the top of the risk register: adversaries with time, custom tooling, insider recruitment budgets, and tolerance for long dwell times. Detection engineering, supply-chain hygiene, and incident-response rehearsal all cost more against that adversary.
There is also a jurisdictional dimension. Operators sitting between hyperscale customers and regulated verticals — finance, health, energy — increasingly find themselves inside the blast radius of geopolitical disputes they are not party to. Contracts, insurance, and liability frameworks written for criminal threats do not always map cleanly onto state activity, which is often excluded from cyber insurance policies as an act of war.
Norms, Deterrence, And The Questions No One Has Answered
A durable question is whether normalization deters or invites conflict. Advocates argue that visible capability, like nuclear posture, creates restraint. Skeptics note that cyber operations are cheaper, more deniable, and less escalatory-looking than kinetic force, which historically lowers the threshold for use rather than raising it. The public record does not yet settle that debate, and reasonable analysts disagree.
It is also fair to ask pointed questions of every side. Governments framing offensive cyber as routine should explain oversight, targeting rules, and civilian protection. Vendors selling the shift as inevitable should show evidence, not just marketing. And critics who characterize any state cyber activity as reckless should engage with the reality that adversaries are already operating whether or not one’s own government does.
Background
Offensive cyber operations have been part of statecraft since at least the early 2000s, with disclosed incidents ranging from industrial sabotage to election interference and prepositioning inside critical infrastructure. What has shifted over the past decade is the number of governments openly building such capabilities and the willingness to acknowledge them in doctrine and budget documents.
For infrastructure providers, the practical backdrop is that data centers, subsea cables, cloud regions, and internet exchanges are increasingly viewed by states as strategic terrain. That framing brings new regulatory attention, new customer expectations, and new adversary interest, regardless of whether an individual operator wants a role in geopolitics.
A report surfaced via Yahoo Finance on May 23, 2026 says roughly 49,000 residents in the Lake Tahoe area fear losing electric power as data center growth strains regional grids, with experts quoted as seeing a broader electricity crisis ahead. The story frames household reliability — not just wholesale prices or emissions — as the newest casualty of surging computing demand.
Executive Summary
The claim at the center of the report is simple and unsettling: ordinary households near Lake Tahoe worry that the lights may go out because large computing facilities are absorbing the region’s available electric capacity. The figure of 49,000 residents puts a concrete community behind what has mostly been an abstract national debate about artificial intelligence and energy.
Why it matters: for years the data center power conversation played out in interconnection queues, utility rate cases, and investor decks. When it shows up as outage fear in a specific residential community, the politics change. Reliability concerns mobilize regulators, county commissions, and voters far faster than megawatt statistics do — and the industry’s social license to build depends on answering them credibly. The available source is brief, however, and the underlying evidence for both the fear and the reassurances deserves scrutiny, which we take up below.
When Grid Strain Becomes a Neighborhood Story
Grid “strain” is shorthand for a resource-adequacy problem: at moments of peak demand, the generation and transmission serving an area may not comfortably cover the load, forcing utilities to curtail service or lean on emergency imports. Data centers change this math because they add large, around-the-clock demand — a single big AI campus can draw on the order of a mid-size city — and because they arrive faster than power plants and transmission lines can be permitted and built.
What is new in this report is the framing. The affected parties are not industrial ratepayers or grid operators but 49,000 residents of a well-known mountain community. That framing tends to travel: local reliability fears have already reshaped data center siting debates in Northern Virginia, Georgia, and Ireland, producing moratoriums, connection pauses, and stricter tariffs. If Tahoe-area residents formally raise outage concerns with their utility or state regulators, developers in the region should expect the same escalation path.
The Evidence Question — For Every Side
Fear of an outage is not the same as a documented outage risk, and a headline is not a reliability study. The fair questions run in every direction. To those raising the alarm: is there a utility resource-adequacy filing, a grid operator assessment, or an outage record that quantifies the risk to these households, or is the fear inferred from regional growth trends? Which specific facilities, and what load, are actually driving it? To utilities and data center developers: what firm capacity backs the new load, what do interconnection studies show for the local system, and can they demonstrate — not merely assert — that residential service will not be degraded?
The report as available to us is thin, so we cannot verify which claims rest on filings and which on sentiment. That cuts both ways: the concern should not be dismissed as anti-development noise, and the industry’s standard reassurances should not be accepted without the studies to back them. The productive next step for any of the parties is publishing the load numbers and adequacy analyses that would settle the question.
Who Pays, and Who Adapts
Beneath the reliability fear sits an economics fight. Serving large new loads requires substations, transmission, and generation, and someone funds them: the developer through special tariffs, or all ratepayers through general rates. Several states have moved toward large-load tariff classes that require data centers to underwrite their own grid impact precisely to prevent the cost-shifting and reliability spillover this story describes. Where such tariffs do not exist, residential customers have a legitimate complaint — and utilities have a regulatory exposure.
The likely winners in this environment are operators who bring their own answer: on-site generation, long-term power purchase agreements that add new supply rather than absorbing existing capacity, batteries, and demand-response commitments that let a facility shed load during regional peaks. Developers who show up asking a constrained grid to simply stretch further will find approvals slower, tariffs stiffer, and communities — like the one in this report — organized against them.
Background
After roughly two decades of flat U.S. electricity demand, load growth has returned sharply, driven by data centers — especially AI training and inference facilities — alongside electrification of transport and industry. Utilities and grid operators across the country have raised resource-adequacy warnings as interconnection requests from large computing loads outpace the construction of new generation and transmission.
The Lake Tahoe area sits near one of the West’s fast-growing data center corridors in northern Nevada, where large campuses have clustered east of Reno over the past decade. That regional context makes the residents’ concern plausible on its face, but the report available to us does not tie the fear to specific facilities, load figures, or utility studies — which is precisely the evidence this debate now needs.
Hackers linked to Iran are targeting key sectors in the United States and allied countries with sophisticated spear-phishing messages, according to reporting published by Cybersecurity Dive on May 23, 2026. Spear-phishing — fraudulent messages tailored to a specific person or organization to steal credentials or deliver malware — remains one of the most reliable entry points for state-aligned intrusion campaigns.
The report frames the activity as state-actor tradecraft aimed at strategically significant sectors across the US and its allies, placing it in the long-running pattern of Iran-linked cyber operations against Western targets.
Executive Summary
The announcement, as reported, is narrow but consequential: an Iran-linked threat campaign is actively working email inboxes across key US and allied sectors, using spear-phishing messages described as sophisticated. Unlike bulk phishing, spear-phishing is researched and personalized — attackers study a target’s role, contacts, and current projects, then craft a message plausible enough that a careful professional might still click.
Why it matters: for operators of critical infrastructure — data centers, networks, energy, government suppliers — the initial access vector in most serious intrusions is not an exotic zero-day exploit but a person and a login. A state-aligned campaign that invests in convincing lures is a direct test of an organization’s identity controls, email defenses, and staff vigilance. The report is a signal to treat inbound-message risk as a board-level infrastructure issue, not a routine IT nuisance.
It is worth being clear about what is and is not established by the source available at publication: the headline-level report attributes the campaign to Iran-linked actors and characterizes the targeting and technique, but the public details we have do not enumerate specific victim organizations, confirmed breaches, or the precise malware involved. Our analysis below works within those limits.
Why Spear-Phishing Still Opens the Door
Spear-phishing endures because it attacks the one system that cannot be fully patched: human judgment. A tailored message that appears to come from a known vendor, a regulator, a recruiter, or a colleague converts trust into access. Once a target enters credentials on a look-alike page or opens a weaponized attachment, the attacker inherits a legitimate identity inside the network — often bypassing perimeter defenses entirely, because from the system’s point of view a real user has simply logged in.
The economics favor the attacker. Crafting a convincing lure costs a state-backed team hours; defending against every possible lure costs an enterprise a layered program of email filtering, authentication hardening, and continuous training. That asymmetry is why campaigns of this type recur year after year, and why the reported sophistication matters: better-crafted lures defeat the pattern-matching — both human and automated — that catches commodity phishing.
Critical Infrastructure in the Crosshairs
The reported targeting of key US and allied sectors fits the established logic of state-aligned operations. Nation-state actors pursue two broad goals against infrastructure-adjacent organizations: intelligence collection — reading email, mapping networks, harvesting credentials for later use — and pre-positioning, meaning quiet footholds that could be activated during a future geopolitical crisis. Iran-linked groups have been publicly documented over the past decade conducting both kinds of activity against Western government, energy, telecommunications, and defense-industrial targets, which is the context in which a report like this lands.
For the infrastructure sector specifically, the supply chain widens the aperture. A data center operator, carrier, or managed-service provider is valuable to an attacker not only for its own systems but as a stepping stone into hundreds of customers. That makes vendors and operators in this industry disproportionately attractive spear-phishing targets — and makes their security posture a shared-fate issue for everyone downstream.
What “Sophisticated” Should Trigger in a Defense Program
Labels like “sophisticated” appear in nearly every threat report, so the practical question is what a defender should change. The durable answers are structural rather than heroic. Phishing-resistant multi-factor authentication — hardware security keys or platform passkeys rather than SMS codes or push approvals — removes most of the value of a stolen password. Strict email authentication (the SPF, DKIM, and DMARC standards that let receiving servers verify a sender’s domain) narrows spoofing room. Network segmentation and least-privilege access limit how far a single compromised account can travel.
Equally important is the reporting culture: organizations that make it easy and blame-free for staff to flag a suspicious message convert their workforce from the weakest link into a distributed sensor network. State-actor campaigns are rarely stopped by one control; they are stopped by several mediocre days for the attacker in a row. The measured takeaway from this report is not alarm but prioritization — inbox-borne identity attacks remain the front line, and budgets should reflect that.
Background
Cyber operations linked to Iran have been a fixture of the threat landscape since at least the early 2010s, with publicly documented campaigns against Western banks, energy companies, government agencies, and defense contractors. Spear-phishing has consistently served as the entry technique of choice for these operations, because it is cheap, deniable, and effective against organizations of any size. Periods of geopolitical tension between Iran and Western governments have historically coincided with upticks in reported activity.
For the infrastructure industry, the relevant history is the steady shift of state-actor attention toward operators — data centers, carriers, utilities, and managed-service providers — whose networks connect to many downstream customers. US and allied governments have repeatedly warned critical-infrastructure operators to assume they are targets and to harden identity and email defenses accordingly; the May 2026 reporting fits squarely within that ongoing advisory pattern.
