jain.com — data centers, connectivity and security, analyzed daily

Author: Deepak Jain

  • Grid Equipment Emergency Order Collides With Data Center Demand

    Grid Equipment Emergency Order Collides With Data Center Demand

    President Trump has declared a national emergency in order to bar certain foreign-made electrical grid equipment from the United States, according to reporting by The Hill published on April 28, 2026. Grid equipment in this context means the heavy hardware that moves electricity from generators to customers: transformers that step voltage up and down, switchgear that isolates faults, protective relays, and the control systems that coordinate them.

    The reporting available at the time of writing establishes the action and its instrument — an emergency declaration used to restrict a category of imported equipment — but does not, in the headline summary reaching us, itemize which product categories, which countries of origin, or which effective dates are covered. Those details determine almost everything about the order’s practical effect.

    Executive Summary

    A national emergency declaration is a legal mechanism, not a policy in itself. It unlocks executive authority to restrict transactions that would otherwise be ordinary commerce. Applied to grid equipment, it signals that the administration views some imported transformers, switchgear, or control hardware as a security exposure serious enough to justify blocking purchases rather than merely inspecting or certifying them.

    The timing is what makes this consequential for the technology-infrastructure sector. Electrical equipment for utility interconnections has been a bottleneck for new construction for several years, and the arrival of large AI and cloud campuses has added a class of buyer that needs tens or hundreds of megawatts per site and needs it on a schedule. Any measure that narrows the pool of eligible suppliers acts on a market where the constraint is already delivery time rather than price.

    None of that makes the security rationale wrong. Grid hardware sits at the base of every other system — including the data centers running the economy’s compute — and equipment with remotely accessible firmware is a genuine attack surface. The honest read is that this is a real trade-off between two legitimate goods, and that the size of the trade-off cannot be assessed until the scope of the ban is published.

    A Supply Chain That Was Already the Bottleneck

    Large power transformers are a category of equipment that behaves almost nothing like the rest of the technology stack. They are custom-engineered for a specific site and voltage, built from specialized steel and copper by a small number of factories worldwide, shipped by rail or heavy haul because of their weight, and ordered years rather than months ahead. There is no spot market and very little interchangeability: a unit built for one substation is generally not a drop-in for another.

    That structure means supply responds slowly to demand. When a new class of buyer appears — and hyperscale and colocation data centers are exactly that, requesting utility interconnections at industrial scale — the queue lengthens rather than the price simply clearing the market. Utilities, which need the same equipment for ordinary replacement and storm hardening, are competing in that same queue, and they generally have regulatory obligations that make waiting expensive in a different way.

    Into that market comes a restriction on a subset of foreign-made equipment. The mechanical effect is straightforward even without knowing the specifics: fewer eligible suppliers for the same volume of orders means longer waits, more competition for domestic and allied production slots, and a stronger bargaining position for whoever already holds capacity. Whether that effect is small or severe depends entirely on how much of current supply falls inside the restricted category — which the available reporting does not tell us.

    Security Logic and Delivery Logic Are Both Real

    The case for restricting foreign grid hardware rests on a straightforward premise: modern transformers, breakers, and substation controllers contain firmware and often communications interfaces, and equipment installed at the base of the power system is difficult to inspect, expensive to replace, and long-lived. A component compromised at manufacture could sit in place for decades. This is not a novel concern invented for this order — a 2020 executive order on securing the bulk-power system pursued the same theory, and successive administrations have kept the underlying question open rather than settling it.

    The fair question to put to that case is evidentiary: what specifically has been found, and does the response match the finding? Emergency authority is a blunt instrument, and the difference between “we have identified compromised units in service” and “we judge this supply route to be an unacceptable theoretical risk” is the difference between two very different policies. Declarations of this kind are frequently issued without a public factual record; that is normal for classified material and also normal for weak cases, and from the outside the two look identical.

    The same scrutiny belongs on the industry side. Utilities and equipment buyers will argue that restrictions raise costs and delay projects, and that argument is both true and self-interested — it is the response any purchaser gives to any supplier restriction. The useful question for readers is not who is complaining but what the measurable effect is: how many units, from which sources, on what delivery schedules, and whether qualified alternatives exist at comparable lead times.

    Who Gains and Who Absorbs the Cost

    The clearest beneficiaries of a narrowed supplier pool are manufacturers already inside it. Domestic and allied-country producers of transformers and switchgear gain pricing power and order-book visibility, which is precisely the condition under which firms are willing to finance new plant capacity. If the restriction is durable and clearly scoped, it can function as the demand signal that domestic manufacturing has historically lacked. If it is ambiguous or expected to be reversed, it produces the price effect without the capacity investment — the worst of both outcomes.

    The cost lands first on projects that have not yet locked their electrical equipment orders. In practice that means later-stage entrants to the data center buildout rather than the incumbents: operators who placed equipment orders early, or who acquired sites with interconnection agreements and equipment already secured, are insulated. Those competing for slots now face a smaller field of eligible vendors. This tends to advantage large, well-capitalized buyers who can pre-purchase inventory and absorb carrying costs, and to disadvantage smaller developers.

    For end customers of infrastructure — enterprises buying colocation, cloud capacity, or connectivity — the effect arrives indirectly and with a lag, as availability rather than as a line item. Capacity that cannot be energized on schedule shows up as longer waits for space and power in constrained metros, and as more pressure to consider secondary markets where interconnection queues are shorter.

    What Careful Buyers Do Before the Rules Firm Up

    The practical response to an announced-but-unspecified restriction is not to rewrite procurement strategy on a headline. It is to establish exposure: which equipment on order originates where, which suppliers are subcontracting to manufacturers that might fall within scope, and what the contractual position is if a delivery becomes non-compliant mid-order. Many buyers do not have that visibility past their immediate vendor, and building it is useful regardless of how this particular order is written.

    The second move is to check where risk sits in existing contracts. Force majeure and regulatory-change clauses in equipment and construction agreements determine who eats a delay caused by a government restriction, and those clauses vary widely. This is a cheap thing to review now and an expensive thing to discover later.

    The third is patience about the analysis itself. Emergency declarations are typically followed by implementing rules, definitions, exemption processes, and often litigation — and the scope can change materially at each step. Until the implementing detail is published, the responsible position is that the direction of the effect on grid-equipment lead times is upward and the magnitude is unknown.

    Background

    The electrical grid runs on a class of equipment that is unglamorous, extremely long-lived, and produced by a concentrated global supplier base. Large power transformers in particular are engineered to order, take years to procure, and cannot be swapped between sites. Because replacement cycles are measured in decades, a decision about what equipment is allowed into the system today shapes the physical grid well past the term of any administration that makes it.

    Concern about foreign-supplied grid hardware has been a recurring feature of U.S. policy rather than a new development, including a 2020 executive order aimed at securing the bulk-power system. What has changed is the demand side. Data centers built for AI and cloud workloads have become a significant new source of load growth, requesting utility interconnections at a scale and pace that the equipment supply chain was not sized for. Restrictions on supply and a surge in demand are now arriving in the same market at the same time, which is why a policy question that once concerned mainly utilities and regulators is now a scheduling question for anyone building compute.

    Source: Trump declares national emergency to ban some foreign grid equipment — The Hill, April 28, 2026, reporting the emergency declaration used to restrict certain imported electrical grid equipment.

  • Carrier Deepens ZutaCore Bet, Pushing Two-Phase Liquid Cooling Into AI Racks

    Carrier Deepens ZutaCore Bet, Pushing Two-Phase Liquid Cooling Into AI Racks

    Carrier Ventures, the venture arm of HVAC and building-systems giant Carrier Global, announced on April 28, 2026 that it is expanding its investment in ZutaCore, a maker of two-phase, direct-to-chip liquid cooling technology. The stated purpose is to scale liquid cooling for AI data centers, where rapidly rising chip power densities are outrunning traditional air cooling. The announcement, distributed via PR Newswire, did not disclose the size or terms of the expanded investment.

    Executive Summary

    Carrier first backed ZutaCore with a strategic investment and partnership announced in late 2024. This follow-on commitment signals that Carrier sees direct-to-chip cooling — hardware that removes heat at the processor itself rather than from the room around it — as central to its data center strategy, not a side experiment. For a company whose traditional data center business is facility-level equipment such as chillers and air handlers, that is a meaningful shift in where it believes thermal value will be captured.

    The ‘why now’ is straightforward: AI accelerators have pushed rack power draws from the tens of kilowatts into the hundreds, a range where moving heat with air alone becomes physically and economically impractical. Liquid cooling has moved from niche to necessity for AI deployments, and every major thermal-management vendor is racing to own a piece of the resulting stack. The open question is whether the announcement represents scaled commercial traction or primarily a strategic option on a still-contested technology — the release headline promises scale, but the syndicated text offers no deployment figures, customer names, or dollar amounts to measure it by.

    Why an HVAC Giant Wants Inside the Rack

    Carrier’s historical position in data centers is at the facility level: chillers, cooling towers, and air-handling systems that condition entire halls. Direct-to-chip cooling changes where the critical engineering happens. When heat is captured at the silicon by cold plates and carried away in fluid loops, the highest-value thermal decisions move from the building to the rack — territory contested by specialists like ZutaCore, CoolIT, and Motivair, and by IT-side players such as Vertiv and the server manufacturers themselves. An expanded investment in ZutaCore is a hedge against disintermediation: if Carrier does not have a credible chip-level offering, it risks being relegated to supplying the commodity heat-rejection equipment at the end of someone else’s thermal chain.

    There is also a plausible offensive logic. A vendor that can pair chip-level heat capture with its own facility-scale heat rejection can sell an integrated thermal chain — from cold plate to cooling tower — which is attractive to operators who currently stitch that chain together from multiple vendors. Whether Carrier and ZutaCore intend to productize such an integrated offering is not stated in the announcement, but it is the strategic prize this kind of pairing points toward.

    Two-Phase Cooling, Explained — and Why It Is Contested Ground

    Most liquid cooling deployed for AI today is single-phase: water or a water-glycol mix flows through a cold plate on the chip, warms up, and carries the heat away. ZutaCore’s approach is two-phase — a dielectric (non-electrically-conductive) fluid boils directly on the cold plate, absorbing large amounts of heat as it vaporizes, then condenses elsewhere in the loop. The physics advantage is real: boiling absorbs far more heat per unit of fluid than simple warming, which matters as individual accelerator packages climb toward and beyond kilowatt-class heat output. Because the fluid is non-conductive, a leak is also less catastrophic than a water leak inside a server.

    The counterweight is ecosystem maturity. Single-phase water cooling is the volume standard for current AI reference designs, with an established supply chain, well-understood operating practices, and trained technicians. Two-phase systems introduce different fluids, pressures, and service procedures, and specialty dielectric fluids carry their own cost and, depending on chemistry, environmental scrutiny. The bet embedded in Carrier’s investment is that next-generation chip heat densities will strain single-phase designs enough to open a mainstream window for two-phase — a defensible thesis, but one the market has not yet settled.

    What the Announcement Does and Does Not Substantiate

    Read carefully, this is a statement of investor conviction, not a disclosed commercial milestone. A follow-on investment from a strategic corporate backer is a genuine positive signal: corporate venture arms rarely double down on portfolio companies whose technology their own engineers have found wanting. It suggests the 2024 partnership produced enough validation to justify more capital.

    What the syndicated release does not provide is the evidence a buyer or investor would need to gauge momentum: the investment amount, ZutaCore’s resulting valuation or Carrier’s stake, named customers, deployed megawatts, or manufacturing capacity commitments. ‘Scale liquid cooling for AI data centers’ is a direction, not a metric. That does not make the announcement empty — strategic capital and an incumbent’s distribution reach are real assets for a smaller technology vendor — but the gap between the headline’s ambition and the disclosed specifics is worth keeping in view. The same skepticism should be applied evenly: competing single-phase vendors’ claims of inevitability are also assertions, not settled fact, in a market where chip roadmaps can shift the thermal calculus every generation.

    Background

    Carrier Global, spun off from United Technologies in 2020, is one of the world’s largest providers of heating, ventilation, air conditioning, and refrigeration systems, with a long-standing data center business centered on facility-level cooling equipment. ZutaCore, founded in the mid-2010s with roots in Israel, developed a waterless two-phase direct-to-chip cooling platform aimed at high-density computing. The two companies first linked up in late 2024, when Carrier announced a strategic investment and partnership with ZutaCore as part of a broader industry pivot toward liquid cooling.

    That pivot has been driven by the AI buildout: accelerator-dense racks have pushed power and heat densities beyond what air cooling can economically handle, turning liquid cooling from a specialty into a core requirement of new AI data center designs and drawing HVAC incumbents, power-infrastructure vendors, and startups into direct competition for the rack thermal stack.

    Source: Carrier Ventures Expands Investment in ZutaCore to Scale Liquid Cooling for AI Data Centers — PR Newswire announcement, April 28, 2026, describing Carrier’s expanded strategic investment in two-phase liquid cooling company ZutaCore.

  • RAND Asks How Much Power the US Grid Can Spare for AI by 2030

    RAND Asks How Much Power the US Grid Can Spare for AI by 2030

    On April 28, 2026, RAND — the nonprofit, nonpartisan policy research institution — published an analysis titled “How Much More Power Can the U.S. Grid Provide for AI? Projections and Policy Implications for 2030.” The work models the gap between surging AI-driven electricity demand and the grid’s realistic ability to serve it this decade, and maps the policy choices that will widen or narrow that gap.

    Executive Summary

    The question in RAND’s title is arguably the central resource question of the AI buildout. Data centers running artificial-intelligence workloads have become one of the fastest-growing sources of new electricity demand in the United States, and every hyperscale campus announcement ultimately depends on an answer to the same question: can the grid actually deliver the power, and by when?

    What makes a RAND treatment notable is the framing. Rather than starting from what AI developers say they need — the demand-side forecasts that dominate industry discourse — the title starts from what the grid can provide, a supply-side constraint analysis. Pairing “projections” with “policy implications” signals that the answer is not a fixed number but a range whose outcome depends on decisions about generation, transmission, and interconnection that federal and state policymakers are making right now.

    Because our source is the publication listing rather than the full report, this article analyzes the question RAND is posing and the market context around it, and flags below what the listing alone does not tell us about the report’s specific findings.

    Why the Supply-Side Framing Matters

    Most public numbers in the AI-power debate come from the demand side: forecasts of how many gigawatts AI data centers will request. Those forecasts are genuinely uncertain — utilities have reported that the same prospective data center project often applies for service in multiple territories, which can inflate aggregate demand figures if requests are summed naively. A supply-side analysis flips the question to the binding constraint: how much new load the existing fleet of power plants, transmission lines, and distribution infrastructure can absorb by 2030 under realistic buildout assumptions.

    That reframing matters commercially. If credible headroom estimates exist region by region, they become a de facto siting map — telling developers where power is available and telling investors which announced projects face energization risk. It also disciplines the conversation: a project announcement is not capacity until a utility can serve it.

    The Bottleneck Is Delivery, Not Just Generation

    For readers new to the topic: connecting a large new power plant or a large new customer to the grid requires an engineering study process called interconnection, and in much of the country those study queues have stretched to multiple years. High-voltage transmission lines — the long-distance wires that move bulk power — routinely take the better part of a decade from proposal to operation because they cross many permitting jurisdictions. Meanwhile, a modern AI campus can be requesting hundreds of megawatts, the scale of a small city, on a two-to-three-year construction schedule.

    That timing mismatch, not any absolute shortage of energy resources, is the crux of the 2030 question. It explains why data center operators are increasingly pursuing workarounds: siting at retired industrial locations with existing grid connections, contracting directly with power plants, adding on-site generation, and offering demand flexibility — agreeing to reduce draw during grid stress in exchange for faster hookups.

    The Policy Levers on the Table

    The “policy implications” half of RAND’s title points at a live agenda. The levers most commonly debated in this space include: reforming interconnection queues so viable projects move faster; accelerating transmission permitting and cost allocation; deciding who pays for grid upgrades triggered by large loads, a question with direct consequences for other ratepayers’ bills; and setting rules for large flexible loads and behind-the-meter generation. Each lever sits with a different actor — federal regulators, regional grid operators, state commissions — which is why national demand projections translate so unevenly into local reality.

    For the infrastructure industry, the stakes cut both ways. Faster interconnection and transmission buildout expands the addressable market for data center development. But cost-allocation decisions that shift upgrade costs onto large loads change project economics, and jurisdictions that move slowly will simply watch capacity — and the tax base that comes with it — land elsewhere. An evenhanded, nonpartisan modeling effort that quantifies these tradeoffs is useful precisely because most numbers in circulation come from parties with a commercial or advocacy position.

    Background

    US electricity demand was roughly flat for about two decades before data centers — accelerated sharply by the generative AI boom that began in late 2022 — joined electrification and reshored manufacturing in pushing load growth back onto utility planning agendas. Since then, hyperscale campus announcements measured in the hundreds of megawatts or more have become routine, and access to power has displaced land and fiber as the primary siting constraint for the data center industry.

    RAND, founded in 1948, is a nonprofit research institution known for quantitative analysis of defense, infrastructure, and technology policy. Its entry into the AI-and-grid debate adds an independent modeling voice to a discussion otherwise dominated by utilities, developers, and advocacy groups, each with a stake in how big the numbers are said to be.

    Source: How Much More Power Can the U.S. Grid Provide for AI? Projections and Policy Implications for 2030 — RAND publication listing, April 28, 2026, via Google News.

  • Critical Infrastructure Supplier Discloses Cyberattack, Renewing Supply-Chain Fears

    Critical Infrastructure Supplier Discloses Cyberattack, Renewing Supply-Chain Fears

    A major supplier to the critical-infrastructure sector has reported a cyberattack, according to an April 28, 2026 report by trade publication Cybersecurity Dive. The syndicated report identifies the victim only as a “major critical infrastructure supplier” and, in the form available to us, provides no further detail on the company’s identity, the nature of the intrusion, or its operational impact.

    Executive Summary

    On April 28, 2026, Cybersecurity Dive reported that a major critical-infrastructure supplier had disclosed a cyberattack. Suppliers in this category — the vendors that build and service the switchgear, transformers, control systems, cooling plants, and software that power grids and data centers run on — occupy a uniquely sensitive position: a compromise at one vendor can create exposure across hundreds of downstream operators at once.

    The available report is thin on specifics, and that itself is worth noting. Early-stage incident disclosures from infrastructure vendors are often deliberately sparse while forensics are underway. But for grid operators, data-center owners, and their customers, even a bare-bones disclosure is actionable: it is the trigger to check vendor dependencies, review remote-access pathways, and press the supplier for indicators of compromise. This article lays out what the disclosure signals, why supplier breaches matter disproportionately in this sector, and the specific questions the announcement leaves open.

    Why a Supplier Breach Is Never Just the Supplier’s Problem

    Critical-infrastructure supply chains are highly concentrated. A relatively small set of vendors provides the industrial control systems (the computers that operate physical equipment like breakers, pumps, and chillers), the engineering software, and the field services that utilities and data-center operators depend on. When one of those vendors is breached, the blast radius is not one company — it is every customer whose networks the vendor can touch, whose equipment runs the vendor’s firmware, or whose engineering files sit in the vendor’s systems.

    Precedent explains why these disclosures draw immediate attention. The 2020 SolarWinds campaign turned one software vendor’s build system into a distribution channel for espionage across government and industry. The 2023 MOVEit file-transfer breach cascaded through thousands of organizations that had never heard of the underlying vendor. In the industrial world, attackers who obtain a supplier’s design documents, credentials, or remote-maintenance access gain exactly the foothold that is hardest for an operator to detect, because vendor traffic is expected and trusted.

    Reading a Thin Disclosure

    The report available to us confirms only that an attack occurred and was significant enough for a major supplier to report it. It does not — at least in the syndicated form we can verify — name the company, the attack type, or the impact. Readers should resist filling that vacuum with assumptions: “cyberattack” can span anything from a contained IT ransomware incident with no customer exposure to a compromise of systems that touch customer environments, and the difference matters enormously.

    Sparse initial disclosures are common and not inherently evasive. U.S. securities rules adopted in 2023 push public companies to disclose material cyber incidents within four business days of determining materiality — often before forensics are complete — and companies in the EU face tightened reporting duties under the NIS2 directive. The predictable result is a first announcement that confirms the incident and little else. The fair test of the supplier’s handling is not the first press release but the follow-through: whether customers receive timely indicators of compromise, whether the scope statement holds up, and whether subsequent filings expand or quietly walk back the initial account.

    What Grid and Data-Center Operators Should Do With This News

    For operators, a vendor-breach headline is a prompt to exercise the third-party-risk muscle regardless of whether this particular supplier is in their stack. The practical checklist is well established: inventory which vendors have remote access into operational networks, confirm that access is segmented and logged, verify the provenance of recent firmware and software updates, and ask key suppliers directly whether they are affected. Operators bound by NERC CIP — the mandatory cybersecurity standards for the North American bulk power system — already have supply-chain risk-management obligations that make this review an auditable expectation, not a nicety.

    Data-center operators sit in a similar position even where regulation is lighter. Modern facilities are dense with vendor-managed building-management, power-monitoring, and cooling-control systems, and the AI build-out has only deepened dependence on a fast-moving supplier ecosystem. The economic logic is straightforward: the cost of verifying vendor access paths is trivial next to the cost of an intrusion that arrives through a trusted maintenance channel.

    The Market Backdrop: Suppliers Are Now Front-Line Targets

    This disclosure lands in a market where infrastructure suppliers are under sustained pressure from both criminal and state-aligned actors, precisely because they aggregate access to many high-value environments. Governments have responded with overlapping reporting regimes — the SEC’s disclosure rule, the U.S. CIRCIA incident-reporting framework being implemented through CISA, and NIS2 in Europe — which means more of these announcements, not fewer, should be expected. That is arguably healthy: a steady stream of disclosures is evidence of reporting obligations working, not necessarily of a sector suddenly getting worse.

    For buyers, the durable takeaway is that supplier cybersecurity is now a procurement criterion with teeth. Operators increasingly demand software bills of materials (a machine-readable list of a product’s software components), contractual breach-notification windows, and evidence of secure development practices. Suppliers that can demonstrate mature incident response — including candid, detailed disclosure — are turning security into a competitive differentiator rather than a compliance cost.

    Background

    Critical infrastructure — power grids, data centers, water systems, telecommunications — runs on equipment and software from a concentrated set of specialist suppliers, and those suppliers have become prime cyber targets because one intrusion can yield access to many downstream operators. Landmark incidents shaped today’s defenses: the 2020 SolarWinds software-supply-chain campaign, the 2021 Colonial Pipeline ransomware shutdown, and the 2023 MOVEit breach that cascaded through thousands of organizations. In response, governments layered on reporting and supply-chain security mandates, including the SEC’s 2023 cyber-disclosure rule, NERC CIP standards for the North American grid, the U.S. CIRCIA reporting framework, and the EU’s NIS2 directive — making public disclosures like the one reported here an increasingly routine, and increasingly scrutinized, part of the infrastructure landscape.

    Source: Major critical infrastructure supplier reports cyberattack — Cybersecurity Dive, April 28, 2026, reporting a cyberattack disclosure by an unnamed major critical-infrastructure supplier.

  • TVA Moves Data Centers Into a Separate, Higher Power Rate Class

    TVA Moves Data Centers Into a Separate, Higher Power Rate Class

    The Tennessee Valley Authority (TVA) will charge data centers more for power under a separate rate, according to an April 28, 2026 report by the Chattanooga Times Free Press. The federally owned utility, which supplies electricity across Tennessee and parts of six neighboring states, is effectively carving hyperscale computing load out of its general commercial and industrial rate structure and pricing it as its own customer class.

    Executive Summary

    According to the report, TVA — the largest public power provider in the United States — is establishing a distinct rate under which data centers will pay more for electricity than they would under existing industrial tariffs. A “rate class” is the category a utility assigns to groups of customers with similar usage patterns; creating a new one for data centers means the utility believes this load is different enough in size, growth, and risk to deserve its own pricing.

    Why it matters: this is one of the clearest signals yet that utilities are no longer treating gigawatt-scale computing demand as ordinary industrial load. When a system as large as TVA’s formalizes a premium rate for data centers, it sets a reference point that other utilities, regulators, and public power boards across the country can cite. For operators planning campuses in the Tennessee Valley — a region that has actively courted data center investment — the cost of power, typically the largest ongoing operating expense of a data center, just became a moving target.

    Pricing Hyperscale Load as Its Own Risk Category

    Utilities have historically loved large industrial customers: steady, predictable consumption spreads fixed grid costs over more kilowatt-hours, which can lower rates for everyone. Data centers complicate that logic. They arrive in enormous increments, request interconnection faster than generation and transmission can be built, and — critically — a project can be cancelled or relocated after a utility has committed capital to serve it. A separate rate class is the standard regulatory tool for isolating that risk: it lets the utility recover the cost of serving data centers from data centers, rather than socializing it across households and smaller businesses.

    The reported move fits a broader pattern. Utilities and regulators in several U.S. markets have been developing large-load tariffs with features like minimum-demand charges, longer contract terms, and collateral requirements. TVA formalizing a higher rate suggests the debate has shifted from whether hyperscale load should be treated differently to how much more it should pay.

    What a Premium Rate Means for Data Center Economics

    Electricity is usually the single largest recurring cost of operating a data center, and for AI-oriented facilities running dense, power-hungry hardware, the sensitivity is even greater. A structurally higher rate changes site-selection math: the Tennessee Valley’s traditional pitch — abundant, relatively inexpensive, largely carbon-light power from a mix that includes nuclear and hydro — becomes less differentiated if data centers pay a premium over the headline industrial rate. The report does not disclose the size of the premium, so the practical impact could range from a rounding error to a genuine deterrent.

    Operators have levers in response: negotiating long-term supply agreements, bringing their own generation or storage to the table, or shifting flexible workloads to hours when the grid has spare capacity. But each of those adds complexity and capital cost, and none fully escapes a tariff that applies by customer class. The likely near-term effect is that hyperscalers press for contract structures — rather than published rates — where their scale gives them negotiating room.

    A Public Power Precedent With National Reach

    TVA occupies an unusual position: it is a federally owned corporation that sets its own rates through its board rather than through a state public utility commission. That autonomy means it can move faster than investor-owned utilities, whose large-load tariffs must survive contested rate cases. If TVA’s data center rate takes effect as reported, it becomes an operating precedent other utilities can point to when they argue that hyperscale customers should carry a larger share of grid-expansion costs.

    There is a fairness argument on both sides worth stating plainly. Ratepayer advocates contend that residential customers should not fund transmission and generation built for a handful of technology companies. Data center operators counter that they are long-tenured, high-load-factor customers whose demand justifies infrastructure the whole region eventually benefits from, and that punitive pricing simply pushes investment — and its tax base and jobs — to neighboring territories. The reported story does not resolve which framing TVA’s rate design reflects, and the details of the tariff will determine whether it reads as prudent risk allocation or as a growth deterrent.

    Background

    The Tennessee Valley Authority was created by Congress in 1933 and grew into the largest public power system in the country, serving roughly ten million people through a network of local power companies. Its generation mix — including nuclear, hydroelectric, gas, and coal — and its historically competitive industrial rates helped make the Tennessee Valley a magnet for energy-intensive industry, and more recently for data center development tied to cloud and AI growth.

    That growth collided with a nationwide reality: electricity demand, flat for two decades, began rising sharply as hyperscale computing facilities requested interconnections measured in hundreds of megawatts. Utilities across the U.S. responded by rethinking how such load is priced and contracted, seeking to protect other ratepayers from stranded-cost risk. TVA’s reported creation of a separate, higher data center rate places it among the most prominent utilities to formalize that shift.

    Source: TVA to charge data centers more for power under separate rate — Chattanooga Times Free Press report, April 28, 2026, on TVA’s creation of a separate, higher electricity rate class for data centers.

  • Veolia and Amazon Partner on Reclaimed-Water Cooling for AWS Data Centers

    Veolia and Amazon Partner on Reclaimed-Water Cooling for AWS Data Centers

    Veolia, one of the world’s largest water and environmental services companies, announced on April 27, 2026 that it is working with Amazon to develop a reclaimed-water cooling system for data centers. The collaboration targets Amazon Web Services (AWS) facilities, aiming to substitute treated, recycled water for the potable water that many data centers currently draw for cooling.

    Executive Summary

    The announcement pairs the operator of some of the world’s largest water-treatment networks with the world’s largest cloud provider on one of the industry’s most scrutinized problems: how much drinking-quality water data centers consume to stay cool. Reclaimed water — wastewater that has been treated to a standard fit for industrial reuse, though not for drinking — can displace that potable draw, easing pressure on municipal supplies in the communities where hyperscale campuses cluster.

    For Amazon, the partnership supports its publicly stated goal of becoming “water positive” by 2030 — returning more water to communities than its operations consume — and, just as practically, it addresses a growing source of friction in siting and permitting new capacity. For Veolia, it signals a move to position water expertise as core infrastructure for the AI-era data center buildout. The release, however, is light on specifics: no named sites, volumes, timelines, or financial terms were disclosed.

    Why Water Is the Data Center Industry’s Quiet Constraint

    Power gets most of the headlines, but water is increasingly the constraint that shapes where data centers can be built. Many large facilities use evaporative cooling, which chills servers efficiently by evaporating water — often millions of gallons per year per site, much of it drawn from the same municipal systems that supply homes. In drought-prone regions, that draw has become a genuine permitting and community-relations issue, with local opposition to new campuses increasingly citing water alongside electricity and land.

    The industry measures this through water usage effectiveness (WUE) — water consumed per unit of computing energy delivered — and operators face growing pressure from regulators, investors, and neighbors to disclose and reduce it. A credible, scalable alternative to potable water is therefore worth real money: it can be the difference between a project that clears local approval and one that stalls.

    What Reclaimed Water Solves — and What It Doesn’t

    Reclaimed water is municipal or industrial wastewater treated to a quality suitable for non-potable uses such as irrigation and industrial cooling. Using it for data center cooling substitutes a resource that would otherwise be discharged for one that communities drink. That is a genuine improvement, and it is proven ground: power plants and heavy industry have run on recycled water for decades. The engineering challenge is real but tractable — reclaimed water’s chemistry can promote scaling, corrosion, and biological growth in cooling loops, which is precisely the treatment problem a company like Veolia exists to solve, along with the pipeline infrastructure needed to move recycled water from treatment plants to campuses.

    What reclaimed water does not do is reduce total water consumption. Evaporative cooling still evaporates the water, whatever its source. It changes which water is used, not how much — a meaningful distinction in water-stressed basins, where hydrologists note that treated wastewater returned to rivers also supports downstream flows. The release, as summarized, does not address consumption volumes or how the system compares with closed-loop and other low-water designs.

    The Strategic Logic for Both Sides

    For Veolia, hyperscale data centers represent a growth market adjacent to its core business: the company already operates treatment plants and industrial-water services worldwide, and packaging that capability for cloud providers moves it up the value chain from utility contractor to strategic infrastructure partner in the AI buildout. A named relationship with Amazon is also a powerful reference for selling similar systems to other operators.

    For Amazon, the calculus spans sustainability accounting and siting pragmatism. Progress toward its water-positive pledge requires exactly this kind of substitution at scale, and demonstrating a reclaimed-water pathway gives AWS a stronger story in front of the councils and water authorities that approve new capacity. If the partnership produces a repeatable template rather than a single showcase, it could modestly widen the map of viable data center locations — and put competitive pressure on other hyperscalers, some of which have taken the different route of designs that eliminate evaporative water use entirely.

    Background

    Data center water use moved from an engineering footnote to a public issue over the past several years, as hyperscale construction accelerated to serve cloud and AI demand and communities in water-stressed regions began scrutinizing how much potable water evaporative cooling consumes. The major cloud providers have responded with public commitments — Amazon’s is a pledge to be water positive by 2030 — and with a mix of recycled-water sourcing, more efficient cooling designs, and replenishment projects.

    Veolia, formed from more than a century of French municipal water operations and now one of the world’s largest environmental-services groups, has built its industrial business on exactly this kind of problem: treating and delivering non-potable water for cooling and process use. The April 2026 announcement extends that franchise into hyperscale computing, an infrastructure market whose growth currently outpaces most of the industrial sectors Veolia has traditionally served.

    Source: Veolia Works With Amazon to Develop Reclaimed Water for Cooling System for Data Centers — Veolia press release, April 27, 2026, announcing a collaboration with Amazon on reclaimed-water cooling for AWS data centers.

  • Commonwealth Fusion Files First-Ever Fusion Application to PJM Grid

    Commonwealth Fusion Files First-Ever Fusion Application to PJM Grid

    Commonwealth Fusion Systems (CFS) announced on April 27, 2026 that it has become the first fusion energy company to apply for interconnection with PJM Interconnection, the regional transmission organization that operates the largest wholesale electricity market in the United States. The application is a procedural but symbolically significant step toward connecting a commercial fusion power plant to a grid whose demand forecasts are being rewritten by data-center growth.

    Executive Summary

    An interconnection application is the formal request a power-plant developer files with a grid operator to study how, where, and under what upgrades a new generator can plug into the transmission system. By filing with PJM — the grid operator serving 13 states and the District of Columbia, including Virginia’s data-center corridor, the densest concentration of data centers in the world — CFS is putting a commercial fusion plant into the same planning machinery that governs gas turbines, solar farms, and batteries.

    The move matters for two reasons. First, it converts fusion from a laboratory narrative into a grid-planning line item: PJM’s engineers will now study a fusion plant as a real prospective resource. Second, it lands in the middle of the defining energy story of this decade — surging electricity demand from AI data centers colliding with a constrained interconnection process. CFS has previously announced plans to build its first commercial plant, ARC, in Chesterfield County, Virginia, squarely inside PJM territory, so the filing is consistent with the company’s publicly stated roadmap rather than a change of direction.

    What the announcement does not do is demonstrate fusion power. CFS’s demonstration machine, SPARC, is still working toward showing net energy gain from fusion, and an interconnection application is a request to be studied — not evidence that electrons will flow on any particular date.

    Why PJM Is the Grid Fusion Wants to Join

    PJM is not a random choice of market. It serves roughly 65 million people across the Mid-Atlantic and parts of the Midwest, and it contains Northern Virginia — the largest data-center market on the planet. PJM’s own load forecasts have swung sharply upward in recent years on data-center growth, and its capacity auctions (the market that pays generators to be available) have cleared at record prices, a signal that the system is tightening. For any company selling firm, carbon-free power, PJM is where scarcity, willingness to pay, and hyperscaler customers all converge.

    That context explains the strategic logic. CFS has already named Chesterfield County, Virginia as the intended site for ARC, its first commercial plant, and in 2025 it announced that Google agreed to purchase a share of ARC’s planned output. An interconnection application is the necessary next link in that chain: no interconnection study, no grid connection; no grid connection, no power sales. Filing now starts a clock that famously runs long — PJM’s interconnection queue has been one of the most congested in the country, and reforms to speed it up are still working through a multi-year backlog.

    A Milestone of Process, Not Yet of Physics

    It is worth being precise about what “first fusion company to apply to PJM” establishes. It is a genuine first, and firsts in regulatory process have real value: they force grid operators to develop review practices for a new technology class, and they give financiers a concrete, dated artifact of commercial progress. But an application is an entry ticket to a study process, not a commitment by PJM, a permit, or a construction start. Thousands of megawatts enter regional interconnection queues every year and a large fraction never get built.

    The deeper uncertainty is scientific and engineering risk. Fusion — fusing light atomic nuclei to release energy, the process that powers the sun — has never produced net electricity in a commercial setting. CFS’s approach uses high-temperature superconducting magnets to shrink the tokamak (a donut-shaped magnetic confinement device) to commercially plausible size, and its SPARC demonstration machine in Devens, Massachusetts is the intended proof point. Until SPARC demonstrates energy gain, every downstream commercial milestone, this filing included, is contingent. The release, appropriately read, is a statement of sequencing and seriousness rather than of achievement.

    The Economics of Being First in Line

    There is a rational commercial reason to file early even with technology risk unresolved: interconnection positions are time-consuming to obtain and increasingly valuable. In a market where new gas plants face turbine backlogs and new transmission takes a decade, a studied, approved grid position is itself an asset. If fusion works on anything like CFS’s timeline, holding a place in PJM’s process could compress years off commercialization. If it slips, the sunk cost of an application is modest relative to the company’s overall capital raise — CFS is among the best-funded private fusion companies, having raised on the order of billions of dollars from private investors.

    For competitors — other fusion developers, but also advanced nuclear fission companies courting the same data-center buyers — the filing raises the bar on what “commercial traction” looks like. Announcing a site, an anchor customer, and now a grid application is a coherent commercialization story that rivals will be pressed to match. For utilities and grid planners, it is an early test case in how to underwrite a resource class with no operating history: what capacity value, what outage assumptions, what interconnection requirements apply to a first-of-a-kind fusion plant are all questions PJM now has to begin answering in practice.

    What It Means for Data-Center Buyers

    For data-center operators and the enterprises behind them, the practical takeaway is about the shape of the late-2020s and 2030s power market, not near-term procurement. Fusion, if delivered, is the profile hyperscalers say they want: firm, dense, carbon-free generation that can sit near load. Google’s early offtake commitment to ARC showed that large buyers are willing to pay today to option that future. This filing adds a data point that the pipeline behind such deals is advancing through real regulatory machinery. But no operator should plan capacity around fusion this decade; the sober read is that fusion is now competing in the same queues and processes as everything else — which is exactly where a maturing technology should be.

    Background

    Commonwealth Fusion Systems spun out of MIT’s Plasma Science and Fusion Center in 2018 with a bet that high-temperature superconducting magnets could shrink tokamak fusion reactors to commercially buildable size. Backed by billions in private capital, it is building SPARC, a demonstration machine in Devens, Massachusetts intended to show net energy gain, and has announced ARC, its first commercial plant, for Chesterfield County, Virginia — with Google signed on in 2025 as an early purchaser of a portion of ARC’s planned output.

    The announcement lands amid a structural shift in U.S. electricity markets: after two decades of flat demand, load is growing again, driven substantially by AI data centers concentrated in PJM territory. Capacity prices have set records and interconnection queues are congested, making grid access itself a scarce, strategically valuable asset — the backdrop against which a pre-revenue fusion company filing a grid application is genuinely newsworthy.

    Source: Commonwealth Fusion Systems Becomes First Fusion Company to Apply to PJM Interconnection, the Largest U.S. Wholesale Electricity Market — company announcement of its interconnection application to the PJM grid, April 27, 2026.

  • €50 Billion AI Data Center Campus Announced for Croatia: What We Know So Far

    €50 Billion AI Data Center Campus Announced for Croatia: What We Know So Far

    An entity calling itself the Transatlantic Investment Group announced on April 27, 2026 a €50 billion AI data center and innovation campus in Croatia. The announcement describes the project as the largest investment in Croatian history and among the largest private U.S. investments in Europe. Beyond that headline framing, the release provides few operational details — no named site, power figure, timeline, or anchor tenant.

    Executive Summary

    The announcement positions Croatia — an EU, eurozone, and Schengen member on the Adriatic — as the destination for one of the largest AI infrastructure commitments ever declared in Europe. A €50 billion figure, if realized, would place the project in the same conversation as the multi-hundred-billion-euro wave of AI campus announcements that has swept the U.S. and, increasingly, Europe and the Gulf since 2024.

    Why it matters: hyperscale AI buildout is going global. Power, land, and permitting constraints in Europe’s established data center markets — Frankfurt, London, Amsterdam, Paris, Dublin — have pushed developers toward secondary markets, and a commitment of this size in Croatia would be the strongest signal yet that the frontier has moved to Southeast Europe. But the announcement, as published, is a statement of intent. The distance between a declared figure and energized capacity is measured in grid connections, financing closes, and construction phases — none of which are detailed here. Readers should treat this as a significant claim awaiting substantiation, not a shovel-ready project.

    Why Croatia? The Logic of AI’s Geographic Spillover

    Europe’s traditional data center hubs are effectively full. Utilities in Dublin and Amsterdam have restricted new grid connections for large facilities, and Frankfurt and London face similar power and land pressure. That has redirected capital toward markets that can offer three things at once: available power, developable land, and EU regulatory standing. Croatia checks the third box cleanly — it is inside the EU single market, the eurozone, and Schengen — which matters for data sovereignty rules that push European enterprises and governments to keep AI workloads on EU soil.

    The strategic framing as a “private U.S. investment in Europe” also fits a broader pattern: American capital funding AI capacity abroad, both to serve regional demand and to diversify away from congested U.S. power markets. For Croatia, a country whose economy leans heavily on tourism, an anchor investment in digital infrastructure would be transformative — which is precisely why the announcement’s superlatives deserve careful measurement against what has actually been committed.

    What €50 Billion Buys — and What an Announcement Doesn’t

    At current costs, hyperscale AI capacity runs very roughly in the tens of millions of euros per megawatt once you include the chips inside. A €50 billion program therefore implies gigawatt-class ambitions — a campus that would rank among the largest in Europe and consume electricity on the scale of a sizable city. Nothing in the announcement explains where that power comes from, and in AI infrastructure, power is the project. Grid interconnection queues, not capital, are the binding constraint almost everywhere.

    Industry observers have also learned to discount announcement figures. Across the sector, headline commitments are typically phased over a decade, contingent on demand, and structured so that early phases are a small fraction of the total. That is not a criticism of this project specifically — it is how large campuses are legitimately built — but it means the meaningful milestones to watch are land acquisition, a signed grid agreement, a financing close, and a named hyperscale or AI-lab tenant. None appear in the source material.

    Winners, Losers, and the Regional Ripple

    If even a first phase proceeds, the beneficiaries are identifiable: Croatia’s grid operator and power producers (who would need to expand generation and transmission), regional construction and electrical trades, European chip-adjacent suppliers of cooling and power equipment, and connectivity providers building fiber routes to link the Adriatic to Frankfurt, Milan, and Vienna. An “innovation campus” component, if real, could seed a local AI workforce — though such components are also the easiest part of an announcement to promise and the last to be funded.

    The competitive question is who this capacity would serve. Europe’s AI compute demand is growing, and the EU has actively courted large-scale AI infrastructure through initiatives like its AI gigafactory push. But Croatia would be competing with Spain, the Nordics, and Southern European markets that offer abundant renewables and established subsea connectivity. A project of this scale succeeds or fails on tenant demand, and the announcement names none.

    Background

    Croatia joined the European Union in 2013 and adopted both the euro and Schengen membership in 2023, completing its integration into the EU single market. Its economy has historically leaned on tourism and shipping, with a small but growing technology sector; it has not previously hosted hyperscale data center capacity, which in Europe has concentrated in the so-called FLAP-D markets — Frankfurt, London, Amsterdam, Paris, and Dublin.

    That concentration is now breaking up. Power and land constraints in the established hubs, EU data sovereignty rules encouraging in-region AI capacity, and Brussels-backed initiatives to attract large-scale AI computing have pushed developers toward Southern and Eastern Europe. The Croatian announcement, if substantiated, would be the largest expression of that shift to date.

    Source: Transatlantic Investment Group Announces €50 Billion AI Data Center and Innovation Campus in Croatia — announcement dated April 27, 2026, describing the project as the largest investment in Croatian history and among the largest private U.S. investments in Europe.

  • The ‘Memory Tax’: Dell’Oro Flags HBM and DRAM Costs in AI Infrastructure

    The ‘Memory Tax’: Dell’Oro Flags HBM and DRAM Costs in AI Infrastructure

    Market research firm Dell’Oro Group has published analysis describing a growing “memory tax” on AI infrastructure — the rising share of system cost attributable to high-bandwidth memory (HBM) and DRAM in AI servers and accelerators. The note, surfaced April 27, 2026, frames memory as an increasingly material and often under-examined component of AI capital spending.

    Executive Summary

    Dell’Oro Group, an analyst firm that tracks data center and telecom infrastructure markets, is calling attention to memory — specifically HBM, the stacked memory packaged alongside AI accelerators, and conventional DRAM used in servers — as a fast-growing cost component in AI infrastructure. The “memory tax” framing suggests that as AI models and the clusters that train and serve them grow, memory is consuming a larger slice of every infrastructure dollar.

    The framing matters because most public discussion of AI capital expenditure centers on GPUs and, increasingly, on power and data center construction. If memory costs are rising as a share of the bill of materials — the itemized cost of the components inside a server — then budget models built around accelerator pricing alone will understate the true cost of AI capacity. That has implications for cloud providers, enterprises buying AI servers, and the memory suppliers positioned to benefit.

    Readers should note what is available here: a headline and thesis from a recognized analyst firm, without the underlying figures, forecast horizon, or methodology visible in the source material. The direction of the claim is consistent with the widely reported tightness in memory supply driven by AI demand, but the magnitude is not substantiated in what we can see.

    Why Memory Became a Line Item Worth Naming

    AI accelerators are unusual among chips in that their usefulness is bounded as much by memory as by raw compute. Training and serving large models requires moving enormous volumes of data to the processor quickly, which is why modern accelerators are packaged with HBM — DRAM dies stacked vertically and connected to the processor over a very wide, short interface. HBM is expensive to manufacture, supply is concentrated among a small number of suppliers (SK hynix, Samsung, and Micron are the established producers), and each new accelerator generation ships with more of it.

    Conventional DRAM matters too: the host servers around the accelerators, plus the storage and networking tiers of an AI cluster, all consume memory. When one demand source — AI — pulls hard on a supply chain with long lead times and few producers, prices tend to rise across the board. Dell’Oro’s “memory tax” label captures the effect from the buyer’s side: a cost that arrives embedded in system prices whether or not the buyer itemizes it.

    Who Pays, and Who Collects

    If memory’s share of AI system cost is growing, the immediate beneficiaries are the memory manufacturers, for whom HBM commands substantially better margins than commodity DRAM historically has. Accelerator vendors sit in the middle: memory is a cost input to their products, but strong demand has so far allowed system prices to carry it. The buyers — hyperscale cloud providers, AI labs, and enterprises — absorb the tax directly in capital expenditure, and indirectly it flows into the price of cloud GPU capacity and AI services.

    There is a second-order effect worth watching. Rising memory prices do not stay confined to AI hardware. General-purpose servers, storage systems, and consumer devices draw on the same DRAM supply base, so a sustained AI-driven squeeze can raise costs for infrastructure buyers who are not purchasing AI systems at all. For data center operators and IT planners, that argues for treating memory pricing as a market variable in refresh budgets, not a constant.

    An Analyst Thesis, Not a Dataset — Yet

    It is worth being precise about the evidentiary weight of what has surfaced. Dell’Oro is an established infrastructure research firm, and the thesis aligns with observable market conditions. But the material visible here is a headline-level framing: it does not disclose how large the memory share of AI system cost currently is, how fast it is growing, or over what forecast period. “Growing” is directionally plausible and quantitatively unverified in this source.

    That distinction matters for anyone using the claim to make decisions. A memory share that rises from, say, a modest slice to a dominant one would reshape supplier negotiations and cloud pricing; a gradual drift would be a planning footnote. Until the underlying figures are public, the responsible reading is that memory costs deserve a named line in AI infrastructure budgets — and that the size of that line needs data the summary does not provide.

    Background

    The AI infrastructure buildout that accelerated from 2023 onward has been discussed mostly in terms of GPUs, power, and data center construction, but every AI accelerator ships with a large complement of high-bandwidth memory, and every cluster consumes conventional DRAM in its servers and supporting systems. Memory is a historically cyclical market dominated by a small number of manufacturers — SK hynix, Samsung, and Micron — and AI demand has become a defining force in its current cycle.

    Dell’Oro Group, founded in the 1990s and based in Silicon Valley, publishes recurring research on data center capex, servers, and network infrastructure. Its analysts’ framing of trends — in this case, memory as a “tax” on AI infrastructure — often shapes how vendors and buyers talk about market economics before detailed figures circulate publicly.

    Source: The Growing Memory Tax on AI Infrastructure — Dell’Oro Group, analyst commentary on rising HBM and DRAM costs in AI infrastructure economics, published April 27, 2026.

  • Federal Advisory Warns of Active Cyberattacks on Industrial Control Systems

    Federal Advisory Warns of Active Cyberattacks on Industrial Control Systems

    U.S. federal authorities have issued a warning about an active cyber threat targeting critical infrastructure, according to an April 27, 2026 report from Fox Business. The advisory centers on programmable logic controllers (PLCs) — the ruggedized industrial computers that directly operate physical equipment such as pumps, valves, breakers, and chillers across the power, water, and facility-cooling systems the country depends on.

    The key word is active: this is framed not as a theoretical vulnerability disclosure but as a warning about attacks currently underway against operational technology (OT), the layer of computing that touches the physical world.

    Executive Summary

    The reported advisory warns that attackers are actively targeting the control-system layer of American critical infrastructure. PLCs sit at the bottom of that stack: they read sensors and command machinery, often using decades-old protocols that were designed for reliability on closed networks, not for authentication on the open internet. When a PLC is compromised, the consequence is not stolen data — it is the potential manipulation of physical processes like water treatment chemistry, electrical switching, or the cooling plant that keeps a data hall alive.

    For operators of data centers, utilities, and industrial facilities, an advisory of this kind matters even when it is short on public detail. Federal agencies generally reserve “active threat” language for cases where compromise activity has actually been observed, and prior advisories in this vein — most notably the late-2023 wave of attacks on internet-exposed PLCs at U.S. water utilities — were followed by confirmed intrusions at real facilities. The prudent reading is that internet-reachable, weakly authenticated controllers are being probed and, in some cases, accessed right now.

    Based on the material available, however, readers should note that the Fox Business report is a brief news item, and the specifics — which agency issued the warning, which sectors or device vendors are affected, and whether any disruption has occurred — are not spelled out in the source. Our analysis below separates what the warning signals from what remains unverified.

    The OT Layer Is Where Cyber Risk Becomes Physical Risk

    Most cybersecurity coverage concerns information technology (IT): servers, laptops, email, databases. Operational technology is different. A PLC is a small industrial computer, typically bolted inside an electrical cabinet, that runs a fixed control program — open this valve when the tank hits a setpoint, start this pump, trip this breaker. PLCs and the human-machine interfaces (HMIs) that supervise them were engineered for uptime measured in decades, in an era when the control network was assumed to be physically isolated.

    That assumption has quietly eroded. Remote-monitoring requirements, vendor maintenance access, and cost pressure have connected many control networks — directly or indirectly — to the internet. Security researchers routinely find thousands of controllers reachable online with default or absent passwords. An advisory about “active” attacks on this layer is therefore credible on its face: the attack surface is real, well documented, and historically exploited.

    Why This Warning Should Resonate in the Data Center Industry

    Data centers are usually discussed as the thing being protected, but every data center is itself an industrial facility. Building management systems, chiller plants, computer-room air handlers, generators, switchgear, and uninterruptible power supplies are all orchestrated by the same class of controllers this advisory concerns. A facility can have immaculate IT security and still be exposed through a BMS controller a mechanical contractor connected to the internet for convenience.

    The dependency also runs outward. A data center’s availability ultimately rests on the utility grid and, for cooling, often on municipal water. An attack that degrades a regional utility degrades every facility downstream of it. This is why OT threat advisories are relevant to cloud and colocation buyers, not just plant engineers: the resilience story a provider tells should extend below the operating system, into the physical plant and the controllers that run it.

    The Economics of an Unfixable-by-Patching Problem

    OT security is hard for structural reasons, not because operators are careless. Controllers frequently cannot be patched without shutting down the process they run, and many run vendor firmware that no longer receives updates at all. Replacement cycles for industrial equipment run fifteen to thirty years, so devices designed before modern security practices will remain in service well into the 2040s. The practical playbook — inventory every device, remove direct internet exposure, segment control networks from corporate networks, require multi-factor authentication on remote access, and monitor for anomalous commands — is compensating architecture, not a patch.

    That reality shapes the market response. Each federal warning of this kind tends to accelerate spending on network segmentation, OT-specific monitoring, and secure remote access, and to sharpen insurer and regulator attention on control-system hygiene. For infrastructure operators, the cost of that program is increasingly best understood not as discretionary security spend but as a component of availability engineering — the same budget line as redundant power and cooling.

    What the Report Substantiates — and What It Doesn’t

    Even-handedly: the source here is a brief news report of a federal warning, and it leaves most operational detail unstated. It does not, in the material we reviewed, identify the issuing agency by name, attribute the activity to a specific actor, enumerate affected vendors or sectors, or confirm any successful disruption. The pattern is consistent with prior joint advisories from U.S. cyber agencies about internet-exposed controllers, but consistency is not confirmation.

    What the warning does establish is direction: the U.S. government judged the threat to the control-system layer serious enough to warn publicly and to characterize it as active. Operators should treat the underlying advisory — not press coverage of it — as the actionable document, and pull the technical indicators and mitigations directly from the issuing agency once identified.

    Background

    Warnings about cyberattacks on industrial control systems have escalated steadily over the past decade. Stuxnet demonstrated around 2010 that malicious code could physically damage industrial equipment, and subsequent incidents — attacks on Ukraine’s power grid in 2015 and 2016, the 2021 tampering attempt at a Florida water treatment plant, and the late-2023 compromises of internet-exposed PLCs at multiple U.S. water utilities — moved the threat from theory to record. U.S. agencies led by CISA have responded with a cadence of joint advisories urging operators to disconnect controllers from the public internet and harden remote access.

    The April 2026 warning arrives amid that trajectory and amid unprecedented growth in physical infrastructure itself: the AI-driven data center buildout is adding enormous new electrical and cooling capacity, all of it orchestrated by the same operational-technology layer this advisory concerns. As the footprint of controller-run infrastructure grows, so does the attack surface — which is why federal OT warnings increasingly speak to the digital-infrastructure industry as much as to traditional utilities.

    Source: US warns of active cyber threat targeting critical infrastructure — Fox Business report, April 27, 2026, on a federal warning of active cyberattacks against U.S. critical-infrastructure control systems.