Power Gets Consolidated

If You Only Read One Thing

The useful pattern today is that infrastructure risk is being pulled onto balance sheets. NYC Health + Hospitals shows what happens when public healthcare treats biometrics as ordinary recoverable data; NextEra-Dominion shows AI power demand becoming utility consolidation. Read NextEra's deal announcement not for spin, but because the numbers reveal where the bottleneck moved.

Hospitals Stored The Irreplaceable

The worst data to lose is not the data that can be reset. It is the data that follows a person forever.

NYC Health + Hospitals said an unauthorized actor accessed its systems between November 25, 2025 and February 11, 2026, with suspicious activity discovered on February 2, and that the access may have come through a third-party vendor breach. The system's public notice says the files may include Social Security numbers, government IDs, financial-account data, medical and insurance records, location information, and biometric data. TechCrunch reported the breach affects at least 1.8 million people, making it one of the more consequential healthcare incidents of the year.

Why it matters: The ordinary breach playbook assumes identity is repairable. Freeze credit, replace cards, issue two years of monitoring, move on. That model breaks when a public hospital system stores fingerprints, palm scans, treatment histories, and billing records in the same vendor-accessible blast radius. A password is a secret; a biometric is a body part turned into an authentication token. Once copied, the problem is not just fraud next month. It is the permanent weakening of a future identity system that may rely more, not less, on biometric matching.

The structural story is vendor delegation. Public healthcare providers increasingly outsource intake, billing, analytics, scheduling, and identity workflows because the internal IT burden is too large and the procurement process rewards packaged systems. The vendor becomes part of the hospital's operating system, but the public accountability stays with the hospital. That creates a familiar asymmetry: the institution gets the political damage, patients get the irreversible exposure, and the vendor identity may remain vague long after the breach notice lands.

This also changes the regulatory politics around health data. HIPAA was built around protected health information, not the idea that a safety-net hospital might become a biometric identity warehouse. New York's public system covers patients who are less able to shop away from risk: uninsured residents, low-income families, immigrants, public employees, and people seeking emergency care. A consumer app breach is bad. A public hospital breach converts a service people cannot realistically avoid into a lifelong identity liability.

Room for disagreement: The affected universe may be broader than the actually compromised population, because breach notices often define eligibility conservatively. It is also possible the biometric fields were sparse or tied mostly to workforce systems rather than patients. Those details matter, and the current notice does not settle them.

What to watch: The key test is whether the final data review separates patient biometric exposure from workforce biometric exposure, because the long-tail identity risk is materially different if the compromised prints belong to patients who had no employment choice in the system.

NextEra Buys The Bottleneck

The AI data-center story keeps being told as a chip story. The more durable constraint is permission to move electrons.

NextEra Energy agreed to buy Dominion Energy in an all-stock deal worth about $67 billion. The companies say the combined utility would serve roughly 10 million electric customers, operate more than 110 gigawatts of generation and storage, and bring a 130-gigawatt pipeline of possible large-load opportunities, including data centers. AP framed the transaction as a power play in the AI boom; Semafor's read is sharper: the deal lands directly in the politics of AI load growth.

Why it matters: AI infrastructure is moving from private capex into regulated utility math. Hyperscalers can buy GPUs, sign leases, and finance campuses. They cannot unilaterally build transmission, assign cost recovery, or decide which households subsidize a substation. That is why the utility balance sheet is becoming strategic. Dominion owns the Virginia power territory around the world's densest data-center market. NextEra brings renewables, gas, nuclear exposure, and a financing machine. Together, they are not just selling electricity; they are trying to own the approval path for the next decade of large-load growth.

The deal's structure reveals the constraint. The companies promised $2.25 billion of customer benefits and expect 12 to 18 months of approvals across state commissions and federal regulators. That is the right battleground. The economics of AI power will not be settled by the cheapest megawatt alone. They will be settled by who pays for grid upgrades, whether data centers get separate tariffs, how much risk remains with households, and whether regulators believe consolidation improves reliability or gives one utility too much negotiating power over an essential chokepoint.

This is why the transaction matters even if it faces heavy conditions. Data centers have turned electricity from a commodity input into a site-selection weapon. The old utility bargain was stability: predictable returns in exchange for public oversight. AI load growth pressures both sides of that bargain. Utilities can justify more capex and bigger rate bases; regulators can demand ring-fenced data-center costs; hyperscalers can threaten to move workloads to friendlier grids. The bottleneck moved from the GPU cluster to the commission docket.

Room for disagreement: Scale could help. A larger utility may finance transmission, storage, and generation faster than Dominion could alone, and a combined fleet may lower reliability risk. The customer-benefit package is also designed to pre-answer the obvious ratepayer objection. The counter is that promises made at merger announcement are not the same as enforceable cost allocation over a decade of load growth.

What to watch: The important variable is whether large data-center customers publicly support the merger with firm power commitments, because that would show hyperscalers are willing to trade supplier choice for a utility that can finance load growth faster.

The Contrarian Take

Everyone says: The NextEra-Dominion deal proves AI has made power companies the new picks-and-shovels trade.

Here's why that's incomplete: Picks and shovels implies ordinary suppliers selling into a boom. Regulated utilities are different because their margins come through public permission, not pure market demand. The buyer can win the AI load race and still lose politically if regulators decide households are underwriting data-center growth. The real scarcity is not just generation capacity. It is social license to convert private compute demand into public grid investment.

Under the Radar

The DOJ fund is a new appropriation workaround — The Justice Department announced a nearly $1.8 billion fund to compensate people allegedly targeted by government "weaponization," drawing on a settlement tied to old IRS treatment of conservative groups. The under-covered question is not whether the Obama-era IRS episode was real; it is whether the executive branch can convert settlement machinery into a political restitution channel without Congress writing a normal program. AP
Medicare drug-price negotiation survived a venue test — The Supreme Court declined to take up drugmakers' challenges to the IRA negotiation program, leaving lower-court losses in place. That does not end the fight, but it pushes pharma's strategy away from an early constitutional off-ramp and toward pricing, launch sequencing, and lobbying over implementation details. Endpoints News

Quick Takes

OpenAI won on timing, not legitimacy. A federal jury rejected Elon Musk's claims against Sam Altman and OpenAI after finding them filed too late. The practical effect is still large: procedural closure removes one public litigation overhang from OpenAI's restructuring path, even though it does not answer the broader governance question around nonprofit control and commercialization. (Source)
Anthropic bought the API plumbing. Anthropic acquired Stainless, the startup behind SDK generation and MCP server tooling used by hundreds of companies, including Anthropic's own official SDKs. The signal is that agent platforms need reliable machine-readable access to third-party systems; owning that layer lets Anthropic shape how agents reach enterprise software. (Source)
Sony is pricing the multiplayer toll. PlayStation Plus is raising one-month and three-month subscription prices in select regions while keeping the annual plan cheaper on a monthly basis. That is classic installed-base extraction: once multiplayer, cloud saves, and monthly games are bundled into a platform toll, the platform can steer users toward longer commitments without changing the console hardware. (Source)

The Thread

Today's stories are about institutions discovering that infrastructure is not neutral background. A hospital vendor turns identity systems into permanent exposure. A utility merger turns AI demand into ratepayer politics. DOJ settlement machinery becomes a way to move money around Congress. Sony's subscription price is a small version of the same logic: once a platform controls access, pricing power follows. The recurring mistake is treating infrastructure as passive when it is actually where power accumulates.

Predictions

New predictions:

I predict: By 2026-06-30, NYC Health + Hospitals will either name the breached third-party vendor publicly or face a formal city, state, or federal demand specifically seeking that vendor's identity and contract scope. (Confidence: medium; Check by: 2026-06-30)
I predict: By 2026-08-31, at least one regulator reviewing the NextEra-Dominion transaction will require a separate data-center or large-load cost-allocation analysis before allowing the merger process to advance. (Confidence: medium; Check by: 2026-08-31)

2026-05-19 03:26 EDT