Amazon Web Services has confirmed that some customer data hosted in its war-damaged Middle East data centers is permanently unrecoverable, marking what appears to be the first time military action has caused irreversible data loss at a global cloud provider.
Half a year after Iranian drone strikes knocked out multiple Amazon data centers, the company has acknowledged the permanent loss of information stored in Bahrain and the United Arab Emirates.
In an AWS Health Dashboard update posted on September 15, the cloud giant said it was “unable to restore access to the resources and data” hosted exclusively in the affected sites.
According to initial reporting by Reuters, the development signals that the strikes inflicted catastrophic, unrecoverable damage on the underlying infrastructure. It is the company’s first public update on the incidents since April, and its clearest admission yet that some losses are permanent.
The damage in the UAE was concentrated in one of three availability zones in the region, specifically the mec1-az2 zone, where customer data was irretrievably lost.
Each availability zone is serviced by one or more physical Amazon data centers, and AWS said it continues to work on recovering regional resources and restoring the other two affected zones, mec1-az1 and mec1-az3.
According to the dashboard, objects struck the mec1-az2 data center at around 4:30 AM PST, creating sparks and fire that ultimately overwhelmed recovery efforts.
The destruction was even more severe in Bahrain, where AWS said it could not restore access to resources and data across the entire region, me-south-1.
“The damage to our infrastructure spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand,” the company stated.
That admission is significant because AWS architecture is normally built to survive the failure of a single zone, not coordinated strikes across several sites simultaneously.
The disruptions began in March following U.S. and Israeli attacks on Iran, which prompted Tehran to retaliate with missile and drone strikes on Gulf states hosting U.S. military bases.
Two AWS facilities in the UAE were directly hit, while a drone strike near a Bahrain facility physically damaged its infrastructure. A first Bahrain zone fell in March, and a second was knocked out in April, rendering the region unavailable.
The critical lesson for cloud customers is one of shared responsibility. AWS said most customers re-established operations in other regions using backups where available, but data stored solely within the damaged footprint with no external copy was lost entirely.
Organizations should immediately audit whether any assets resided exclusively in me-south-1 or mec1-az2. AWS has notified authorities in both countries, suspended regional billing, and promised further updates on the UAE in the coming months and on Bahrain in early 2027.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
