The notice went out after dark on September 15. Amazon Web Services told customers that it could not restore service at two availability zones — one in Bahrain, one in the United Arab Emirates — and that some of their data could not be recovered. The message landed six months after an Iranian drone attack on the region, and it offered no timeline for when the sites might return.
The admission is the clearest statement yet of the physical limits of cloud computing. Data centers are marketed as indestructible, a promise built on redundancy and replication. But when the facility itself is damaged, the redundancy has a boundary, and AWS has now told its customers where that boundary is.
CNBC, The Wall Street Journal, and Reuters all confirmed the notice, and each reported the same essential fact: some customer data is gone. The company has not said how much, or whose, but the phrase “cannot be recovered” is the one a cloud provider never wants to put in writing, and AWS has now put it in writing.
The geography compounds the problem. The two sites sit in the same region as the UAE Stargate campus, the five-gigawatt facility announced in 2025 as a centerpiece of the AI buildout. The proximity underscores how much of the industry’s newest and most valuable infrastructure is being built in a part of the world where the physical security question is not hypothetical.
AWS’s advice to affected customers was simple: move, and move now, rather than wait for a recovery that may not come. The company told customers to migrate their workloads to other regions, a recommendation that shifts the burden onto the very customers the cloud was supposed to insulate. For a business running production systems in Bahrain or the UAE, that is not a settings change; it is a rebuild.
The Iranian drone attack, which struck energy and infrastructure targets in the region, was one of the first direct tests of whether cloud facilities could survive a state-backed strike. The answer, six months on, is that they could not — at least not completely — and that the industry’s assumptions about where it is safe to build data centers may need to be revised.
Analysts said the incident will sharpen scrutiny of every buildout in the region. The Gulf states have courted cloud investment aggressively, and the AI boom has turned those courtships into multi-billion-dollar commitments. If the physical security of those facilities is in question, the discount the region’s cheap energy and land once justified becomes harder to defend.
AWS has not detailed the cause of the failure beyond the attack itself. The company’s public statements have been careful, offering sympathy and support without quantifying the damage. That caution is standard for a provider facing customers who have lost data, but it leaves a gap between what happened and what is known.
The recovery question is the one customers will press. A provider that cannot restore a zone after six months is a provider that has exhausted its standard playbook, and the longer the sites stay dark, the more the temporary outage looks like a permanent write-off. AWS has not said whether the facilities will ever come back.
For the cloud industry, the incident is a data point in a larger argument about concentration. The AI buildout has concentrated enormous computing power in a small number of enormous facilities, and a single point of failure now represents a larger loss than it would have a decade ago. The drone strike turned that argument from theory into a notice sent to real customers at midnight.
The outage also cuts against the industry’s own marketing. Cloud providers have spent years selling the idea that geography is an abstraction, that a customer’s data can live anywhere and survive anything. A customer who has now lost data in Bahrain will read the next redundancy pitch differently, and the sales teams at rival providers know it.
The region’s ambitions have not paused. Gulf states continue to announce new AI campuses at a pace that outstrips the rest of the world, and the Stargate project remains a national priority. What the AWS notice changes is the risk premium attached to those announcements, and the questions that boards will now ask before signing a lease in the region.
For AWS specifically, the damage is reputational as much as physical. The company is the market leader, the provider that others are measured against, and the standard it has set for reliability is the standard the whole industry borrows. An admission that data cannot be recovered, in any region, for any customer, is a crack in that standard that no competitor will let pass unremarked.
