Loading story…
Iran’s Islamic Revolutionary Guard Corps said its Aerospace Force struck and destroyed Amazon Web Services’ Bahrain data center during the latest wave of Operation Nasr-2, describing the attack as retaliation for an alleged U.S. strike on Iran’s under-construction Darkhovin nuclear site. Iranian state media portrayed the AWS facility as a wartime target, while Bahrain said its air defenses intercepted several incoming Iranian threats and did not report damage to any Amazon site; no independent verification of the destruction claim has emerged.
Reports said the AWS Bahrain region, ME-SOUTH-1, had already been severely disrupted after an earlier Iranian drone attack allegedly caused a power failure and fire, prompting Amazon to shift customers to other sites, advise migrations, and later pull engineers because of security risks. Even if the latest strike claim remains unconfirmed, the incident underscores that commercial cloud infrastructure in the Middle East is being openly named in the escalating U.S.-Iran confrontation, with Amazon’s regional operations already operating under contingency measures to limit customer impact.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Tom's Hardware says the AWS Bahrain region (ME-SOUTH-1) was placed in hard-down status and marked unavailable on the AWS Health Dashboard between late March and early April. The report adds that Amazon had already shifted customers to unaffected sites to limit disruption.
On 21 July, Iranian state media and the IRGC claimed the Aerospace Force struck and destroyed the AWS Bahrain data center during the twenty-fourth wave of Operation Nasr-2, describing it as retaliation for an earlier U.S. strike on Iran's Darkhovin nuclear site. Security Online notes the claim was not independently verified, and Bahrain said its air defenses intercepted incoming Iranian targets without reporting damage to an Amazon facility.
Security Online reports that a 1 March Iranian drone attack caused a power failure and fire at the AWS Bahrain facility, leaving it effectively offline. The article says Amazon subsequently urged customers to migrate workloads and later withdrew engineers because of security risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon Web Services reported prolonged outages and permanent customer-data loss after alleged Iranian drone, missile, and cruise-missile strikes damaged its data-center facilities in Bahrain and Abu Dhabi. AWS has suspended billing for affected regional customers, advised them to move workloads to other cloud regions, and told customers with inaccessible resources to restore them from remote backups; it has not set a timetable for repairs or service restoration. The strikes occurred amid regional escalation following U.S. and Israeli attacks on Iran, with incidents reported from March through a later missile strike on a remaining Bahrain facility. The disruption has affected infrastructure used by banking and financial-sector organizations, while Iranian state media claimed the Bahrain site was destroyed. The IRGC also claimed an attack on an Oracle-linked Dubai data center and threatened other U.S. technology companies; AWS said it will continue supporting Bahrain customers and provide another update in early 2027.
Sep 16, 2026
Amazon confirmed that **drone strikes** physically damaged AWS facilities in the **Middle East (UAE) Region `me-central-1`** and the **Middle East (Bahrain) Region `me-south-1`**, triggering a prolonged outage affecting dozens of cloud services. AWS reported structural damage, disrupted power delivery, and in some cases fire-suppression activity that caused additional water damage; multiple Availability Zones remained impaired, including **`mec1-az2` and `mec1-az3`** in the UAE and a continuing localized power issue impacting **`mes1-az2`** in Bahrain. Amazon said it is restoring physical infrastructure while also pursuing software-based recovery paths and prioritizing tools that enable customers to back up and migrate workloads out of the impacted regions. Incident reporting on the outage described an “unusual physical incident” in `me-central-1` where external objects struck a data center, causing sparks and a fire that led authorities to require a full power shutdown (including backup generators), taking down **EC2 instances**, **EBS volumes**, and **RDS databases** in the affected zone. Customers also experienced significant impairment of **EC2 networking APIs** (including `AllocateAddress`, `AssociateAddress`, `DescribeRouteTable`, and `DescribeNetworkInterfaces`), with AWS using traffic-weighting and configuration changes to shift load and restore functionality, though some API recovery lagged and constrained actions like reassigning Elastic IPs. AWS advised impacted customers to back up data and migrate workloads to unaffected regions while recovery continued.
Jun 29, 2026
Iran-linked threats and attacks expanded from shipping lanes to digital infrastructure across the Gulf, with reports naming **Google, Amazon, Oracle, IBM, and Nvidia** facilities in the Middle East as potential targets and describing earlier drone strikes that disrupted **AWS** operations in the UAE and Bahrain. Regional authorities later denied an IRGC claim that Oracle’s Dubai data center had been hit, but multiple reports said missile and drone attacks had already affected energy, desalination, and industrial sites in Kuwait and the UAE while raising fears for data centers and telecom assets tied to U.S. firms. The conflict’s cyber dimension also spilled into enterprise systems, with analysts warning that retaliation was increasingly aimed at civilian-adjacent technology, logistics, finance, and cloud dependencies rather than a single decisive cyberattack. At the same time, the Strait of Hormuz became a pressure point for both maritime traffic and internet connectivity. Large-scale **GPS/GNSS spoofing**, AIS suppression, dark vessel activity, and selective transit controls disrupted hundreds of ships, while repair and construction work on subsea cables slowed or stopped as security conditions deteriorated. Meta’s **2Africa/Africa2** cable project was delayed after Alcatel Submarine Networks declared force majeure, and Iran-linked media proposed licensing, taxing, and controlling undersea cable operations in the strait, with some outlets openly discussing cable disruption as leverage. Analysts warned that at least six major fiber systems crossing Hormuz underpin Gulf cloud services, finance, and trade, meaning prolonged interference or damage could delay repairs, force traffic onto riskier overland alternatives, and threaten the region’s broader digital-economy ambitions.
Jun 29, 2026