Loading story…
Amazon Web Services reported prolonged outages and permanent customer-data loss after alleged Iranian drone, missile, and cruise-missile strikes damaged its data-center facilities in Bahrain and Abu Dhabi. AWS has suspended billing for affected regional customers, advised them to move workloads to other cloud regions, and told customers with inaccessible resources to restore them from remote backups; it has not set a timetable for repairs or service restoration.
The strikes occurred amid regional escalation following U.S. and Israeli attacks on Iran, with incidents reported from March through a later missile strike on a remaining Bahrain facility. The disruption has affected infrastructure used by banking and financial-sector organizations, while Iranian state media claimed the Bahrain site was destroyed. The IRGC also claimed an attack on an Oracle-linked Dubai data center and threatened other U.S. technology companies; AWS said it will continue supporting Bahrain customers and provide another update in early 2027.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The IRGC allegedly launched a missile strike against a remaining Amazon data-center structure in Bahrain. Satellite imagery reportedly independently confirmed damage to the structure; Iranian state media later claimed the Bahrain facility was destroyed.
A reported Iranian follow-up strike focused on AWS facilities in Bahrain, disrupting a second availability zone in the Bahrain region.
Iran's Islamic Revolutionary Guard Corps claimed it struck a Dubai data center linked to Oracle and threatened Microsoft, Oracle, Alphabet, and Nvidia over their alleged roles in attacks on Iran.
Alleged Iranian drone strikes targeted Amazon data centers in Bahrain and Abu Dhabi, UAE, causing fires and infrastructure damage. Emergency firefighting water reportedly caused additional damage to the facilities.
U.S. and Israeli strikes on Iran occurred amid regional escalation that preceded the reported attacks on Middle East data-center infrastructure.
AWS suspended billing in the affected Bahrain and UAE regions and instructed customers to move workloads and data to other regions or restore inaccessible resources from remote backups. AWS continued repairs but did not provide a timeline for either facility to resume operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s Islamic Revolutionary Guard Corps said its Aerospace Force struck and destroyed Amazon Web Services’ Bahrain data center during the latest wave of **Operation Nasr-2**, describing the attack as retaliation for an alleged U.S. strike on Iran’s under-construction Darkhovin nuclear site. Iranian state media portrayed the AWS facility as a wartime target, while Bahrain said its air defenses intercepted several incoming Iranian threats and did not report damage to any Amazon site; no independent verification of the destruction claim has emerged. Reports said the AWS Bahrain region, `ME-SOUTH-1`, had already been severely disrupted after an earlier Iranian drone attack allegedly caused a power failure and fire, prompting Amazon to shift customers to other sites, advise migrations, and later pull engineers because of security risks. Even if the latest strike claim remains unconfirmed, the incident underscores that commercial cloud infrastructure in the Middle East is being openly named in the escalating U.S.-Iran confrontation, with Amazon’s regional operations already operating under contingency measures to limit customer impact.
Jul 22, 2026
Amazon confirmed that **drone strikes** physically damaged AWS facilities in the **Middle East (UAE) Region `me-central-1`** and the **Middle East (Bahrain) Region `me-south-1`**, triggering a prolonged outage affecting dozens of cloud services. AWS reported structural damage, disrupted power delivery, and in some cases fire-suppression activity that caused additional water damage; multiple Availability Zones remained impaired, including **`mec1-az2` and `mec1-az3`** in the UAE and a continuing localized power issue impacting **`mes1-az2`** in Bahrain. Amazon said it is restoring physical infrastructure while also pursuing software-based recovery paths and prioritizing tools that enable customers to back up and migrate workloads out of the impacted regions. Incident reporting on the outage described an “unusual physical incident” in `me-central-1` where external objects struck a data center, causing sparks and a fire that led authorities to require a full power shutdown (including backup generators), taking down **EC2 instances**, **EBS volumes**, and **RDS databases** in the affected zone. Customers also experienced significant impairment of **EC2 networking APIs** (including `AllocateAddress`, `AssociateAddress`, `DescribeRouteTable`, and `DescribeNetworkInterfaces`), with AWS using traffic-weighting and configuration changes to shift load and restore functionality, though some API recovery lagged and constrained actions like reassigning Elastic IPs. AWS advised impacted customers to back up data and migrate workloads to unaffected regions while recovery continued.
Jun 29, 2026
Iran-linked threats and attacks expanded from shipping lanes to digital infrastructure across the Gulf, with reports naming **Google, Amazon, Oracle, IBM, and Nvidia** facilities in the Middle East as potential targets and describing earlier drone strikes that disrupted **AWS** operations in the UAE and Bahrain. Regional authorities later denied an IRGC claim that Oracle’s Dubai data center had been hit, but multiple reports said missile and drone attacks had already affected energy, desalination, and industrial sites in Kuwait and the UAE while raising fears for data centers and telecom assets tied to U.S. firms. The conflict’s cyber dimension also spilled into enterprise systems, with analysts warning that retaliation was increasingly aimed at civilian-adjacent technology, logistics, finance, and cloud dependencies rather than a single decisive cyberattack. At the same time, the Strait of Hormuz became a pressure point for both maritime traffic and internet connectivity. Large-scale **GPS/GNSS spoofing**, AIS suppression, dark vessel activity, and selective transit controls disrupted hundreds of ships, while repair and construction work on subsea cables slowed or stopped as security conditions deteriorated. Meta’s **2Africa/Africa2** cable project was delayed after Alcatel Submarine Networks declared force majeure, and Iran-linked media proposed licensing, taxing, and controlling undersea cable operations in the strait, with some outlets openly discussing cable disruption as leverage. Analysts warned that at least six major fiber systems crossing Hormuz underpin Gulf cloud services, finance, and trade, meaning prolonged interference or damage could delay repairs, force traffic onto riskier overland alternatives, and threaten the region’s broader digital-economy ambitions.
Jun 29, 2026