AWS Says Iran Strikes Caused Permanent Customer Data Loss
The disclosure marks a hard limit for AWS’s regional protections after damage reached multiple availability zones.
Listen to this story
The audio brief
Story brief
3 key pointsAWS has confirmed that attacks on its Bahrain and UAE infrastructure caused permanent customer-data loss, exposing limits in its regional redundancy model. One UAE availability zone suffered irretrievable loss, while damage across all three Bahrain zones left resources inaccessible and exceeded what AWS’s multi-Availability Zone services were designed to withstand. AWS is still replacing infrastructure in the UAE,...
- 01
AWS identified three strikes: Iranian drones hit facilities in Bahrain and the UAE, followed by a Bahrain strike and missile attack.
- 02
The UAE loss is confined to mec1-az2; AWS is still working on the other two availability zones.
- 03
AWS reportedly issued $150 million in customer credits after the March attacks and suspended billing in both regions.
AWS says Iranian strikes on data centers in Bahrain and the United Arab Emirates left some customer resources and data permanently inaccessible. In the UAE, data was irretrievably lost in one availability zone; in Bahrain, AWS said it could not restore access to resources and data across all three zones in the region.
The acknowledgment came in an AWS dashboard update on September 15, about six months after the first attacks. AWS had suspended billing in the affected Bahrain and UAE regions while attempting to restore normal operations.
Damage crossed the regional boundary
The lost UAE data was in mec1-az2, one of the region’s three availability zones. AWS is still working to recover regional resources and restore services in the other two UAE zones, and said it is replacing affected infrastructure over the coming months.
Bahrain’s recovery remains unresolved
AWS described the Bahrain damage as spanning multiple availability zones and exceeding what its regional and multi-Availability Zone services were designed to withstand. Its statement identifies physical damage across several zones as the condition that surpassed those service limits.
After the initial strikes, AWS urged customers to move resources to other cloud regions and use remote backups for inaccessible resources. It reportedly issued $150 million in customer credits after the March strikes.
The next recovery markers
- AWS is continuing work on the two UAE availability zones where data loss was not disclosed.
- AWS says it will provide another update on support for Bahrain customers in early 2027.
The loss turns AWS’s earlier recovery guidance into the practical dividing line for affected workloads: migrate to another region where possible, and use remote backups for resources that became inaccessible. AWS has not offered a timetable for restoring Bahrain services beyond its promised early-2027 customer update.
Editorial analysis
Our Read
AWS’s disclosure puts a concrete boundary around the protection its regional and multi-Availability Zone services can provide. The company says damage across multiple zones exceeded those services’ design limits, while its post-strike guidance directed customers toward remote backups and migration to other regions. That does not establish which individual recovery plans succeeded. But it makes the Bahrain update AWS has promised for early 2027 more consequential: it should show whether replacing affected infrastructure can restore any remaining regional resources after the losses AWS has already deemed irretrievable.
Sources
- arstechnica.comIran strikes on Amazon data centers caused permanent loss of customer data
- wired.comCustomer Data Permanently Lost in Iran Strikes on Amazon Data Centers
Loading discussion...
Reader comments
Newest comments first. Replies stay oldest first.