Amazon says Gulf cloud data cannot be recovered after drone damage to Bahrain and UAE sites

Amazon Web Services said on Tuesday 15 September that it cannot restore access to cloud facilities in Bahrain and parts of the United Arab Emirates damaged by Iranian drone strikes in the opening days of the war, that the damage “exceeded what its services are designed to withstand”, and that it is unable to restore data hosted exclusively in the region. The account reaching us is GlobalSecurity.org’s rolling war digest, Day 201, dated 16 September 2026, which characterises the statement as the first by a major American technology company acknowledging permanent data loss caused by Iranian military action. The IRGC had claimed the Bahrain strike as retaliation for Amazon’s support to the American military — a claim of intent by the striking party, not a confirmed account of targeting. The Files has not seen the AWS post or health dashboard entry directly, and the affected Availability Zones, the number of customers and the volume of data are not in our material.

The distinction worth holding is that nothing here is a cyber operation. A drone that destroys a data hall produces the same outcome as a wiper — irrecoverable data — by a route that no patch cycle, no threat feed and no endpoint product addresses. The exposure it reveals is architectural: any Gulf government service, bank or logistics operator that ran single-region on a Bahrain or UAE zone, without cross-region replication, has lost that data because of a procurement decision taken years before the war. None of those customers has yet been named.

Assessment: Treat the permanence claim as the story and the IRGC’s retaliation framing as noise; a group that fires a drone will always supply a motive afterwards, and Amazon’s own statement is the load-bearing element. What to watch for over the coming week is not the strike but the audit: Gulf regulators asking which national services were single-region, and whether sovereignty rules that mandated in-country data residency quietly mandated a single point of failure. Expect the number of affected customers to stay unpublished. Corporate disclosure of permanent loss is a legal event as much as a technical one, and the wording released so far — damage exceeding design tolerances — is the language of a liability ceiling being built.