“A cloud region losing customer data because of an airstrike — I don’t think that’s ever happened before.” That is Doug Madory, head of internet analysis at the cybersecurity firm Infoblox, describing something genuinely new.
Amazon Web Services said Tuesday it is unable to restore access to some customer data hosted in Persian Gulf data centers that were struck by Iranian drone swarms in the opening days of the U.S. war against Iran. Data stored exclusively in AWS data centers across Bahrain is beyond restoration. One availability zone in the United Arab Emirates — a group of data centers with independent power, cooling and networking — shares the same fate.
How infrastructure actually fails
The mechanics are worth reading, because they are a small masterclass in why disasters compound. The strikes set fires and damaged infrastructure, and forced authorities to cut the power. Then the water used to extinguish the fires caused even more damage.
Nobody designed for this. Madory’s assessment is blunt: “I just don’t think that they try to build these facilities to survive missile strikes.” Why would they? Redundancy engineering assumes a power failure, a flood, a hardware fault, a bad deployment. It does not usually assume a drone swarm.
To Amazon’s credit, it told customers after the March strikes to migrate their data to other regions including the United States and Europe, and most did so — before fresh Iranian strikes hit the Bahrain facilities again in April. The customers who lost data are, largely, the ones who kept a single copy in a single place.
The strategic consequence
This is a setback for Arab Gulf states positioning themselves as world-leading data processors for industries such as artificial intelligence, and it adds a significant new risk for U.S. companies weighing investments that can cost tens of billions of dollars.
The proposed fixes are telling: Emirati officials have floated building data centers underground and placing drone-defense systems near the computing centers. Both would add cost. Iran’s Islamic Revolutionary Guard Corps, meanwhile, has threatened American technology companies it accuses of contributing to the attacks, naming Microsoft (MSFT), Oracle (ORCL), Alphabet (GOOGL) and Nvidia (NVDA).
And yet the capital keeps going. Amazon and Microsoft both said last month they would still launch data centers in Saudi Arabia by the end of the year; Microsoft’s 200-megawatt Abu Dhabi site is under construction. They are betting the war ends and are drawn to the region’s capital — and fortifying a Gulf project may be cheaper and faster than starting over somewhere else.
The household version, which is the point
Read the operative phrase again: stored exclusively. That is what turned a facility outage into permanent loss.
The same principle governs a family’s financial life, and applying it is free.
Where does the only copy of something live? Estate documents in one safe-deposit box nobody else can open. Every account at one institution. Tax records on one laptop. A password manager whose recovery key exists in exactly one place. Digital records of a business in one cloud account tied to one email address that one person controls.
None of those arrangements fail often. All of them fail totally when they fail, and the failures tend to arrive at the worst possible moment — a death, an illness, a dispute — when the person who knew where everything was is the person who isn’t available.
Amazon at least had the good sense to warn its customers in March. Most households have no one to send that email. Fifteen minutes with a statement and an honest list of where the only copies live is a reasonable substitute.