Iranian Drone Strikes Cause Permanent Data Loss for AWS Customers in Bahrain and UAE
What Happened — In September 2026 AWS confirmed that Iranian drone strikes destroyed physical infrastructure in its Middle‑East regions. The damage rendered the Bahrain region (me‑south‑1) and one availability zone in the UAE region (me‑central‑1 – mec1‑az2) unrecoverable, resulting in permanent loss of customer data stored there.
Why It Matters for Trust & Control Assurance
- Physical‑security failures at a cloud provider test the effectiveness of your third‑party risk and business‑continuity controls – you must be able to prove that backup and recovery processes are independent of a single provider’s infrastructure.
- Continuous monitoring of vendor‑provided evidence (e.g., data‑center resilience reports, backup‑service attestations) supplies a defensible audit trail when a provider suffers a supply‑chain attack.
- Mapping this incident to the control objective “Maintain resilient backup and recovery capabilities” satisfies requirements across NIST CSF 2.0, ISO 27001, and other frameworks.
Who Is Affected – Cloud‑hosting customers (enterprises, SaaS providers, government agencies) that relied on AWS’s Bahrain or the affected UAE availability zone for production workloads and data storage.
Recommended Actions
- Verify that critical data is replicated to geographically separate regions or to an independent backup provider.
- Review and update your third‑party risk program to include physical‑security assessments and continuous evidence collection for cloud hosts.
- Document the incident and your remediation steps in your audit artifacts to demonstrate due diligence.
Technical Notes – The strikes caused structural damage, power loss, and water damage from fire‑suppression systems, overwhelming AWS’s built‑in redundancy across availability zones. No cyber‑exploit was reported; the loss stems from physical destruction of hardware. Source: Help Net Security