This story begins on 28 February 2026, when the US and Israel unleash a war against Iran by launching a series of bombing raids on various targets of strategic importance - we’ll come back to this in a moment. On 1 March 2026 Iran responds, bombing in turn various targets in the Gulf countries, military ones of course, but also some civilian ones. Among these, the part that concerns us, are two data centers housing two Availability Zones of the AWS me-central-1 Region in the UAE, plus one in the me-south-1 Region in Bahrain.
This is the official notice, not public but visible in any AWS account once logged in, in the AWS Health Dashboard, at the time of writing under the “Open and recent issues” section.
Nothing special so far, a bit of context and an image as a record for the future.
The first thing I found, apparently not so widely reported, is this: alongside the so-called “kinetic” attack (for non-specialists, “the bombs”) there was, in parallel, what was declared (by Israel) “the largest cyberattack in history” (The Jerusalem Post - Israel plunges Iran into darkness with largest cyberattack in history during attack against Iran) which, in the words of General Dan Caine instead, Chairman of the Joint Chiefs of Staff, during a briefing at the Pentagon on 2 March, “effectively disrupted communications and sensor networks, leaving the adversary unable to see, coordinate or respond effectively” (Stimson Center - Experts React: What the Epic Fury Iran Strikes Signal to the World). Some of the examples reported were the total compromise of the mobile network and the takeover of the traffic-light camera network in some areas of the country, which first made it possible to monitor the actions and communications of Khamenei and his entourage, and subsequently the shutdown blocked communications. In addition, institutional websites and prayer apps were hacked to display fake news and incite members of the army to desert. It is worth noting that General Caine also mentions the involvement of U.S. Space Command in the operation, which in concert with the cyber and physical attacks disrupted satellite communications and positioning, navigation and timing services (Apogee Magazine - Space, cyber significant factors in Operation Epic Fury).
These latter actions fit into a further context in which the internet in Iran had been “switched off” on 8 January to suppress the internal uprising (and probably to hide massacres and human rights violations, as Amnesty International says), and from 28 January was gradually being reopened, albeit with heavy restrictions (Wikipedia - 2026 Internet blackout in Iran). It should also be borne in mind that, these being highly classified military operations, the details are inevitably very limited and often qualitative.
Why all this long preamble recounting, at a very high level, the cyber side of the 28 February attack? To highlight how the IT component is by now considered an integral and fundamental part of every act of war. It seems a similar strategy was also used in Venezuela during the capture of Maduro (CIGI - Maduro’s capture reflects growing role of cyberattacks and satellites in warfare, RUSI - Layered Ambiguity: US Cyber Capabilities in the Raid to Extract Maduro from Venezuela). Moreover, the cyber component is a constant part of the Ukraine-Russia conflict, with data centers on both sides constantly hacked and damaged and a series of problems as a consequence (see Computer Weekly - In conflict: Putting Russia’s datacentre market under the microscope, MeriTalk - Ukraine Data Centers Became Physical Targets When Cyberattacks Failed, Data Center Dynamics - Ukrainian hackers claim takedown of Russian data center).
Right, it is in this context that Iran’s response the following day fits. Unable to defeat the US and Israel directly, its strategy (may the experts and military commentators forgive me for the oversimplification, my field is IT) is to do as much damage as possible to everyone, especially the Gulf countries but not only them, in order to create international pressure that leads to a halt to the attacks. Consequently, in addition to military, energy, political and port infrastructure, digital infrastructure too makes an excellent target, as we saw earlier. Hence, if Iranian intelligence suspects that US intelligence servers are hosted in the largest American data center in the area (CNBC - Amazon’s Bahrain data center targeted by Iran for support of U.S. military, state media says and the Telegram post itself Telegram - Fars News channel on the attack on the Amazon and Microsoft data centers), and on top of that it can directly damage several countries as a consequence, then the AWS data centers in the area become excellent targets in a context of war. Interestingly, both Amazon and Microsoft are mentioned in the Telegram announcement.
In any case, at this point it must be trivial for a state’s intelligence service to find out exactly where the data centers are located, and to know that hitting two out of three in the same Region causes the real damage at the architectural level (AWS Documentation - Advanced Multi-AZ Resilience Patterns), even though in my experience one is enough to cause big problems if the infrastructure is not designed properly (Reddit - On going AWS Frankfurt is partially down). For non-specialists, the comparison is that to cause serious problems to a house it is enough to damage the wall of one room, but if you knock down most of the supporting pillars it is a physical certainty that the house collapses.
After this long introductory journey, we finally come to the trigger for this post. It is not the first time a commercial data center has been targeted in a war, it has been happening at least since 2022 with the war between Ukraine and Russia, but it is the first time that one has been hit and seriously damaged (physically, moreover, with a drone attack) to the point of taking an entire Region offline, a hyperscaler, an event I used to jokingly describe as an extreme case, a meteorite, an atomic bomb on Milan or in Ireland. The fact that a hyperscaler was hit is the single thing that brought the matter to the attention of a much wider audience, fuelling a (for now) brief but intense discussion about what changes from here on.
A short space for interesting developments that occurred after the article was written
- 29 March 2026: this article was written in mid-March. Let’s say the strategy of doing as much damage as possible to everyone later became evident in the closure of the Strait of Hormuz, with repercussions for the world economy that were plain to everyone.
- 7 June 2026: this story has had several developments and I have discovered some facts that had escaped me, all of which unfortunately point in the direction I was describing. I won’t write a dedicated article, I don’t think it’s worth it, I’ll just mention a few things:
- on 11 March 2026 the US bombed the building of Sepah Bank, an institutional bank which among other things manages the payroll data of the Islamic Revolutionary Guard Corps (IRGC); in particular the premises of the “Sepah Bank Digital Security Center” were hit, which probably also hosted part of that bank’s IT services, given that immediately afterwards its online banking appears to have gone offline (Data Center Dynamics - Bank data center struck by missile in Iran – report, Küre Ansiklopedi - Iran Sepah Bank Attack (2026))
- on 31 March Iran named (again, this time officially it seems - it had already done so in theory) 18 American companies as legitimate military targets, practically all of them among the largest technology companies in the world (Amazon, Microsoft, Nviodia, Google, Apple, Meta, HP, Tesla, Oracle, Cisco, IBM, Boeing,…).
- on 1 April, probably to follow up on the official declaration, Iran struck one of the AWS data centers in Bahrain again (Reuters - Amazon’s cloud business in Bahrain damaged in Iran strike, FT reports). Probably following the decision to inform only the customers directly affected, nothing was written in the Health Dashboard; however, as written in the second article, as of 30 April a notice of complete unavailability of the Region was published for the Bahrain Region too, so there probably was damage.
I have explored, as well as I believe possible with the means at my disposal (that is, basically my brain, Claude and the internet), the situation at the macro level, the international context, the general picture. Now I will dive into the particular, into the technical detail of the incident, into the known consequences for those who had workloads hosted in me-central-1.
This article was translated from the Italian original with the help of AI (Claude) and reviewed by the author.