AWS confirms permanent customer data loss in UAE and Bahrain regions, admits Multi-AZ limits

What AWS acknowledged

According to a dev.to write-up compiling AWS health dashboard updates and press reports, AWS publicly stated on September 15, 2026, in its first such update since April, that some customer data in its Middle East regions cannot be recovered.

The reported breakdown: in the UAE region (me-central-1), data in one of three availability zones, mec1-az2, is unrecoverable, while the other two zones remain recoverable. In Bahrain (me-south-1), all three availability zones are unrecoverable, meaning the region as a whole.

The post reports that AWS told customers it had assessed all affected infrastructure and exhausted every option for recovering data and resources that had not been migrated before Bahrain became unusable. The author reads that language as confirmation that recovery is finished, not ongoing.

AWS also described damage that, per the post, spanned multiple availability zones and exceeded what its regional and Multi-AZ services were designed to withstand, a direct admission that the industry's default resilience pattern did not hold.

The six-month timeline

The post lays out the sequence:

• February 28, 2026: the United States and Israel strike Iran, starting the war.
• March 1: Iranian drone attacks directly hit two buildings in the UAE; in Bahrain, a drone crashes near a facility and causes damage.
• April: a repeat strike on Bahrain damages a second availability zone, taking down the whole region.
• July 24: Iran's IRGC reportedly strikes the remaining Bahrain building with missiles, confirmed by satellite imagery.
• September 15: AWS confirms some data is unrecoverable.

AWS had advised customers to migrate workloads away from April onward, and most reportedly did so before Bahrain went dark. The lost data belonged to customers who stayed without cross-region backups or replication.

Water did as much damage as the blasts

Per the AWS statement quoted in the post, the attacks caused structural damage, cut power delivery to the facilities, and in some cases required firefighting that produced additional water damage. A Korean report cited by the author states that the physical destruction came from water entering during firefighting.

The author's observation is that backup power, flood defenses and fire suppression are engineered for accidents, not for buildings that are struck, set alight and then drenched.

A first for a hyperscaler

Reports cited in the post describe this as the first time a global cloud provider's data has been destroyed through military action, and the first time war has disrupted a major American hyperscaler. The outages affected parts of the banking sector at the time.

AWS reportedly issued $150 million in credits after the first attack and waived the entire March bill for UAE-region customers, a step reports described as unprecedented. Credits, of course, do not bring data back. There was also a compliance wrinkle: reports suggested the fee waiver could erase Cost and Usage Report data used in audits, but AWS clarified that it does not delete customer billing data and that usage data remains available on request.

What actually worked

Cross-region backups. According to the post, AWS helped customers rebuild in other regions from their existing backups, and customers with copies elsewhere had far better recovery odds than those relying on in-region redundancy alone.

The lessons the author draws for architects:

• Multi-AZ solves one data center failing, not several failing at once. All three Bahrain zones sit in one geographic area and were hit together.
• Backups must be cross-region, not merely cross-zone.
• Test restoration itself. The failure mode here was not broken backups but the inability to restore into infrastructure that no longer exists.
• Know which data exists in only one place, because that is what is at risk.
• Ask how long it would take your organization to learn data is gone. This case took roughly six months, March 1 to September 15.

What comes next

The UAE is reportedly reviewing plans for large AI data centers, weighing dispersed sites, partial underground construction, blast-resistant concrete, and drone and missile interception systems, and AWS is said to be considering similar measures. AWS said it would update on the UAE region in the coming months and on Bahrain in early 2027. As Tom's Hardware notes, per the post, AWS has given no timeline for returning either region to service.

Why it matters

Multi-AZ has been the standard answer to the question of what happens when a data center fails. AWS itself now says that design assumption was exceeded by a correlated, physical, regional event. For architects on any cloud, the consequence is concrete: in-region redundancy is a bounded guarantee, cross-region backups are what actually survived, and the unmodeled failure mode, firefighting water, was enough to take out a region. One caveat on sourcing: the dev.to author notes the piece was AI-assisted and that AWS statements were read through press coverage rather than the health dashboard directly.