Iran's drones erased AWS customer data; Amazon paid in credits

Gone means gone

On 15 September 2026, Amazon Web Services told Gulf customers what six months of recovery work had produced: it was "unable to restore access to the resources and data" hosted in its Bahrain region and one UAE availability zone, after Iranian drone strikes that began on 1 March ²³⁸. The damage "spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand"; AWS said it had "exhausted every option" for data not migrated out in time ²⁹.

It suspended billing in the affected regions and, according to reports, issued roughly $150m in customer credits after the first strikes ². Credits are not data.

Five campuses, one first

Howden counts five data centres struck across the UAE and Bahrain, the first deliberate wartime targeting of commercial data centres ⁴. Iran's Revolutionary Guards said they hit Bahrain because of Amazon's support for the US military, and satellite imagery confirmed the July strikes↗ ³⁷. In 2025 alone, data-centre space built within 10 to 15km of active conflict zones matched about 60% of the previous five years combined ⁴.

The market that wants the premiums

At this month's Monte Carlo Rendez-vous, data centres were the growth story ¹¹⁰. Swiss Re expects tied premiums to climb from $11bn to $24bn by 2030, and Swiss Re Institute sees AI data centres and renewable infrastructure generating around $200bn of premiums between 2026 and 2030 ¹⁵. Arbol's Sid Jha, fresh from the same event, says the build-out will force the industry to rethink traditional risk modelling↗ ¹⁰.

The cover runs out at $8.5bn

The market's largest bundles cover up to $8.5bn of value on projects worth up to $25bn, leaving many of the biggest campuses insured to less than half their worth ¹. A single site can cost $20bn to build, up to double once the chips are in ⁵. War sits between wordings: cyber, property and war coverage are blurring, Howden says, and policy language must catch up ⁴.

Six months of disclosures have produced a restoration timeline, not a claim. No claims figure has been disclosed by Amazon or by any insurer.

Who is actually holding the risk

Hyperscalers keep the residual. Deep pockets let them "take on quite a bit of risk themselves", Allianz's Darren Tasker notes, and captive premiums worldwide rose 8% in 2025 to roughly $240bn ¹. Money is arriving on the other side of the trade too: CalPERS lifted its catastrophe-bond and reinsurance-linked allocations by about 70% in six months to nearly $2.46bn ⁶. Pension capital is being paid to absorb peak losses, though those securities are mainly tied to homeowners' policies, not war ¹.

The other side can take a hit

A single shock loss would not erase the industry, says Aon's Caroline St. Clair, and insurers still speak of data centres with glee ¹. Amazon says it remains committed to Bahrain long term, with a further update due in early 2027 ². Both can be true: the industry survives, and the customer still owns the data that never came back.

What to watch

The UAE is redesigning Stargate, the 5-gigawatt campus pitched by OpenAI, Nvidia, Oracle and Cisco, around dispersal, underground halls, blast-resistant concrete and interceptors ³. The tell is the first catastrophe bond written on a data centre: capital markets are structured for exactly this peak risk, in Howden's reading ⁵. Until one prices, the cloud's newest peril stays where the drones left it, on Amazon's balance sheet and its customers' backups.