Iranian missile strikes on two Amazon Web Services data centres in the Middle East have caused irreversible loss of stored customer files, according to a report by Ars Technica.

The damage appears to exceed the design limits of Amazon's infrastructure, which is built to survive regional power outages and natural disasters but not sustained kinetic attacks.

"The strikes caused permanent loss of data that could not be recovered from backups," the report said.

Both facilities, located in the United Arab Emirates and Saudi Arabia, were hit during a coordinated barrage late on Tuesday, shortly after Iranian forces launched a series of missiles targeting what they described as "strategic foreign assets".

Satellite imagery captured plumes of smoke rising from the rooftops, while emergency crews worked to contain fires sparked by ruptured power supplies. On the ground, staff described the scene as "chaotic" as cooling towers collapsed and racks of servers were reduced to twisted metal.

Amazon declined to comment on the specifics of the incident, but a spokesperson confirmed that the company is conducting a thorough investigation and will notify affected customers where feasible.

Extent of the Damage

Ars Technica notes that the affected clusters housed a mixture of public cloud services and private enterprise workloads, including databases and archival storage. Because the physical media were destroyed, the data could not be reconstructed from Amazon's standard multi‑region replication, which relies on the surviving hardware.

Industry analysts estimate that the loss could affect an "unspecified number" of customers, ranging from small businesses to multinational corporations that rely on the region's low‑latency services.

Amazon's Response

In a brief statement, Amazon said it is working with customers to assess the impact and will provide guidance on data recovery options where possible. The company also indicated that it is reviewing its disaster‑recovery architecture to address the vulnerability exposed by kinetic attacks.

Regulators in the United Arab Emirates have opened a formal inquiry into the incident, seeking to determine whether existing data‑protection statutes cover losses caused by armed conflict.

Wider Implications for Cloud Security

The episode underscores a growing concern that cloud providers, long praised for their digital resilience, remain exposed to physical threats in volatile regions. Experts say the incident may prompt a reassessment of data‑sovereignty strategies, with some firms considering multi‑cloud or on‑premises backups to mitigate geopolitical risk.

Previous disruptions to cloud services have stemmed from natural disasters or technical faults, but the Iranian strikes represent the first documented case of intentional warfare causing permanent data loss at scale.As the investigation continues, businesses are urged to audit their backup policies and consider the geographic distribution of critical workloads, a move that could reshape how the industry balances performance, cost and security.