Three data centres. Two countries. One watershed moment for how the Gulf thinks about protecting its digital backbone.
On the morning of 2 March 2026, objects struck an Amazon Web Services facility in the UAE.
The AWS health dashboard recorded the event in clinical language. Sparks and fire. Elevated error rates. Degraded availability. What those phrases described was something that had never happened before in the history of modern conflict.
The first known military strikes on an American hyperscaler’s infrastructure. Rest of World
By the time the damage was fully assessed, two of three cloud availability zones in the UAE region had been critically impaired and one availability zone in Bahrain had been taken offline. AWS confirmed structural damage, power disruption, fire, and water damage from suppression systems. Tech Policy Press
The consequences were immediate and visible. Abu Dhabi Commercial Bank, Emirates NBD, First Abu Dhabi Bank, payments platforms Hubpay and Alaan, and the massive ride-hailing platform Careem all reported service disruptions. CNBC For millions of people across the UAE, the ability to pay for goods, access bank accounts, and move around the city briefly stopped working.
This was not a cyber attack. There was no malware, no intrusion, no sophisticated technical operation. Three drones hit three buildings and the digital infrastructure of a major global financial centre partially collapsed.
That distinction is the most important thing to understand about what happened.
The separation that no longer exists
Gulf critical infrastructure planning has historically maintained a clear distinction between physical security and digital security.
Physical threats, pipelines, ports, power stations, were handled by one set of planners with one set of tools. Cyber threats, network intrusion, malware, denial of service attacks, were handled by another. The two disciplines overlapped at the edges but operated largely in parallel.
The AWS strikes ended that separation.
The boundary between commercial cloud computing and military operations has largely vanished. The Pentagon’s Joint Warfighting Cloud Capability runs on the same commercial infrastructure that serves banks and ride-hailing apps. That dual-use reality means that attacks on commercial data centres can have immediate military consequences and vice versa. Fortune
For Gulf infrastructure security planners, this creates a problem that neither the physical security team nor the cyber security team can solve independently. A drone is a physical threat. But its consequences are digital. The protection required is physical. But the assets being protected are logical infrastructure, data, compute, connectivity.
The disciplines that have operated in parallel must now converge. That convergence is not a future planning exercise. It is an operational requirement that the first week of March 2026 made unavoidable.
Concentration risk made visible
When applications rely heavily on a single cloud environment, slowness or service interruption can quickly ripple across banking apps, airline booking systems and consumer-facing services. The National
The AWS strikes demonstrated this at scale and in real time.
The UAE has been aggressively positioning itself as a regional cloud hub. Sovereign data localisation mandates across GCC states require that government services and sensitive public sector data be hosted within national borders. Consequently, data centre providers have limited geographic options if they wish to operate in these lucrative markets. They must build physical facilities locally. Tech Policy Press
That regulatory requirement, designed to protect data sovereignty, created physical concentration risk. The same buildings that house sovereign government data, financial system infrastructure, and commercial cloud services are now confirmed targets in an active conflict.
The multi-availability zone architecture that cloud providers advertise as their resilience model assumes that threats affect individual facilities, not coordinated strikes on multiple facilities simultaneously. Because multiple zones went down simultaneously, standard redundancy models failed. Tech Policy Press
This is the same pattern we identified in the East-West Pipeline strikes. Redundancy architectures built for one threat era are being tested against a different one. In both cases, the redundancy held partially but not completely. In both cases, the gaps were exposed in live conditions rather than planning exercises.
What the IRGC said about why they hit it
The targeting rationale matters for every infrastructure operator in the region.
Iran’s Fars News Agency said on Telegram that the Bahrain facility had been deliberately targeted to identify the role of these centres in supporting the enemy’s military and intelligence activities. Fortune
Whether or not that specific claim is accurate, the logic it represents is not going away. Commercial infrastructure that hosts or processes data relevant to military operations becomes a legitimate military target under the doctrine being applied in this conflict. The fact that the same facility also hosts a bank’s payment processing or a logistics company’s routing data is not a protection. It is a complication.
Seventeen submarine cables pass through the Red Sea, carrying the majority of data traffic between Europe, Asia, and Africa. With Iran’s closure of the Strait of Hormuz and renewed Houthi threats in the Red Sea, both critical data choke points are now in active conflict zones simultaneously. Fortune
The physical and digital choke points of the global economy are converging in the same geography. That is not a coincidence. It is the strategic logic of the conflict being fought.
What protection now looks like
The immediate question for every organisation operating cloud infrastructure in the Gulf is what changes.
The answer operates on two levels.
At the architecture level, multi-region deployment is no longer optional for any organisation whose operations cannot tolerate outage. Storing replicas of critical data in facilities outside the immediate conflict geography is basic resilience planning. Cloud providers will commit to multi-AZ deployments, saving replicas of data in separate data centres. Globally, companies and governments will expect data centre providers to have recovery plans and multiple facilities within a country. Rest of World
But architecture alone does not solve the physical protection problem.
Data centres in the Gulf were not built to military hardening standards. They were built to commercial availability standards, uptime guarantees, power redundancy, cooling resilience. Physical strike resistance was not part of the design brief because physical strike was not considered a credible threat to commercial facilities.
That design assumption has been invalidated. The question now is what physical hardening for commercial digital infrastructure looks like, and who pays for it.
The answer will involve the same convergence of counter-drone detection, perimeter protection, blast resistance, and rapid recovery capability that we have examined for pipeline and energy infrastructure. The difference is that the operators of data centres are technology companies, not defence contractors. Most of them have no institutional capability for this conversation.
That gap is where the risk lives.
The broader implication for Gulf digital strategy
The Gulf states have collectively pledged trillions of dollars to build AI and data infrastructure. Saudi Vision 2030, UAE artificial intelligence strategy, Qatar’s national digital agenda. The entire regional economic transformation depends on digital infrastructure that is reliable, trusted, and available.
To attract clients, governments will have to offer heightened security measures. Rest of World The strikes demonstrated that the current security model, designed around cyber threat and physical access control, is insufficient for the threat environment that now exists.
This creates a genuine strategic challenge. The Gulf’s economic future requires digital infrastructure investment at scale. That investment now carries physical risk that was not priced into the original calculations. How governments, regulators, cloud providers, and enterprise customers respond to that repricing will shape the region’s digital trajectory for the next decade.
The line that has been crossed
Before 2 March 2026, data centres existed in a conceptual category separate from pipelines, ports, and power stations.
They were critical to economic function. They were targets for cyber attack. But they were not, in any serious planning framework, targets for physical military strike.
That category no longer exists.
The cloud is now critical infrastructure in the same sense that a refinery or a pumping station is critical infrastructure. It requires the same threat assessment, the same protection planning, and the same resilience architecture.
The organisations that understand that first will be better protected. The ones that continue to treat physical and digital security as separate disciplines, managed by separate teams, with separate budgets and separate threat models, are operating on assumptions that three drones in the UAE made obsolete in a single morning.
