What happened: On 15 September 2026, Amazon Web Services told customers it cannot restore access to resources and data hosted exclusively in its Middle East (Bahrain) region, me-south-1. In a status update reported by Reuters that day, AWS said the damage there “spanned multiple Availability Zones and exceeded what our regional and multi-AZ services are designed to withstand.” After what it called a thorough assessment, the company said it is unable to restore access to the resources and data hosted exclusively in that region.
The same update drew a narrower line in the United Arab Emirates. In Middle East (UAE), me-central-1, AWS said it cannot restore resources and data hosted exclusively in one availability zone, mec1-az2. It is still working to recover regional resources, and the zonal resources in the other two affected zones, mec1-az1 and mec1-az3. AWS said it is replacing the damaged UAE infrastructure and will update customers on service restoration in the coming months. For Bahrain, it pointed to a further update in early 2027.
So, is the data gone forever? For some customers, yes. The word AWS keeps using is “exclusively.” Data that lived only inside the Bahrain region, with no usable copy anywhere else, is in the category AWS says it cannot bring back. The same is true of data that lived only in mec1-az2. Data that customers had replicated or backed up outside those failure domains is not in that category, and can still be used to rebuild. AWS has not publicly quantified how much customer data was permanently lost, how many accounts were affected, or which services lost the most. Reuters and later accounts of the status page all note that missing number.
The outage did not start in September. Disruptions began in the UAE on 1 March 2026, with Bahrain reporting a localized issue the next day. AWS first described each incident as affecting a single availability zone. It later said both regions had suffered physical impacts from drone strikes connected to the conflict in the Middle East: two facilities in the UAE were struck directly, and infrastructure in Bahrain was damaged by a strike nearby. One Bahrain availability zone was damaged in early March. A second Bahrain zone was disrupted in April, and by 30 April the Bahrain region was listed as unavailable.
From the first days of the incident, AWS urged customers to replicate Amazon S3 and other critical data out of me-south-1 into another region, pointing them toward the United States, Europe, or Asia Pacific. Most customers moved workloads before Bahrain went fully dark in April, according to AWS. After that, the company said it helped remaining customers re-establish operations elsewhere, using backups where those backups existed, or other workarounds where they did not. In the September note, AWS said it had assessed the affected infrastructure and exhausted every option for restoring data and resources that had not been migrated before the region became unavailable. It also said it had notified the relevant authorities. Around the 30 April notices, AWS said relevant billing operations for both regions were suspended while customers were told to recover what they could from remote backups.
Why it matters: Availability zones are the basic promise of a cloud region. AWS designs each region as at least three zones, physically separate, with their own power, cooling, and security, typically within about 100 kilometers of one another. Spreading an application across those zones is meant to survive a power cut, a fire, a storm, or a failure in one building. It is not designed to survive several of those buildings being damaged in the same stretch of conflict. AWS said so in its own words: in Bahrain, the damage went past what regional and multi-AZ services are built to withstand.
That is why a second zone in the same country was not a disaster-recovery plan. High availability and disaster recovery are different jobs. High availability keeps a service up when one facility fails. Disaster recovery assumes the whole region might be gone, including local backups, encryption keys, identity services, and the deployment tools that lived there too. Customers who treated “we run in multiple availability zones” as “we can recover from anything” are the ones this notice hits.
The UAE case is smaller in scope, and it is not finished. Losing mec1-az2 does not, on AWS’s account, mean the entire UAE region is unrecoverable. Regional services and the other two zones are still in recovery, and AWS says it is replacing hardware. There is no public date for when me-central-1 will be fully usable again. Bahrain is the harder case. The September notices commit the company to supporting customers there over the long term and to another update in early 2027. They do not describe a rebuild of me-south-1. The Bahrain region opened in 2019. The UAE region opened in 2022. Both can still appear on AWS’s global infrastructure pages, which are a catalog of regions, not a live status board.
Deep dive: The practical test is that one word, exclusively. If a database, an object bucket, a snapshot, or a key existed only inside Bahrain, AWS says that copy is not coming back. If the customer had replicated it to another region, or kept a backup outside Bahrain, that outside copy is the recovery path. The same test applies to mec1-az2. Exclusive to that zone means unrecoverable. A copy in another UAE zone, or in another region, may still be reachable, subject to the recovery work AWS says is continuing in mec1-az1 and mec1-az3.
That distinction matters most for teams that were not free to copy data abroad. Banks, hospitals, and government systems in Bahrain and the UAE often have residency rules that require information to stay inside the country. An encrypted backup sent to Europe does not obviously solve that problem if the decryption keys must also leave the jurisdiction, or if the law forbids the copy in the first place. Cloud architects made that point in March: failing over might restore the service while breaking the legal reason the workload was placed in Bahrain or the UAE. For those customers, the leftover risk was not a missed setting. It was a constraint. The September update is when that constraint turned into a loss.
AWS has been clear that the mechanism is physical destruction, not a cyber intrusion into the control plane. There is no public indication in these notices that an attacker copied the data out by compromising AWS itself. The data is unavailable because the damaged facilities cannot be brought back online. Customers who got out in time did so by moving or restoring from copies that already sat somewhere else.
What AWS has not said is as important as what it has. It has not published a terabyte count, a customer count, or a service-by-service list of what is gone. “Most” customers migrated in time is the only scale clue in the notices. That is reassuring for the customers who left. It is not evidence, for any one company, that its own database, object versions, or audit logs survived. Each team has to reconcile its own inventory: what was in Bahrain only, what was in mec1-az2 only, what was replicated, and which of those copies was ever tested with a real restore.
Open questions: AWS says UAE restoration news will come in the coming months, and Bahrain news in early 2027. It has not said whether me-south-1 will be rebuilt. It has not said how much of mec1-az1 and mec1-az3 can actually be recovered, or whether the “unable to restore” line will later widen. It has not said how customers with in-country-only data should answer regulators when the only copy is gone. And it has not put a number on the loss. Until it does, the status update is the whole story: data that never left Bahrain, and data that never left mec1-az2, is not coming back. Everything else depends on a copy that already existed somewhere else.