- ‘Cloud infrastructure was always theoretically vulnerable to kinetic warfare, but nobody had priced that risk in so far. Now that has to change,’ says consultant Lukasz Olejnik

- Data centers are now ‘much more attractive as targets for states or non-state actors that want to cause disruption,’ warns Carnegie fellow Sam Winter-Levy

ISTANBUL

Drone strikes on Amazon data centers in the Gulf are highlighting a new vulnerability in modern warfare: the data centers that underpin global digital services.

On March 2, Amazon said two of its data center facilities in the UAE and one in Bahrain sustained physical impacts from drone strikes.

“I think this is the first time, as far as I know, that a commercial data center has been targeted in a physical attack by something like a drone strike or a missile,” Sam Winter-Levy, a fellow in the Technology and International Affairs Program at the Carnegie Endowment for International Peace, told Anadolu.

Amazon said the strike had caused structural damage, disrupted power delivery to the infrastructure, and in some cases, required fire suppression that resulted in additional water damage.

The company also urged customers to activate contingency measures, advising them to “enact their disaster recovery plans, recover from remote backups stored in other regions, and update their applications” to minimize disruption amid the ongoing conflict.

Separate reporting indicates that digital infrastructure has also been targeted inside Iran. According to Holistic Resilience, a non-profit mapping airstrikes, Israeli and US strikes have hit at least two data centers in Tehran, including one reportedly linked to the Islamic Revolutionary Guard Corps.

Lukasz Olejnik, an independent consultant and visiting senior research fellow at the Department of War Studies at King’s College London, said the attacks highlight a new strategic risk for cloud infrastructure.

“Cloud infrastructure was always theoretically vulnerable to kinetic warfare, but nobody had priced that risk in so far. Now that has to change,” he said.

Digital infrastructure disruptions

Following the strikes on Amazon’s data centers, disruptions were reported across several digital services in the UAE, with reports of interruptions affecting banking providers, payments companies, taxi and delivery apps, and enterprise software providers.

While the outages were temporary, experts say the episode highlights how heavily modern economies depend on cloud infrastructure.

Data centers are large facilities that house thousands of servers, storage systems and networking equipment that store and process digital information. They form the backbone of cloud computing, allowing individuals, companies and governments to access data and run applications over the internet.

“These are commercial facilities rather than critical national security infrastructure,” said Winter-Levy regarding the attacks on Amazon, noting that major cloud providers typically operate multiple facilities and can shift workloads between regions.

However, moving workloads is not always simple due to data localization requirements and physical infrastructure limits, he added.

The growing importance of these facilities means even short outages can have wide consequences. Data centers host critical digital services used by banks, governments and major industries, so interruptions can quickly ripple across multiple sectors.

“If an AI company is using those data centers to train one of their frontier AI models and that gets disrupted, that could be very expensive,” Winter-Levy added.

According to Bloomberg, it remains unclear whether the attacked facilities were used for military operations, but Amazon and Google have a $1.2 billion contract with the Israeli government to administer cloud services and AI to entities including the Israel Defense Forces.

“With AI getting embedded into ever bigger parts of the economy – healthcare systems, energy infrastructure, the banking sector, government services – outages to a data center could be potentially very disruptive,” said Winter-Levy.

Growing target for disruption

As both defense technology and critical economic sectors increasingly rely on AI and other digital services, security analysts say these types of facilities are emerging as obvious targets.

“As these data centers become more and more important to the global economy, they will become more and more important to economic security, but also national security,” said Winter-Levy. “They become much more attractive as targets for states or non-state actors that want to cause disruption.”

With AI use and digital connectivity accelerating worldwide, global demand for data center capacity could more than triple by 2030, according to McKinsey & Company.

Indeed, major technology companies have rapidly expanded infrastructure in the Gulf in recent years, drawn by relatively cheap energy and available land. Last May, the UAE announced the launch of Stargate UAE, a massive sovereign AI infrastructure project in Abu Dhabi.

“AI data centers that the Gulf states want to build in the coming years could be much more significant targets,” said Winter-Levy.

He stressed that it is hard to protect a data center from air assault, as critical components like the chillers that keep them cool often tend to be exposed, making it difficult to cover them in reinforced concrete.

“They need to make sure that they have critical components on standby, like the chillers and transformers that help provide electricity to the facility, so they can make repairs quickly,” said Winter-Levy.

Analysts also point out that global internet traffic depends on a limited number of fiber-optic routes and submarine cable landing points connecting data centers to users. Damage to those physical connections could make it far more difficult to reroute computing capacity between regions, compounding disruptions during a conflict.

“In the past, we have seen groups like the Houthis targeting oil refineries in Saudi Arabia and the Gulf, because hitting economic infrastructure can cause broader damage. Exactly the same logic applies to a data center,” Winter-Levy added.

He believes that in general, companies and governments have historically been more focused on cyberattacks and digital outages than physical disruption from a missile or a terrorist attack.

“Companies will need to give a lot more thought to what their backup plans are, what redundancy they have available, how they can shift workloads to a different data center, if it gets taken out,” he added.