Iranian drones struck two Amazon Web Services data centers in the United Arab Emirates on March 1, 2026, and a third AWS facility in Bahrain on April 1, in what Rest of World and other outlets described as the first known military strikes on a hyperscaler's infrastructure. The attacks, launched amid Iran's broader retaliation for U.S. and Israeli strikes on its territory, knocked out services for regional apps including the ride-hailing platform Careem and payment service Alaan, and the April strike on Bahrain's ME-SOUTH-1 facility, operated by telecom company Batelco and described as Amazon's largest Middle East data center, caused a fire, according to Bahrain's interior minister. Days later, Iran's Islamic Revolutionary Guard Corps named 18 U.S. companies, including Microsoft, Apple, Alphabet, Meta, Amazon, and Nvidia, as legitimate military targets in the region.
“Physical attacks are only going to become more common moving forward as AI becomes more significant,” Sam Winter-Levy of the Carnegie Endowment told Rest of World. IDC's Ashish Nadkarni described the shift more starkly: “Now suddenly, protecting data centers is like protecting top-security government offices.” The industry has historically built its defenses around cyberattacks and natural disasters; the drone strikes forced a reckoning with the idea that a data center could simply be bombed.
That reckoning has domestic roots too. On April 6, 2026, Indianapolis city-county councilman Ron Gibson said someone fired 13 shots into his home just after midnight while he and his 8-year-old son were inside; a note reading “No Data Centers” was left at the door. No one was injured, and police called it an isolated, targeted incident with the FBI assisting. Gibson had voted days earlier to support a rezoning petition for a Metrobloks data center project in his district. Jordyn Abrams, a research fellow at George Washington University's Program on Extremism, told the Associated Press that data centers have increasingly become a symbol for grievances spanning the political spectrum, citing energy and water consumption concerns and confidential utility power deals as recurring flashpoints.
Security researchers say the physical exposure compounds an already underappreciated vulnerability in data centers' operational technology. More than half of data center professionals identified human threats, internal or external, as their biggest security risk, according to a 2026 AFCOM survey cited by Bloomberg Law. Anthony Ferrante, global cybersecurity head at FTI Consulting, told Bloomberg Law that compromising the systems controlling cooling, fire suppression, and access control “could essentially shut down” a facility's computers entirely. Dave Wulf, co-founder of the Center for Cross-Sector Coordination, warned that a data center failure can cascade into banking, pipelines, hospitals, and defense systems that depend on it.
Congress has not settled on how to respond. The House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection has held hearings on whether data centers, or AI infrastructure more broadly, should become the 17th federally recognized critical infrastructure sector. “If a major data center is attacked, disrupted, or taken offline, the consequences can reach far beyond one company,” Rep. Andy Ogles said, arguing the current framework lacks a clear, unified approach. Industry witnesses split on the remedy: USTelecom's Robert Mayer and the Space Information Sharing and Analysis Center's Samuel Visner backed a standalone sector designation, following the United Kingdom's own move to designate data centers as critical infrastructure, while the IT-ISAC instead created a “special interest group” for data center providers rather than pushing for new federal machinery. The debate is complicated by capacity at the agency that would have to run it: CISA's headcount has fallen from roughly 3,300 to about 2,200 employees over the past year, including 96 of 189 people in its Stakeholder Engagement Division, according to a letter five House Democrats sent the Government Accountability Office asking it to investigate what capabilities were lost.
A year ago, data centers were mostly discussed in terms of power bills and zoning fights. Between a foreign government's drones, a councilman's front door, and a Congress still arguing over jurisdiction, the industry is now confronting a threat model it did not build for, and no clear consensus yet on who is responsible for closing the gap.
- Rest of World — “Iranian drone strikes at Amazon sites raise alarms over protecting data centers”
- Network World — “Amazon Middle East datacenter suffers second drone hit as Iran steps up attacks”
- CNBC — “Iran threatens Nvidia, Apple and other tech giants with attacks”
- PBS News (AP) — “Indianapolis councilman says shots fired at home and ‘No Data Centers’ note left at door”
- Bloomberg Law — “Data Centers Confront Rising Cyber and Physical Security Threats”
- CyberScoop — “Congress, industry ponder government posture for protecting data centers”
- Government Executive — “House Democrats want answers on what CISA lost in workforce cuts”