On September 16, 2026, Reuters reported that Amazon Web Services could not restore access to its Bahrain cloud region or to resources hosted only in one of its three UAE availability zones. The facilities were damaged in March, when two AWS sites in the UAE were directly struck and a drone strike near a Bahrain facility damaged its infrastructure. According to the status update Reuters reviewed, AWS said the damage "exceeded what our regional and multi-AZ services are designed to withstand," that it had "exhausted every option" for data not migrated before the Bahrain region went down, and that it would replace the affected UAE infrastructure, with a further Bahrain update in early 2027.
Most data center investors do not underwrite military strikes. The lesson is not about the threat. It is about what happens to an asset, and to the people who financed it, when a physical event exceeds the design basis.
The insurance market is repricing the same lesson
The outage did not happen in isolation. Marsh Re estimates that 2026 losses in the Middle East war, terrorism and political violence market will exceed $2 billion against roughly $2.5 billion in annual gross premium, which Business Insurance reported could make this the class's first loss-making year. Pricing has tightened where losses are concentrated.
In the United States, the Senate Banking Committee met on September 17 to consider S. 4395, the Terrorism Risk Insurance Program Reauthorization Act of 2026, and, as the National Association of Realtors reported, advanced it unanimously. The Senate bill is a clean seven-year extension through 2034. The House passed its own seven-year version earlier in the year, and the two must be reconciled before the program's current December 31, 2027 expiration. Until then, owners and lenders are financing long-lived assets against a backstop whose renewal is likely but not yet law.
Five diligence questions the outage raises
1. What event does the redundancy assume?
Multi-zone architecture is built on the premise that zones fail independently. A single physical event that damages several zones at once breaks that premise. Investors should ask what physical event the design basis is meant to tolerate, in plain words, and what event it is not. A design basis that only addresses equipment failure and weather is incomplete for a high-value, high-visibility campus.
2. How long does physical recovery take?
Logical recovery is measured in minutes. Physical recovery is measured in procurement, construction and commissioning time. Six months after the first strike, AWS was still describing restoration "in the coming months" for one location and an update in early 2027 for another. A lender's model should include a scenario in which a building, not a server, has to be replaced.
3. Does the insurance follow the cause?
Property programs commonly exclude war and hostile acts, while terrorism cover may be bought, declined or sublimited. Under the US federal backstop, coverage applies to acts the Treasury Secretary formally certifies, and policyholders are not required to purchase it, as the Congressional Research Service explains. An owner who has declined terrorism cover to save premium, or whose program sublimits it below the campus value, should know that before closing, not after an event.
4. How concentrated is the exposure?
Data center campuses concentrate value. Separate programs for buildings, equipment and on-site power can make it hard for any single party to see the total exposure at one address. Reuters reported that the UAE is revising plans for a major AI data center project, including dispersing facilities and using underground, blast-resistant infrastructure. Investors do not need to follow that model to learn from it: dispersal and protection are choices that change a campus's loss profile, and they are easier to make at site selection than after construction.
5. What do the tenant contracts say?
Service-level credits, force majeure language and termination rights determine who bears the cost of a prolonged physical outage. If a tenant can walk after a defined period of unavailability, the asset's income depends on recovery speed as much as on lease term. That makes physical resilience a leasing issue, not only an engineering one.
What a lender's file should contain
| Document | What it should show |
|---|---|
| Physical threat design basis | The events the facility is designed to resist or recover from, and those it is not. |
| Dependency map | Power, fiber, water and cooling paths, with single points of failure identified on and off site. |
| Recovery-time scenarios | Equipment-level and building-level loss, with realistic procurement and commissioning time. |
| Insurance wording review | How property, terrorism, war and business interruption clauses respond to each scenario. |
| Residual-risk statement | A plain account of what remains exposed and who carries it. |
The US context is different, but the logic holds
Domestic data centers face a different threat picture: intrusion, vandalism, ballistic attack on supporting substations and sabotage of utility feeds are more relevant than military strikes. The financial logic is the same. When a physical event exceeds what the facility was designed for, the loss lands on the asset's income, its insurance program and its lenders in that order. The difference between a manageable event and a value-impairing one is usually decided long before the event, in the design basis, the dependency map and the policy wording.
That is also where an owner can make the case for value. A campus whose physical protection is tied to its uptime mission, documented, and matched to its insurance and lease terms is easier to finance, insure and sell. The AWS outage is an extreme case. It is useful precisely because it removes any doubt that physical risk can outlast every layer of logical redundancy.
Frequently asked questions
Does multi-zone redundancy protect against physical attack?
Only against the events it was designed for. Redundancy assumes independent failures. A single event that damages several zones at once can exceed that assumption, as AWS said happened in the Gulf.
Will terrorism insurance cover an attack on a US data center?
It may, if the owner bought the coverage and the event meets the policy's definition. Under the federal backstop, coverage applies to acts the Treasury Secretary formally certifies, and policyholders may decline the coverage. War and hostile-act exclusions are a separate question.
What should a lender ask for at closing?
A dependency map, the design basis for physical threats, the insurance wording that matches it, and a residual-risk statement that says plainly which events the facility is not designed to withstand.
Need to frame a facility decision?
ISCoA helps owners organize physical security exposure, mitigation priorities and evidence requirements before product selection.
Request a preliminary review