Breaking Lab srl
What happened in Bahrain
In September 2025, Amazon Web Services confirmed something cloud providers rarely admit: some customer data stored in its Middle East (Bahrain) region, known as me-south-1, is simply gone. Permanently. The damage hit multiple Availability Zones — AWS’s term for separate, independent data centres within the same region — and went beyond what the regional infrastructure was designed to survive.
AWS built its multi-zone architecture so that even if one data centre fails, the others keep your data safe. Whatever happened in Bahrain broke that assumption. For customers who stored data exclusively in that region, there is no recovery path.
The data sovereignty trap
This is where the story gets uncomfortable for anyone running a website or application that must comply with data residency laws. Data residency rules — legal requirements that say certain data must stay within a specific country or region — can force you to keep everything in one place. If that one place fails catastrophically, you have nowhere to fall back to.
Regulators in the UAE, Bahrain, and several other countries impose exactly these kinds of restrictions, especially on financial, healthcare, and government data. The rules are well-intentioned. But they create a structural conflict with the most basic principle of disaster recovery: never keep all your copies in one place.
What this means if you run a server or website
Even if you are not operating under strict residency laws, this event is a useful reality check. Ask yourself three questions:
Where are your backups? If your backup lives in the same cloud region as your main server, it is not really a backup — it is a second copy of the same risk.
Do you actually test restores? A backup you have never tested is a backup you cannot trust. Schedule a real restore drill, even a small one.
Are you relying on one provider for everything? Spreading data across two cloud providers or keeping an off-site copy — even a daily export to a cheap object-storage bucket in a different region — can be the difference between a bad day and a permanent loss.
The bigger picture
Cloud providers market reliability so effectively that it is easy to forget they are just buildings full of hardware that can burn, flood, or fail in unexpected ways. The Bahrain incident is a reminder that “highly available” and “indestructible” are not the same thing. As data sovereignty laws spread to more countries, the tension between legal compliance and sound backup strategy will only grow. Site owners who think through that tension now — before a crisis — will be in a far better position than those who discover the problem after the fact.
