Drone Attack on Middle East Data Centers and Security Risks of Overseas AI Infrastructure Investment: Korean Corporate Response Strategies

Executive Summary

The structural damage to three AWS data centers in Bahrain due to Iran's retaliatory drone attack in March 2026 has incorporated AI cloud infrastructure into the new high-value target landscape of the Gulf proxy war. While Gulf governments and local companies are framing this incident as an exceptional event and focusing on enhancing cybersecurity, the US is maintaining its attraction strategy by easing export controls on advanced chips to the UAE, making a complete halt to Gulf AI investment unlikely. However, the US policy community is beginning to re-evaluate the concentration of frontier model training infrastructure in high-risk regions, with a dual strategy of separating high-risk/critical workloads from low-risk/general-purpose workloads being the most probable outcome. Korean companies venturing into the Gulf should specify physical attack risks in their contracts and insurance clauses, secure opportunities to host domestic training clusters under the dual strategy, and manage industrial priorities to prevent subservience to hyperscalers' simple leasing models for power grids and land. A dual-track approach, concurrently strengthening both physical and cybersecurity, is required as an immediate action item.

I. Issue Situation Analysis

Middle East Data Center Drone Attack Incident: Situation Analysis

1. Background and Progression

The "Roaring Lion" operation, launched by the US and Israel against Iran on February 28, 2026, drew the physical infrastructure across the Middle East into the theater of war [6]. In retaliation, Iran launched drone attacks named "Operation Epic Fury" [6]. On March 1, these attacks caused structural damage to three AWS data centers in the Middle East [4]. According to the Brookings Institution, the attacks resulted not only in structural damage to the facilities but also in power outages and water damage from the fire suppression systems [4]. Iranian state media claimed that the Revolutionary Guard Corps targeted facilities in Bahrain because they supported US military operations [4].

This incident needs to be understood in the context that drone attacks on energy and power infrastructure in the Gulf region are not a new phenomenon. In 2019, Saudi Aramco's Abqaiq and Khurais facilities experienced production disruptions of 5.7 million barrels per day, or 5% of global supply, due to cruise missile and drone attacks [15]. More recently, Houthi rebels claimed responsibility for a drone attack on an Aramco facility in Nazran, Saudi Arabia [13], and a power plant substation in Zawiya, Libya, was destroyed by a drone attack, causing a blackout [14]. To the existing landscape where energy infrastructure in the Gulf has been a constant target of armed conflict, a new high-value target, AI data centers, has now been added.

2. Current Situation

The incident has prompted a full-fledged discussion within the US policy community regarding the national security implications of constructing frontier AI data centers overseas [4]. Concurrently, the US is exhibiting a contradictory stance by easing export controls on advanced AI chips to the United Arab Emirates [1]. Local Kuwaiti media interpreted this as energy geography transforming into computing geography due to the power-intensive nature of AI, assessing it as an opportunity for the Gulf and a strategic choice for the US [1].

In Bahrain, the focus of discussion has shifted to the cybersecurity risks associated with the spread of AI. The Gulf Daily News reported that Bahraini companies are establishing cybersecurity guardrails in line with the expansion of AI adoption [12]. Experts' warnings that network perimeter defense alone is insufficient due to the accelerated adoption of cloud platforms were also conveyed [12]. The fact that cybersecurity risks, rather than physical attack risks, are at the center of local corporate discourse suggests that Gulf countries are treating the drone attack as an exceptional event while maintaining their AI infrastructure attraction policy.

Saudi Arab News expressed concern that the repercussions of the US-Iran conflict are not yet fully apparent, describing the regulatory vacuum in the AI industry as an "AI Wild West" [5]. The same publication also reported on a Politico story alleging that Israel is engaging in influence operations to inject information into generative AI models to create narratives related to Gaza [11]. This indicates that the risks associated with AI infrastructure are expanding beyond physical destruction to include information manipulation.

In Europe, separate from this incident, the burden on data center power grids has emerged as a key issue. Roland Berger diagnosed that Europe is falling behind in the race to expand data centers compared to the US and Asia [3]. Ireland has implemented measures to restrict new data center grid connections until 2028 [8].

3. Key Actors and Interests

Iran (Revolutionary Guard Corps)regards the attack as a legitimate retaliation against bases supporting US military operations [4]. In Iran, there is a perception that cloud infrastructure is an integral part of the military support system, suggesting that Big Tech facilities in US allied countries could become repeated targets in the future.

AWS (Amazon)suffered structural damage, power outages, and water damage from the incident [4]. From the company's perspective, the erosion of trust in customer data and workload continuity is a greater concern than the physical repair costs. Adjustments to its strategy between expanding Middle East region investments and risk management are inevitable.

US Governmentis exhibiting a dual approach. On one hand, it supports the Gulf's transformation into a computing hub by easing advanced chip export controls to the UAE [1]. On the other hand, it is re-evaluating the security risks of constructing overseas frontier data centers through policy institutions like Brookings [4]. This reflects the policy tension between securing technological hegemony against China through allied infrastructure expansion and the security risks posed by exposing infrastructure in conflict zones.

Gulf Countries (Bahrain, UAE, Saudi Arabia)have made attracting AI infrastructure a core component of their national economic strategies. Bahrain's focus on building cybersecurity guardrails rather than physical attack risks [12] indicates an intention to manage drone attacks as an exceptional risk while retaining their AI hub status. Saudi Arab News adopts a more cautious tone, warning that the repercussions of the war are not yet over and expressing concern about the regulatory vacuum in AI [5].

European Countriesare facing their own bottleneck of data center power infrastructure limitations, separate from the Middle East incident [3][8]. Ireland's restriction on new data center grid connections [8] illustrates that Europe is losing ground in the competition for data center attraction due to physical power supply limits, even before considering security risks.

4. Key Issues

The first issue is the duality of geographically dispersing frontier AI infrastructure. The strategy of building data centers in proximity to conflict zones, driven by low energy costs and regulatory incentives, is being redefined by this incident as a risk of physical destruction rather than financial risk [4][1].

The second issue is the policy inconsistency within the US government. While easing chip exports to enhance the Gulf's computing capacity, the US is simultaneously sending contradictory signals by worrying about the potential for that infrastructure to become a target in conflicts [1][4].

The third issue is the gap in risk perception among Gulf countries. Bahrain focuses on cybersecurity, while Saudi Arabia prioritizes concerns about the war's aftermath and regulatory gaps [12][5], making it difficult to form a unified regional response to AI infrastructure risks within the Gulf.

The fourth issue is that data centers serve a dual function as both physical targets in military and information warfare and platforms for narrative manipulation. The case of Israel's influence operations using LLMs illustrates that AI infrastructure risks are expanding from hardware destruction to software-based influence operations [11].

II. In-depth Issue Analysis

Middle East Data Center Drone Attack Incident: In-depth Analysis

1. Root Cause Analysis

The direct cause of this incident is the US-Israel military operation against Iran and Iran's retaliation. In response to the "Roaring Lion" operation launched on February 28, Iran carried out drone attacks named "Epic Fury," one of which targeted an AWS data center in Bahrain [4][6]. Iranian state media cited the facility's support for US military operations as the basis for targeting it [4]. This suggests that the attack was not indiscriminate infrastructure destruction but a selective strike intentionally aimed at civilian cloud facilities performing functions that support US military operations.

However, a more fundamental cause lies in the logic of site selection for AI infrastructure itself. The Kuwait Times pointed out that as AI transforms into a power-intensive industry, energy geography is becoming computing geography [1]. The Gulf region offered attractive conditions for data center locations, including cheap electricity, abundant capital, and security cooperation with the US. Yet, these are precisely the conditions that also combine with geopolitical risks. The timing of the US easing export controls on advanced AI chips to the UAE and Iran designating data centers supporting US military operations as targets is not coincidental [1][4]. In the process of the US's AI infrastructure expansion strategy combining with the Gulf's energy and capital, the infrastructure began to be perceived as an asset virtually inseparable from the US's military and security network.

2. Structural Context

Political Structure: The Gulf as a Proxy War Arena

The Gulf region has already been the physical stage for proxy wars involving Iran-Israel, Iran-Saudi Arabia, and Iran-Houthi for years. The 2019 attacks on Saudi Aramco's Abqaiq and Khurais facilities, recent Houthi claims of attacking Aramco facilities in Nazran, and the arson at a power substation in Zawiya, Libya, demonstrate that energy infrastructure has been a constant target in the region's armed conflicts [13][14][15]. AI data centers are merely newly incorporated assets into this conflict structure; they do not alter the conflict structure itself. The issue is that, unlike oil facilities, data centers are assets owned by US Big Tech and are dual-use facilities directly linked to US military operations. Consequently, the political implications of an attack extend beyond disruptions to energy supply to directly clash with US security interests.

Economic Structure: The Trilemma of Power, Capital, and Regulation

From the perspective of Gulf countries, attracting AI data centers is a key pillar of their post-oil economic diversification strategy. While Arab News expressed concerns, calling the regulatory vacuum an "AI Wild West" [5], the discourse in Bahrain focuses on building cybersecurity guardrails rather than physical attack risks [12]. This suggests that Gulf governments and companies are treating drone attacks as an exceptional risk, separating it from their core economic objective of attracting AI infrastructure. Simultaneously, as the Roland Berger report points out, data center construction is already encountering physical limitations in power, cooling, and networking capacity [3]. With site selection constraints increasing even in developed countries, such as Ireland's restriction on new data center grid connections until 2028 [8], the cheap electricity in the Gulf continues to act as an irreplaceable incentive. This creates a structure where security risks and economic incentives do not offset each other but coexist.

Security Structure: Proliferation of Dual-Use Civilian-Military Assets

The core issue raised by the Brookings Institution is the dual nature of frontier AI data centers built overseas: in peacetime, they function as civilian cloud services, but in times of crisis, they can be repurposed as infrastructure supporting military operations [4]. Iran's justification for targeting the Bahraini facility is precisely this dual-use nature [4]. This presents a problem on a different level than the data security debates raised by semiconductor export controls or the Huawei telecommunications equipment incident [9]. While the Huawei incident focused on information control risks through backdoors, the current situation involves risks of physical destruction and service disruption to hard infrastructure. Coupled with Israel's alleged attempts to manipulate narratives using generative AI, as reported by Arab News [11], the risks surrounding AI infrastructure are layered across physical attacks, data breaches, and information manipulation.

3. Historical Precedents and Comparison with Similar Cases

The 2019 attack on Saudi Aramco's Abqaiq and Khurais facilities is the closest precedent for understanding the current incident. At that time, a combination of cruise missiles and drones caused production disruptions of 5.7 million barrels per day, 5% of global supply [15]. Saudi Arabia blamed Iran, but Iran officially denied involvement, and the Houthi rebels claimed responsibility, creating ambiguity about accountability. While the current data center attack differs from 2019 in that Iranian state media openly claimed responsibility by the Revolutionary Guard Corps [4], the pattern of targeting—"attacking civilian infrastructure serving US military and economic interests to deliver a political message"—remains the same.

The attacks on the Zawiya substation in Libya and the Houthi claims regarding the Nazran Aramco facility demonstrate that drones have already become a standard means of attacking energy infrastructure in the region [13][14]. The difference is that while past attacks targeted the oil production and supply chains of oil-producing nations, the current attack targeted overseas assets of US Big Tech and the US military support network. The target has shifted from national key industries to the digital infrastructure of multinational corporations. This can be interpreted as a signal that the spectrum of targets in the Gulf's armed conflicts is expanding from energy to digital infrastructure.

Another point of comparison is the history of the data sovereignty debate. The competition between the US and China, which evolved from the Huawei round to the data round [9], had already spread the perception that the physical location of data is directly linked to national security. However, while the Huawei incident focused on information leakage through backdoors, the current situation involves a much more fundamental risk of physical destruction. If the data sovereignty debate was about control over information, the discussion has now shifted to the issue of infrastructure survivability.

4. Key Variables Shaping Issue Development

First, the future trajectory of US-Iran conflict is the most direct variable. Given that the Brookings Institution has begun to address this incident as a national security policy agenda [4], the key question is whether the US administration and Congress will introduce a separate security review system for overseas data center investments. The US has already moved to ease export controls on advanced chips to the UAE [1]; it remains to be seen whether this attack will reverse this easing trend or, conversely, lead to a more refined selective approach of "openness limited to secure allies." This is a point to observe.

Second, the policy response direction of Gulf countries. As seen in Bahrain's case, the local discourse is still centered on cybersecurity [12], making it uncertain whether this will lead to investments in physical protection or demands for infrastructure diversification. If Gulf countries impose conditions on US Big Tech for the construction of redundant and backup facilities, this could alter the cost structure of data center investments in the region.

Third, the risk management strategies of Big Tech companies. If hyperscalers, including AWS, accelerate geographical diversification instead of reducing Middle East investments, the competition for alternative locations—between regions with power grid constraints like Ireland that block new sites [8] and regions like the Gulf where security risks are highlighted—could shift to third regions such as Southeast Asia or Korea [10]. In this scenario, security risk premiums are likely to be added as a new variable in site selection criteria.