Data centres under attack — what Iran’s strikes mean for UK businesses & how to respond

The disruption caused by recent data centre attacks in the Middle East has underscored just how critical cloud infrastructure has become to global commerce.

In March 2026, Iranian drone strikes on commercial data centres operated by US cloud providers — including key Amazon Web Services (AWS) facilities — in the UAE and Bahrain marked the first time that private-sector cloud infrastructure has been deliberately targeted in a live geopolitical conflict. The resulting service outages triggered disruption across payments, banking, enterprise systems and consumer-facing services, with knock‑on effects felt well beyond the Middle East.

Here, Laura Keane from our data protection team explores the implications for UK businesses and outlines the practical measures that can help to mitigate similar disruption.

Data centres as critical commercial infrastructure

Data centres now underpin almost every element of modern commerce: payments, logistics, HR systems, customer data storage, AI-enabled services and real-time analytics. 

Iran’s attack caused structural damage and power failures at multiple AWS facilities, leaving dozens of cloud services unavailable and triggering widespread outages across banking systems, payment platforms, delivery services and ride‑hailing apps. Millions of people were temporarily unable to make digital payments, access wages or use everyday services such as mobile banking.

While many services were eventually restored through rapid migration to alternative regions, the incident exposed how failures in implementing robust business continuity measures can lead to significant economic loss. 

The commercial reality of cloud-based disruption

UK businesses have seen repeatedly how cloud outages translate directly into lost revenue, supply chain breakdown and reputational harm.

In April 2025, the Co‑op reported losing approximately £206m in revenue following a cyber-attack on its IT systems. During the incident, stores across the UK temporarily lost the ability to process card payments, forcing many customers to abandon purchases, with staff later confirming that the disruption was nationwide. 

More starkly, the cyber-attack suffered by Jaguar Land Rover in August 2025 caused widespread production shutdowns and is estimated to have cost the business around £50m per week during peak disruption, with broader impacts across its supply chain and the UK economy. 

The NCSC warning to UK businesses

The National Cyber Security Centre (NCSC) has recently warned UK organisations of heightened indirect cyber risk linked to the Middle East conflict. While it’s said that there’s no confirmed increase in direct Iranian cyber-attacks against UK targets, it’s emphasised the risk of “collateral impacts”, particularly for organisations with operations, suppliers or infrastructure in the region. The NCSC’s assessment is deliberately measured, likely reflecting the UK’s limited direct involvement in the conflict. 

By contrast, guidance issued by the US Cybersecurity and Infrastructure Security Agency (CISA) adopts a more cautious tone. In response, CISA has urged organisations to strengthen their IT systems, warning that a surge in cybersecurity attacks is likely during the conflict and could significantly disrupt many front-line services. It’s also encouraged organisations to review and strengthen their disaster recovery and multi-region resilience strategies so that they’re better placed to withstand and recover from an attack. This firmer stance is unsurprising given the US’ greater exposure to the conflict and the number of US cloud providers operating and maintaining data centres in the region. 

Taken together, these developments show that UK organisations can still face heightened indirect cyber risk, even if they’re not the primary target. For that reason, it’s sensible for UK organisations to take account of CISA’s more robust guidance.

Practical lessons for UK businesses

For UK organisations — particularly those reliant on cloud services, payment platforms or international supply chains — the Iranian data centre attacks reinforce several priorities:

1. Diversification of critical services: over‑reliance on a single cloud provider or region increases systemic risk.
2. Business continuity planning is essential and organisations should future-proof against potential loss of all types of digital services. 
3. Supplier due diligence should be taken seriously from the outset and organisations should focus on supply chain resilience and recovery in the event of a cyber-attack. 
4. Incident response planning should consider data protection obligations alongside operational and business continuity considerations. 

Looking ahead

In an increasingly interconnected digital economy, having strong data protection governance and cyber resilience is now a commercial necessity as well as a regulatory obligation. For UK companies, the question is no longer whether such disruption is possible but whether they’re prepared for it. 

Talk to us

Our specialist data protection team offers expert-led, practical training for covering the Data Protection Act 2018, UK GDPR and the Data (Use and Access) Act 2025, with a strong focus on governance, accountability and real‑world risk. 

This is complemented by our established cybersecurity expertise, enabling us to support you end‑to‑end, from prevention and preparedness to incident response and regulatory engagement.

If you need support with understanding your data protection obligations or require advice or guidance on anything discussed above, talk to us by giving us a call on 0333 004 4488, sending us an email at hello@brabners.com or completing our contact form.