The multi-billion-dollar technology investments of the Gulf Cooperation Council (GCC) states face unprecedented operational risks as hostilities escalate across the Middle East.
Following the outbreak of military conflict between the United States, Israel, and Iran on 28 February this year, shipping through the Strait of Hormuz collapsed within days.
Subsequently, Iran’s security chief, Mohsen Rezaei, warned that communication cables, data centres, and artificial intelligence (AI) facilities across the region could be targeted if military hostilities resume.
Reports confirmed that Iran’s Islamic Revolutionary Guard Corps (IRGC) published target lists and maps via the semi-official Tasnim news agency and Telegram, naming US technology firms, including Google, Microsoft, Oracle, Meta, and Apple, alongside Emirati AI company G42.
Drone strikes and cascading disruptions
Recent military strikes and cyber operations have demonstrated the severe physical and digital vulnerabilities of the region’s technology sector.
Amazon Web Services (AWS) reported that two of its data centre facilities in the United Arab Emirates (UAE) were directly struck by drones, whilst a strike near a facility in Bahrain inflicted physical damage.
AWS later stated in September 2026 that it had exhausted every option and could not restore several sites in Bahrain and one in the UAE.
These marked the first confirmed military strikes on a hyperscale cloud provider.
The resulting disruptions cascaded across local economies, disabling mobile banking applications at Abu Dhabi Commercial Bank, Emirates NBD, and First Abu Dhabi Bank, alongside payment and delivery platforms.
Simultaneously, daily cyberattacks in the UAE tripled to 600,000, a GPS spoofing campaign affected over 1,100 maritime vessels in a single day, and a wiper attack reset over 200,000 devices at US medical-technology firm Stryker.
Iranian strikes also targeted power and water desalination plants in Bahrain and Kuwait, highlighting how desert data centres depend on power-hungry desalination for server cooling.
Red Sea chokepoints and cable damage
Beyond land-based facilities, over 90 per cent of data capacity between Europe and Asia moves through undersea fibre-optic cables in the Red Sea.
Most submarine cables pass through Bab al-Mandeb, a narrow maritime strait roughly 26 kilometres (16 miles) wide connecting the Red Sea and the Gulf of Aden.
Undersea cables suffered physical damage in February 2024 when three lines were cut by the dragging anchor of the cargo ship Rubymar after a Houthi missile disabled it, and in September 2025 when two cables were severed near Jeddah.
Security concerns escalated after Iran-backed Houthi forces seized territory around Mocha and Mayyun Island.
Although Yemen’s government claimed to retake Mocha on 5 October 2026, the Houthis denied the claim, and ongoing combat makes repairs extremely hazardous.
French firm Alcatel Submarine Networks declared force majeure and suspended work in the Gulf on Meta’s 2Africa Pearls cable project.
Systemic risks and ‘counter-legitimacy’
Security analysts emphasise that physical destruction is not required to render digital facilities useless.
Andreas Krieg, senior lecturer in security studies at King’s College London, noted that interrupting electricity, cooling, or telecommunications can shut down an entire facility.
Krieg explained that Mohsen Rezaei’s warning functions as a strategy of deterrence, linking Gulf economic diversification directly to US technological power.
In an Atlantic Council analysis, non-resident senior fellows Alia Brahimi and John James highlighted that adversaries exploit interdependencies through “counter-legitimacy targeting”, striking service delivery to destabilise the social bargain in rentier monarchies.
Brahimi and James observed that data localisation policies inadvertently concentrated government and banking services into a few physical sites, whilst demographic reliance on foreign workers (seven in eight residents in the UAE and Qatar) heightens vulnerability.
Terrestrial alternatives and strategic investments
To bypass maritime risks, regional entities are establishing overland connectivity.
In September 2026, Iraq signed an agreement with Qatar’s Ooredoo to transport data overland via an underground cable running from al-Faw to Rabia on the Turkiye border, as confirmed by Iraqi Communications Minister Mustafa Jabar Sanad.
Ooredoo’s international arm subsequently agreed to acquire fibre capacity from Iraq’s iQ Networks, whilst Google and Meta began routing select traffic through Iraq.
Concurrently, Microsoft committed over $400 million to connectivity and $10 billion to digital resilience across Kuwait, Qatar, Saudi Arabia, and the UAE through 2030.
Major regional initiatives include Abu Dhabi’s Stargate UAE AI campus (G42, OpenAI, Nvidia), Saudi Arabia’s Public Investment Fund launching Humain under Crown Prince Mohammed bin Salman, and Qatar’s sovereign fund partnering with Blue Owl in a $3 billion data centre initiative.
Experts conclude that achieving true security requires geographical redundancy and cross-domain resilience architectures to protect the region’s digital economy.
