Ukraine Hit Yandex's Data Centers

Between October 8 and October 11, 2026, Ukrainian drones struck three of Yandex's six data centers in Russia — Sasovo in the Ryazan region, a facility in Kaluga, and the Vladimir hub east of Moscow. Two facilities shut down completely. The third lost "several modules." Yandex Cloud went into emergency mode. Taxi services, voice assistants, smart-home devices, food delivery, payment systems, and AI tools went dark across Russia, Belarus, Kazakhstan, and Armenia. Yandex shares dropped roughly 4% on the Moscow Exchange. Cloudflare Radar data showed automated traffic from Yandex's network — AS13238 — collapsing to 0.3% of its peak within 72 hours.

This was not a cyber attack. No one wrote an exploit or breached a firewall. Ukraine flew commercially derived one-way attack drones — Firepoint's FP-1, a weapon that costs a fraction of the infrastructure it destroyed — into the physical buildings where Russia's largest technology company stores its servers, trains its AI models, and runs its cloud. The campaign is the first confirmed kinetic strike on data-center infrastructure in the history of modern warfare. It rewrites the targeting calculus for every country that concentrates its digital economy in a handful of physical sites.

What Was Hit — and What It Means

The three strikes were not random. Each targeted a facility with strategic value beyond ordinary cloud hosting.

Sasovo (Ryazan region) — October 8. The overnight drone attack ignited a fire and forced Yandex to suspend all operations. Sasovo is Yandex's largest data center, opened in 2014, and it houses two of the company's three supercomputers — Lyapunov and Chervonenkis — used to train YandexGPT, Russia's most advanced domestic AI model. The facility shares an industrial complex with the Sasta machine-tool plant, which is reportedly linked to supply chains for Russia's Iskander ballistic missile. Yandex has not disclosed whether either supercomputer was damaged.

Kaluga — October 9. Drones hit the Kaluga facility southwest of Moscow. Yandex said "several modules" were "completely disabled." Ukrainian arms manufacturer Firepoint confirmed its FP-1 one-way attack drones carried out the strike — a rare public attribution by a defense company for a specific target. Nine people were injured.

Vladimir — October 11. The third strike shut down a facility housing Galushkin, another supercomputer considered among the most powerful in Russia. Governor Alexander Avdeev confirmed two substations were knocked offline, leaving about 5,000 residents without power. Yandex issued a service alert on Telegram: "Operations at the data centre have been completely suspended."

The three targeted sites have a combined capacity of approximately 115 megawatts — roughly half of Yandex's total data-center footprint. Yandex operates six data centers in Russia. In four days, Ukraine rendered half of them inoperable.

Read the full report on The Record →

The Tit-for-Tat That Got Here

Ukraine's strikes did not emerge from a vacuum. They are the kinetic escalation of a tit-for-tat campaign that began in late September 2026, when Russian forces systematically targeted Ukrainian data centers and telecommunications infrastructure.

Late September: Russian drone and missile strikes damaged or destroyed data centers belonging to at least six Ukrainian hosting providers — MiroHost, Parkovy, DataGroup, CityHost, Utels, and Pautina. The September 23 strike knocked out fixed-line internet for roughly 100,000 households in Kyiv and the surrounding region. MiroHost's equipment was completely destroyed. On September 27, Russia hit the headquarters of Kyivstar, Ukraine's largest mobile provider.

Moscow's Defense Ministry justified the strikes by claiming Ukrainian data centers supported the country's armed forces — a claim Kyiv denied, with Foreign Minister Andrii Sybiha calling the data centers "critical civilian infrastructure that ensures people can access life-saving information."

Russia's Digital Development Minister even referred to the campaign as a "forced digital detox" — dark humor from a government ministry while civilians lost access to banking, medical records, and emergency communications.

Zelenskyy's response was direct: "We always respond in kind."

Read on The Moscow Times →

The Bot Traffic Question — Signal or Noise?

The most dramatic claim to emerge from the strikes is the apparent collapse of Russian bot traffic online. Speaking at the Warsaw Security Forum on October 12, Zelenskyy said "everyone noticed" the decline in Russian bot activity following the strikes. Cloudflare Radar data showed automated HTTP requests from Yandex's network (AS13238) cratering — from 88.2% of its chart maximum to 0.3% within 72 hours.

The United24 Media analysis was the first to connect the dots, reporting that bot traffic "approached zero" on October 11, before recovering to roughly 20% by that evening. Czech MEP Tomas Zdechovsky publicly questioned whether the disruptions had affected online support for Germany's AfD party — implying a connection between Russian digital infrastructure and European far-right political movements.

Reddit's r/technology ran the story to 47,000+ upvotes within 24 hours, with users celebrating the decline as proof that Russian propaganda operations had been physically dismantled.

View on Reddit →

View on Reddit →

Three Lessons for the New Targeting Doctrine

1. Civilian digital infrastructure is now a permanent military target — and the legal framework does not exist.

Both Russia and Ukraine have now struck data centers housing civilian services. Russia justified it by claiming military use. Ukraine justified it as retaliation and pointed to AI-training supercomputers as strategic assets. Neither side has articulated where the line is — and neither has any incentive to.

The Geneva Conventions protect civilian infrastructure from attack. But a data center that runs a taxi app and a food-delivery service on the same racks as an AI model used for military targeting sits in a legal gray zone that international humanitarian law was never designed to address. The dual-use problem is not new, but its application to cloud infrastructure is.

The precedent now set: if your adversary's cloud provider also serves their military, every rack in every facility is potentially a target. For countries with concentrated cloud infrastructure — which is most of them — this is an existential planning failure waiting to happen.

2. The asymmetric economics of drone-vs-data-center warfare favor the attacker.

Firepoint's FP-1 drones are commercially derived one-way attack systems. They cost a small fraction of the infrastructure they destroyed. A single data center with 115 MW of capacity represents hundreds of millions of dollars in servers, networking, cooling, and construction. A drone swarm that can destroy or degrade it costs orders of magnitude less.

This is the same asymmetric logic that has defined the Ukraine war's drone revolution — but applied to the digital economy rather than the battlefield. NATO's own 100-year drone pact with Ukraine is built around scaling autonomous weapons production. What Ukraine demonstrated this week is that the same production base can target digital infrastructure as effectively as it targets logistics depots.

The defensive challenge is immense. Data centers cannot be hardened like military bunkers without destroying their economics. Air defense can intercept some drones but not all. Geographic distribution helps but increases latency and cost. The attacker's advantage here may be structural.

3. Cloud concentration is a single point of national failure.

Yandex operates six data centers for all of Russia. Three strikes took out half the capacity. The impact cascaded from cloud services to consumer applications to critical infrastructure — Russian Railways, telecom operators, payment systems, and retailers all went down or degraded.

This is not a uniquely Russian vulnerability. Any country that concentrates its digital economy in a handful of physical sites faces the same risk profile. The U.S. data-center industry is already facing political resistance at the local level, with 69 jurisdictions imposing bans or moratoriums. The irony is that the same communities resisting data-center construction for environmental or quality-of-life reasons may be inadvertently contributing to the geographic concentration that makes national digital infrastructure more vulnerable to physical attack.

Yandex's own response was revealing: after the strikes, it advised cloud customers to "prepare alternative recovery plans rather than relying only on switching between parts of its own infrastructure." Digital Development Minister Maksut Shadayev said his ministry was working with the Defense Ministry to improve security at Yandex facilities. On October 10 — between the second and third strikes — Yandex updated its terms of service to exclude liability for missed contractual obligations caused by drone attacks.

When your cloud provider rewrites its ToS to disclaim liability for drone strikes, the cloud has become a front line.

Read the full analysis on United24 Media →

The Diplomatic Backdrop: A Ceasefire That Isn't

The data-center campaign unfolded against a diplomatic backdrop that borders on absurdist theater. On October 11 — the same day the Vladimir data center was hit — Donald Trump posted on Truth Social announcing an "energy ceasefire" between Russia and Ukraine, "effective immediately," claiming both parties had agreed.

Zelenskyy's response: it was "news to me." He said Ukraine would support an energy ceasefire if Russia did the same — but noted that Russian drones "took to the sky throughout the day" on Sunday, the same day Trump declared the deal active. The Kremlin stayed silent.

The convergence of events is the point. While Trump announces a ceasefire that neither side acknowledges, Ukraine is conducting the most sophisticated infrastructure-targeting campaign of the war to date. While diplomats talk energy truces, engineers are watching their data centers burn. The information war and the kinetic war have merged — and neither the diplomatic framework nor the legal framework has caught up.

Read on CNBC →

What Comes Next

Russia's Digital Development Minister called the strikes "unprecedented." That word does the analytical work: if this is a precedent, it will be followed. Both sides have now demonstrated the capability and willingness to target civilian digital infrastructure. Neither has offered a framework for restraint. The Trump administration's "energy ceasefire" does not cover data centers — and even if it did, compliance would be unverifiable.

Three trajectories are now in play:

Escalation. Russia retaliates against Ukrainian digital infrastructure with increased intensity. Ukraine continues targeting Yandex and potentially other Russian tech companies (VK, Mail.ru, Rostelecom). The data-center war becomes a parallel theater alongside the ground war, with cumulative damage to both countries' digital economies.

Normalization. Both sides accept data-center targeting as a cost of war, build redundancy where they can, and factor digital infrastructure into ceasefire negotiations — eventually. This is the most likely path, and the most dangerous for every other country watching, because it establishes the norm that cloud infrastructure is a legitimate target in interstate conflict.

International response. A coalition of cloud-dependent nations pushes for explicit protections for civilian digital infrastructure under international humanitarian law. This would be the right move but requires political will that does not currently exist — and both belligerents would resist any framework that constrains their targeting options.

The Yandex campaign is four days old. Its consequences will shape how governments, military planners, and cloud providers think about the physical vulnerability of digital infrastructure for decades. The cloud was never immaterial. Now everyone knows it.