In the early hours of October 8, 2026, a major data center operated by Russian IT giant Yandex was hit by a drone attack by the Ukrainian military, causing a fire and forcing it to suspend operations. Behind this lies a chain of retaliatory attacks by both countries targeting each other’s digital infrastructure, as well as the vulnerability of cloud infrastructure to physical attacks.

Chronology and Direct Damage of the Sasobo Data Center Disaster

In the early hours of October 8, 2026, a Yandex data center located in Sasovo, Ryazan Oblast, approximately 300 kilometers southeast of Moscow, was targeted in a drone attack by the Ukrainian military. The attack caused fires on the building’s roof and other areas; while there were no casualties, the facility completely suspended operations. Boasting a maximum power capacity of 12 megawatts, the facility was co-located on the grounds of the Sasta Machine-Tool Plant, which was placed under sanctions by the UK in 2024. The plant has been noted as being linked to the supply chain for Russia’s “Iskander” ballistic missiles. Furthermore, of the three supercomputers owned by Yandex, two—”Lyapunov” and “Chervonenkis”—were housed in the affected data center. “Chervonenkis” was the company’s most powerful machine, ranked 19th globally in the 2021 Top500 list, and served as essential infrastructure for training artificial intelligence neural networks. Following the attack, the availability zone “ru-central1-b” of Yandex’s cloud service was taken offline, and the company’s stock price on the Moscow Exchange dropped by more than 3 percent in morning trading that same day. Please refer to the figure below.

Major Telecommunications Outage Stikes Across Russia and Its Severe Ripple Effects on Businesses

Due to the shutdown of the Sasovo facility, a massive internet outage occurred across Russia starting around 4:00 PM on October 8, 2026. According to data compiled by outage tracking services, the impact ranged from private enterprises to public infrastructure. The online marketplace platform “Avito” received over 14,000 complaints, and proprietary services such as Yandex Disk, Yandex Documents, and Yandex Mail were suspended. Furthermore, widespread infrastructure disruptions occurred, including website access issues for real estate platform “Cyan”, video streaming service “IVI”, major mobile carrier “Megafon”, T-Bank, and Russian Railways, as well as the suspension of online bus ticket sales by “Mostransavto” in the Moscow region. The impact also extended to major media outlets such as RBC, RIA Novosti, Kommersant, Vedomosti, and Interfax, creating situations where they became inaccessible even via VPN. According to an investigation by network monitoring organization NetBlocks, connectivity dropped to approximately 70 percent of normal levels. Although Yandex automatically rerouted traffic to availability zones in other regions, a sudden concentration of load resulted in creation limits for alternative resources. In response, the company took measures to blur the images of all four cloud data centers, including Sasovo, on its mapping service.

Physical Attacks Targeting Digital Infrastructure and the Structure of Retaliation

Intensification of Mutual Attacks on Data Centers by Ukraine and Russia

This drone attack is positioned as a clear retaliatory measure against the ongoing attacks that the Russian military has deployed against Ukraine’s digital infrastructure. Since late September 2026, the Russian Ministry of Defense has destroyed or damaged at least eight Ukrainian data centers, including those of Cosmonova and Datagroup, with missiles and drones, referring to this as a “forced digital detox.” In response, Ukrainian President Zelenskyy cited the continuous attacks on his country’s data centers and explicitly stated that equivalent countermeasures had been implemented. An official from the National Security and Defense Council of Ukraine also commented, “Both sides will fight by the same rules,” suggesting that attacks on physical digital hubs have become normalized. Such a situation shares similarities with the incident in early 2026 when AWS data centers in the United Arab Emirates and Bahrain were subjected to drone attacks amid the worsening Middle Eastern situation, leading to massive power outages and water damage from fire suppression systems. In modern hybrid warfare, kinetic attacks that directly destroy physical entities such as servers and communication facilities—rather than merely engaging in offensive and defensive maneuvers in cyberspace—are emerging as a primary tactic. Please refer to the figure below.

The Limits of Physical Defense and the Barrier of Redundancy Under International Sanctions

Until now, data centers have been designed to withstand power outages, communication failures, and localized fires, equipped with redundant power supplies, emergency diesel generators, and automatic fire suppression systems. However, it has been exposed that they are entirely defenseless against direct airstrikes by drones carrying explosives. Except for robust facilities utilizing Cold War-era underground shelters—such as Europe’s “Pionen” and Switzerland’s “Fort Knox”—typical data centers built above ground are vulnerable to physical destruction. Naturally, multi-region operations, which replicate and distribute data across multiple regions, are considered effective against such risks. While Yandex also had a mechanism to replicate data across four availability zones, the backups of individual customer virtual machines and proprietary data were left to each user’s responsibility, leading to data loss. Furthermore, as an issue specific to the Russian market, the majority of the approximately 181 existing data centers are concentrated around Moscow and St. Petersburg. For Russian companies that cannot use major overseas cloud services (such as AWS, Google, and Microsoft) due to international sanctions, they are forced to rely on a limited number of domestic providers, highlighting the limits of decentralized deployment.

Strengthening National Regulations and Cloud Infrastructure Defense Strategies

Stricter Regulations via Executive Order and the Move Toward Underground Facilities

In the wake of drone attacks exposing the vulnerability of digital infrastructure, the Russian government is moving to tighten regulations and strengthen its defense systems. In late August 2026, President Vladimir Putin signed a new presidential decree allowing the government to temporarily seize and manage critical infrastructure facilities if operators fail to take adequate protective measures against threats such as drone strikes. This applies to energy and telecommunications, as well as major data centers that house banking and administrative systems. Vladimir Dzhabarov, First Deputy Chairman of the Federation Council Committee on International Affairs, proposed classifying the location data of data centers as a state secret and relocating the facilities themselves underground. Going underground is a defense measure proven internationally and is considered extremely effective in protecting critical equipment from airstrikes. Russian hosting providers such as RUVDS have already begun implementing physical protection measures around external equipment, including air defense nets, metal fences, and smoke generators. Additionally, the concept of relocating and distributing data to regions east of the Ural Mountains to evade threats around Moscow is gaining renewed attention.

Rising Infrastructure Defense Costs and Future Points of Focus

Mandating physical defenses for critical infrastructure implies a significant increase in capital expenditures (CAPEX) and operating costs for cloud providers. It is seen as certain that the costs of building air defense nets, enhancing physical security, and constructing underground facilities will eventually be passed on as higher IT infrastructure usage fees for end users in the long run. Moving forward, it will be essential not only to harden single data centers, but also to design architectures that enhance overall network resilience. Specifically, the adoption of flexible load-balancing systems that integrate on-premises environments and public clouds, such as hybrid cloud configurations or “Stackland,” is projected to advance. Key points to watch in the future include the degree of progress in moving data centers underground and decentralizing them regionally in Russia, as well as the extent to which the installation of air defense networks contributes to the stable operation of commercial IT services. Furthermore, risk management for locating data centers in industrial facilities adjacent to military targets, and the formulation of Business Continuity Plans (BCPs) assuming physical attacks, will become top priorities for companies and IT departments worldwide.

Reference Page

• [Yandex Cloud Official Status Page] https://status.yandex.cloud/ru/incidents/2092
• [Yandex Cloud H1 2026 Financial Results Report] https://yandex.cloud/en/blog/financial-results-h1-2026
• [Official Gazette of the Russian Federation (Presidential Decree on Critical Infrastructure Security Management)] http://publication.pravo.gov.ru/document/0001202608240009

【#Datacenter #DroneAttack #Yandex #CloudSecurity #CyberWarfare #NationalSecurity #InfrastructureDefense】