“Russia Has Backed Itself into a Corner”

This fall, the Russo-Ukrainian war of attrition has entered a new phase. A series of Russia’s successful attacks on Ukrainian data centers has prompted a reciprocal response: Ukrainian drones are now targeted at the data centers belonging to Russia’s digital monopolist Yandex. Among products affected are Yandex’s own services as well as those belonging to numerous other businesses that use its cloud infrastructure for hosting their platforms. Maksut Shadayev, Russia’s Minister of Digital Development, Communications, and Mass Media, called the attacks “unprecedented” and outlined plans to secure other company facilities with the help of the Ministry of Defense.

Russian companies are hampered by excessive regulation: Russia’s “sovereign internet” concept prohibits storing Russian citizens’ data abroad, and the state can seize the businesses of data center owners if they fail to protect their infrastructure from drone raids. IStories examine the potential consequences of Ukraine’s new air campaign and look into Russia’s ability to manage the potential crisis for the country’s IT market.

What happened

On the night of October 8, Ukrainian drones attacked the Yandex data center in Sasovo, Ryazan Oblast. The data center is located next to the workshops belonging to Sasta, a machinery manufacturer working for Russia’s defense industry, so at first there was no certainty that this attack marked the beginning of a new Ukrainian tactic. 

However, later that evening, Ukrainian President Volodymyr Zelenskyy described the strike as a retaliation for Russian attacks on Ukrainian data centers. The next day, October 9, drones struck a second Yandex data center situated in Kaluga Oblast. Yandex then stated that operations at the Sasovo data center had been completely halted, and part of the infrastructure in Kaluga had been disabled. On the night of October 11, drones attacked the company’s third data center in the city of Vladimir. Its operations were also halted. No employees at the facilities were injured.

Following the attacks, more than 30 Yandex services became temporarily unavailable, and, following the strike on the Vladimir data center, disruptions have been reported in the company’s apps in Kazakhstan and Kyrgyzstan. Russians have been complaining about their Yandex Drive photos and Kinopoisk watch history disappearance, meanwhile Yandex Pay customers were unable to access their bank accounts.

Millions of Russians have also felt the impact of these attacks even beyond the Yandex ecosystem: users have complained about disruptions on such websites as the Russian Railways, Cyan (a real estate database), Avito (an advertising platform), VK (a social network), Twinby (a dating website), etc. It is likely that part of their infrastructure was located in the burned-down data centers. Yandex suggested that customers migrate their data to other infrastructure providers, such as Selectel, K2Cloud, and VK Cloud.

In addition to disruptions to the day-to-day operations of its services, the Russian IT giant may face yet another serious problem. The Ryazan and Vladimir data centers house some of Russia’s most powerful supercomputers — the Chervonenskis (ranked 101st globally), the Galushkin (ranked 134th), and the Lyapunov (ranked 161st) supercomputers which Yandex used to train neural networks with billions of parameters.

The company has already taken down its supercomputers information webpage, but a copy can be found on the Web Archive. Yandex has also attempted to conceal its data centers information on the company’s own maps platform: their locations are now blurred on satellite images. At the same time, information about dozens of other Russian data centers is publicly available, and these facilities could become new targets for the Ukrainian Armed Forces' attacks.

How the data center market works in Russia

There are nearly 200 data centers operating in Russia. On March 1, 2026, the Ministry of Digital Transformation launched a non-public registry of data centers and divided them into two types: commercial data centers and those serving companies’ internal needs. The damaged Yandex facilities likely served both roles, supporting both the company’s internal services and its clients’ resources.

A total of five companies — RTK-TsOD , IXcellerate, Rosatom, DataPro, and Selectel — account for two-thirds of the commercial data center market in Russia. They also own the largest data centers, alongside the companies building data centers for their own needs, such as Yandex, Sber, Megafon, MTS, VK and Wildberries.

According to a Kommersant source in the data center market, 80 to 90% of the commercial facilities for data storage are concentrated in the European part of Russia, primarily in Moscow and St. Petersburg. Publically available data analyzed by IStories indicates that there are not many large data centers located outside these major cities.

The key facilities in Moscow, along with the manufacturing, military, energy facilities, etc., are protected by three rings of air defense, which Ukrainian drones have managed to successfully breach twice: in June 2026, when the lid of a Moscow Oil Refinery tank picturesquely flew into the air, and once again in September.

Yandex operates six data centers with a total capacity of over 200 MW. In addition to the three attacked ones, the company’s smaller facilities are situated in the towns of Mytishchi and Ivanteevka in the Moscow Oblast. There’s also one more data center in Vladimir, which began operations in March 2026.

The attacks struck Yandex’s busiest facilities — the Ryazan one consumes up to 34 MW of energy, the Vladimir one — up to 28 MW, and the Kaluga one — up to 13 MW, meanwhile its design capacity reaches 63 MW. All of these centers are located outside Moscow’s air defense “umbrella.”

What else might be targeted besides Yandex

Data centers that support Russia’s government services may end up on the Ukrainian Armed Forces’ list of targets. Key government systems, such as Gosuslugi (the citizen services platform), Gosoblako (a cloud service for government agencies), EGRN (the real estate registry), GAS Vybory 2.0 elections platform, etc. are hosted in Rostelecom’s data centers. However, most of these are located in Moscow and are protected by the three air defense rings, so they are unlikely to be top-priority targets.

One of the most vulnerable civilian facilities for Ukrainian drones could be the Russia’s Federal Tax Service’s large data center in Dubna, Moscow Oblast. The Ukrainian army has already successfully attacked the military Satellite Communications Centre in the same town. The tax service’s backup data center is also located within the reach of a possible Ukrainian strike — in Gorodets, Nizhny Novgorod Oblast. A defense plant was successfully attacked in neighboring Dzerzhinsk in August 2026.

The ERA military technopolis in Anapa, Krasnodarsky Krai, where Russia’s Ministry of Defense tests its latest weapons prototypes, has not yet been targeted. Another data center based on a supercomputer is also located there.

The Russian Armed Forces’ key data center is located at their Moscow headquarters on Frunzenskaya Embankment and appears to be the most complex target for Ukrainian strikes. As IStories previously discovered, this is where Russia’s Unified Military Registry infrastructure is housed.

The National Defense Management Center’s supercomputer, which can be compared to Yandex supercomputers in terms of processing power, is also located there. According to Russia’s former Defense Minister Sergei Shoigu, the Russian military planned to use it to “predict the course of armed conflicts based on historical data.”

What will happen to the data?

It is difficult to say exactly how many data centers would need to be destroyed for the internet to stop working in Russia. The main question is whether those center’s clients have backup copies of their data elsewhere, experts interviewed by IStories say.

The expert team from the Na Svyazi project notes that only multiple backups physically distant from one another and located in different countries can ensure data safety. “Take Yandex, for example — it has five data centers. If we put one [backup] file in each one, that sounds secure, right? But now that two are gone [because of the data center attacks], that’s no longer the case. If the other buildings are destroyed, the data will be destroyed too,” says a team member. According to Na Svyazi, a significant share of Russian services will be affected, and the loss of data could become critical if such attacks continue.

A source familiar with the Yandex infrastructure, in his conversation with the BBC Russian Service, explained that the majority of Yandex services had been hosted in the three attacked data centers. The IT giant had been preparing for a potential shutdown of its data centers and had conducted several drills during which traffic was rerouted through other facilities.

“Yandex has a strong infrastructure, and the Yandex Drive data is most likely secure,” says Leonid Yuldashev, project coordinator at eQualitie. “But there’s always some data that's stored in just one place, so a huge number of vibe coders have already lost access to their servers. Sometimes people don’t even create backups properly — they’re either missing or a year out of date. That data will inevitably be lost.”

Small businesses that rely on cloud storage and do not keep copies of their data separately — customer databases, for example — may face the most serious consequences. “Yesterday you knew you have to produce five custom-made desks, but today everything has been destroyed, and not only do you not know the dimensions of the desks, but you also won’t be able to call the client to clarify the details, unless have your own independent backup,” the Na Svyazi team explains.

Is It possible to safeguard against the attacks?

Russia’s attacks on Ukrainian data centers have been persistent since mid-September. Russia has struck about ten sites in Kyiv, where more than half of the country’s data centers are concentrated. After one of the attacks, 100,000 households were left without internet access. The owners of one data center announced it completely shut down, but the customer data remained intact thanks to backups stored at facilities in the EU.

In February 2022, a week before the Russian invasion, Ukraine’s parliament passed a law allowing government data to be stored in foreign cloud services. In the first months of the war, petabytes of data from Ukrainian government registries were migrated to AWS (an Amazon subsidiary). PrivatBank, one of Ukraine’s largest banks, also transferred its customer data there. Some data was moved to European data centers operated by Microsoft, which allocated $400 million of aid to Ukrainian companies.

This option is not available to Russian companies due to the law requiring personal data to be stored within the country. The largest foreign cloud service providers — Amazon, Microsoft, and Google — withdrew from the Russian market in March 2022 of their own accord.

“Russia has backed itself into a corner: now its data centers store information that can only be kept within the country,” says Leonid Yuldashev from eQualitie. “Because of this law, it’s not even possible to backup the information in Kazakhstan. This only multiplies the destructive power of the attacks.” 

Yuldashev speculates that the attacks may prompt some response from the government: “They could loosen the regulations and allow Russians’ data to be stored in the Eurasian Economic Union countries . I think all the parties are currently considering this: the server and data center owners and the Ministry of Digital Development. Everyone understands that if there have been two attacks, there could potentially be 22 more.”

On the eve of Ukraine’s first strike on a Yandex data center, it was reported that the Ministry of Digital Transformation and the business community were discussing relocating Russia’s AI data centers to “friendly” countries. This was reportedly prompted by the market participants' complaints about energy shortages in Russia. 

Meanwhile, however, the legislation has been shifting in the opposite direction. According to the new AI law, the so-called sovereign and national AI models will be required to process and store data exclusively in data centers located within Russia, starting in March 2027. The government plans to use such sovereign AI models at “significant critical infrastructure facilities.”

“Any centralization, any one-button centralized control, any single-location data storage solution is a massive vulnerability,” Na Svyazi experts explain. “What’s happening now is a consequence of ignoring the problem.”

Businesses will suffer 

The authorities had shifted responsibility for protecting data centers to their owners prior to the first Ukrainian drone attacks. A decree signed by Vladimir Putin in late August allows for imposing temporary state management on critical infrastructure facilities if the owners have failed to provide adequate drone protection. Data centers are listed among such facilities.

Russian data centers have begun upgrading their equipment protection systems “to meet the demands of modern challenges,” Nikita Tsaplin, the CEO of RUVDS hosting provider, noted in a conversation with Kommersant. Back in July, VSK, one of Russia’s largest insurance companies, set a requirement for the data centers to be prepared for drone attacks. According to it, a facility had to be able to withstand a collision with a drone weighing up to 350 kg.

The idea of equipping data centers with anti-drone nets is currently being discussed among hosting providers, says Leonid Yuldashev. Not everyone will be able to afford it: “I can imagine that Yandex might at least install the nets, but for a small data center in Chelyabinsk, it will be more difficult to do so. And at the same time, you wonder [about the rationality of it]: I’ll spend all this money now, then a drone crashes into the data center, and it’ll be taken away [by the state]?”

The costs of protecting the infrastructure will ultimately fall on consumers, Nikita Tsaplin says. At the same time, prices will rise most significantly for the critically important telecom, government, and financial data centers which face the highest risks.

Equipment losses will also hit the data center owners, as they’ll have to purchase replacements from abroad at higher prices. The future of Yandex supercomputers remains unclear as they rely on foreign components, such as AMD EPYC processors and NVIDIA A100 graphics accelerators, the import of which has become difficult following Russia’s invasion of Ukraine.

Standard server equipment supplies are also declining, and due to a global memory supply shortage, their prices are rising. “All of this has become quite difficult to buy. Of course, people are buying Russian-made servers, but the problem is, they’re not actually ‘Russian-made,’” says Leonid Yuldashev. “Because of the storage crisis, it’s almost impossible to purchase equipment promptly."

Building a new data center is, in itself, a costly and complex project involving significant transaction costs, Yuldashev says. It won’t be possible to quickly relocate the facilities to Russia’s Far East, beyond the range of Ukrainian drones.

Alfa-Bank’s data center market review confirms this: by 2025, the rate of new facility launches had halved, and some projects already under construction had been put on hold due to the Central Bank’s high interest rates.

A blow to the “sovereign Russian internet”

Ukraine’s choice of Yandex as a target cannot yet be explained by the fact that its data centers have been directly used in warfare — there has been no direct evidence of this. The company, however, helps the Russian army recruit new contract soldiers. In 2024, through the social advertising mechanism alone (which means it is free for the advertiser), the ads for contract military service in the Russian army were displayed more than 1 billion times on various Yandex platforms. More than 12 million of these impressions happened in Uzbekistan, Kyrgyzstan, Belarus, Kazakhstan, and other foreign countries. In 2025, Yandex concealed the military service ad impressions statistics.

The Yandex data centers may have been targeted based on the same logic as the Wildberries and Ozon warehouses had been months earlier. If popular services — some of which hold a monopoly position in the market — become unavailable, it could hurt Russia's economy as a whole and upset Russians’ daily lives.

According to Leonid Yuldashev, Yandex was chosen as the first target not because of its position in the cloud storage market — there are other, larger players in Russia that most Russians are completely unaware of. Attacks on Yandex primarily harm the state.

“This undermines the main promise of the sovereign Russian internet,” he explains. “The authorities say they’ve blocked Telegram and YouTube, but Max ‘works even underground,’ and RuTube is up and running. [The government stated they] ‘have set up all the sovereign services, and everything works.’ And it turns out that if YouTube doesn’t work, but Yandex Video always does, maybe you’ll just use [Yandex]. But if both Yandex Video and YouTube fail to work, then you might start thinking, ‘Maybe I should set up a VPN [to be able to watch YouTube]?’”