Between 7 and 11 October 2026, drones hit three of Yandex's six Russian data centers: Sasovo in the Ryazan region, Kaluga, and Vladimir. According to The Record, Yandex said the Vladimir site "has shut down completely, and the remaining infrastructure is unstable," and that the platform was running in emergency mode. Whatever one thinks of the war, the episode is a case study in how digital infrastructure behaves when it becomes a target, and in who ends up paying for that.
What was hit, and who felt it
The first strike, overnight on 7-8 October, set the Sasovo facility on fire and forced it offline. Reuters, as carried by The Star, called it the first major attack on a Russian data hub since the war began. Yandex shares fell about 3% on the Moscow Exchange, and the monitoring service Detector404 logged 58,268 user complaints in the previous day. Kaluga was damaged on 9 October. Vladimir followed overnight into the weekend.
The knock-on effects reached well beyond Yandex's own products. Yandex Cloud, which reported about 64,000 customers in mid-2026, was disrupted, along with mail, taxi booking, Yandex Pay, and the Alice assistant. More than a dozen third-party services also failed, including retailers, internet providers, and the Russian segment of TikTok. The Record reports that the three targeted sites have a combined capacity of about 115 MW. Sasovo reportedly hosts two of Yandex's three AI-training supercomputers, and Vladimir hosts Galushkin. Yandex has not said whether any were damaged.
The strongest case for the strikes
The case for treating such facilities as legitimate targets deserves a fair hearing. International humanitarian law protects civilian objects, but under Article 52(2) of Additional Protocol I to the Geneva Conventions, an object becomes a military objective when its nature, location, purpose or use makes an effective contribution to military action and its destruction offers a definite military advantage. Moscow itself argues that Ukrainian data centers serve its armed forces, and The Record notes that Zelensky has framed the strikes as retaliation for Russian attacks on Ukrainian infrastructure, including a 23 September strike that disrupted fixed-line internet for about 100,000 households around Kyiv. Supercomputers that train AI models can plausibly have dual-use value. From that perspective, striking compute is no different from striking a power grid that feeds a war economy.
Why the open-internet case still cuts the other way
That argument has limits. Dual-use is a spectrum, and the effects here landed overwhelmingly on civilians: payments, rail ticketing, email, and a psychotherapy service went down. Proportionality under the same Protocol requires weighing expected civilian harm against concrete military advantage, and a taxi app or a fitness chain is not a military asset. The same logic applies in the other direction. Russian strikes on Ukrainian data centers and telecom sites are no more defensible because Kyiv retaliates. Our editorial position is that connectivity and cloud services should be treated as civilian infrastructure by default, and that both sides should be held to that standard.
There is also a policy lesson that does not depend on who is right in the war: concentration is the vulnerability. Yandex's own documentation says Yandex Cloud runs in four data centers and five availability zones, with each zone isolated from hardware and software failures elsewhere. That design protects against a failed switch. It does not protect against a campaign that removes whole sites in sequence. Yandex's own advice to customers was telling: it recommended alternative recovery plans rather than relying only on moves within its cloud.
Liability moves downstream
The most consequential detail may be contractual. On 10 October, Yandex updated its terms to exclude liability for missed obligations caused by drone strikes and other attacks. Force majeure clauses are standard, and a provider cannot insure against a state's air campaign. But the effect is that customers, many of them small businesses, absorb losses from an event they cannot mitigate, while the provider keeps the revenue. Russian state media reported that Selectel, K2Cloud and VK Cloud agreed to help affected customers migrate. That is a market response, and a sensible one, but it is also a reminder that real resilience comes from multi-provider architecture chosen in advance, not from promises made afterwards.
The state's answer is the wrong lever
Moscow's policy reflex is to tighten state involvement. Digital Development Minister Maksut Shadayev said his ministry is working with the Defense Ministry on securing Yandex sites. This follows a decree Putin signed on 24 August 2026, which, per the AP report, lets the state temporarily take control of critical infrastructure, including communications facilities, when owners fail to protect it from drones. Deputy Prime Minister Denis Manturov said it does not mean nationalisation and will not be widely used. Russian legal commentary identifies it as Decree No. 604 of 24 August.
The decree's logic is that private owners are under-investing in air defense. But no commercial operator can be expected to defend a data center against drones, which is a state function. Threatening takeover of operators for failing at it creates an incentive to hide damage and under-report outages, which is the opposite of the transparency customers need. Evidence-based resilience policy would instead set disclosure duties for outages, require genuine geographic diversity for providers serving critical sectors, and keep the state's role to defense rather than ownership.
What to watch
Three things will show where this goes. First, whether Yandex discloses the status of its supercomputers and the restoration timeline, which it has called very hard to predict. Second, whether Russian regulators use the episode to press more services onto state-controlled infrastructure, which would deepen concentration. Third, whether cloud providers elsewhere begin to price geopolitical risk into contracts. The lesson for every jurisdiction is the same: when compute becomes a target, resilience, transparency, and diversified capacity are the proportionate policies, and centralisation is not.