Ukraine hit a data center operated by the Russian tech giant Yandex. How vulnerable is Russia’s internet to further drone attacks?

Overnight on October 8, Ukrainian forces struck Yandex’s data center in Sasovo, in Russia’s Ryazan region, with drones, causing a fire. No one was injured, but the data center temporarily shut down completely. This disrupted some of Yandex’s own services, as well as those of companies that used the tech giant’s infrastructure in Sasovo.

In the morning, users complained of problems accessing Yandex Disk and Yandex Documents. Disruptions then spread to Yandex Mail, the Yandex-owned Cian, Avito, IVI, MegaFon, Russian Railways, T-Bank, and several property developers and media outlets. The cascading disruptions across the Russian internet throughout the day may have been linked to an attempt to redistribute server capacity after the fire in Sasovo.

The data center occupies part of the former Sasta machine tool factory and houses two of Yandex’s three supercomputers, Lyapunov and Chervonenkis, which are used to train neural networks.

Whether these systems were damaged is not yet known. The overall extent of the damage is also unclear. Yandex shares have already fallen by more than 3% following the attack, according to Moscow Exchange data.

We don’t know. Much depends on how badly the fire damaged the equipment. Even if restoring the data center is technically possible, it might simply not make sense, partly because of the threat of further attacks. After a series of successful Ukrainian strikes on large Wildberries warehouses, for example, the online retailer’s management decided to spread its inventory across smaller facilities. Yandex may take the same approach.

Some of the data stored at the Ryazan data center, however, may be recoverable. If Yandex customers uploaded their data to the cloud, those files were stored simultaneously at different company data centers — more precisely, in four “availability zones.” Yandex said in 2019:

Things are a little more complicated for other companies’ virtual machines hosted there. Customers are responsible for backing up that data themselves. They could have used the separate paid service Yandex Cloud Backup, which would also have stored their data at several data centers. Or they could have chosen another solution — or made no backups at all.

Because these facilities store user data and house the servers that companies and organizations rent to run their websites or internal infrastructure.

Data centers can withstand a temporary power outage thanks to their own diesel generators, the loss of an individual communications link thanks to connections to multiple telecom providers, and even a small fire thanks to automatic fire suppression systems. But, like online retailers’ warehouses, they have proved defenseless against drone strikes. Unless, of course, they are housed in former Cold War shelters — Europe has several such data centers.

Nothing can be predicted with certainty during a war. But the context matters.

The strike on Yandex’s data center looks like a logical Ukrainian response to systematic Russian military attacks on Ukrainian digital hubs, including Cosmonova and Datagroup facilities. Since late September, Russian forces have damaged or destroyed the data centers of at least eight companies.

Russia’s Defense Ministry officially called these strikes a “forced digital detox.” Today, a few hours after the attack on Yandex’s data center, Andriy Kovalenko, the former head of the Center for Countering Disinformation at Ukraine’s National Security and Defense Council, wrote:

Any technology hub could be at risk, but a nationwide digital blackout is unlikely.

Sarkis Darbinyan, a lawyer specializing in digital rights and an expert with RKS.global, told Meduza that a single strike on a regional data center cannot take down a major service entirely. Modern IT companies have infrastructure spread across the country, so when equipment fails, user traffic is automatically rerouted to backup systems. Russia’s main data centers are concentrated in Moscow and the surrounding region and are very well protected. Disabling them all would be an extremely ambitious undertaking, Darbinyan said. Russia has close to 200 data centers in total.

Darbinyan believes further targeted attacks on regional facilities belonging to Rostelecom, Sber, VK, or Selectel are possible in theory:

Another potential target for Ukrainian forces is MSK-IX, Russia’s largest internet exchange point. It has become a “symbol of the centralization of the Russian internet,” Darbinyan said. If MSK-IX is hit, he told Meduza, internet access across the country could slow dramatically, alternative communications links could become overloaded, and the websites of small companies and local providers could temporarily become inaccessible. Even then, however, the internet would not shut down entirely, Darbinyan said:

Indeed, if we accept that this is primarily civilian infrastructure, neither army’s strikes on data centers appear justified. The Geneva Conventions explicitly state that a facility is a military objective if it makes an “effective contribution to military action” and its neutralization “offers a definite military advantage” to the attacking side. In cases of doubt, it is presumed to be civilian — meaning this infrastructure cannot be attacked without clear evidence.

Unfortunately, when it comes to data centers, Russian forces — and, following their lead, Ukrainian forces — are clearly ignoring the question of legality. For example, Russia’s Defense Ministry justified its strikes on Ukrainian data centers by saying that the grounds of one facility “were used by units of Ukraine’s Defense Ministry and other security agencies to store dual-use goods.” Another data center allegedly handled “the processing and transmission of intelligence for the Ukrainian armed forces.” The ministry provided no evidence for these claims.

As for the military rationale, at least some data centers meet the criteria for targets in long-range strike campaigns. Meduza’s Explainers desk previously set out these criteria:

• The facilities are poorly protected and can be destroyed with just a few drones carrying small warheads
• Their coordinates are well known
• They contain large quantities of valuable goods
• Systematically destroying these businesses can damage the enemy’s economy
• Disrupting internet infrastructure can also make civilians feel just how much the war is costing their country and, in theory, fuel public discontent with the government’s actions.