Ukrainian drones are hitting Russia’s biggest data centers. Why are they so vulnerable — and can anything protect them?

After strikes on Yandex’s data centers, pro-war channels accused the company of inaction and even sabotage. Elements of critical infrastructure turned out to be completely unprotected against drone attacks. Now similar accusations will likely be directed at Sberbank: the bank’s largest data center in the Saratov region was attacked overnight on October 14. All these facilities were an obvious target for Ukraine’s military, if only because Russian forces are actively striking similar targets in Ukraine. Of course, the inadequate protection of the data centers has nothing to do with malicious intent or negligence on the part of Yandex and Sberbank’s management. It is known that, even before the strikes, authorities and the military discussed measures to defend such facilities with businesses. And judging by video of the attacks, at least in Yandex’s case some defense — probably in the form of mobile fire teams or automatic turrets — did exist: drones were fired at with small arms. This shows that Russia still lacks the resources to build a multilayered anti-drone air defense system anywhere except Moscow. And site-level defenses at individual factories, warehouses, and data centers cannot repel massed strikes.

First, a reminder of which facilities Ukraine’s military struck

Ukrainian strikes hit three of Yandex’s six largest data centers, also known as data processing centers, between October 7 and 11. None were located in the Moscow region, the area most heavily protected by Russian air defenses.

• The data center in Sasovo, in the Ryazan region, which also housed two of Yandex’s three supercomputers, stopped operating entirely. Judging by satellite images from the Planet Labs, the wing of the building housing the data center had burned down completely.
• Data centers in Vladimir, one of two in the city, and in Kaluga sustained significant damage.

A Ukrainian strike hit Sberbank’s Mega Data Center in Balakovo, in the Saratov region, overnight on October 14. Construction began in 2021, when Russian Deputy Prime Minister Dmitry Chernyshenko promised the facility would become the largest in Russia.

When Yandex and Sberbank built these facilities before the full-scale war, they had no reason to design the buildings to withstand drones carrying warheads with dozens of kilograms of explosives. HAKA Moscow, the company that built one of Yandex’s data centers in Vladimir in 2016–2017, said its main objectives were:

• speed of construction;
• the ability to expand the facility;
• and, importantly, reducing the need for active cooling of the equipment, which increased the facility’s energy efficiency.

Reinforced concrete slabs — a material characteristic of Soviet industrial construction — were not used to build the building’s frame.

So what went wrong with the defenses at these data centers?

All buildings of this kind — built with modern technology out of metal structures — are vulnerable to drones carrying relatively small warheads. By contrast, defense and civilian enterprises built during the Soviet era, such as thermal power plants, are difficult targets for these drones.

The full-scale war has confirmed this. When striking targets in Ukraine, Russian forces prefer to hit reinforced concrete buildings with ballistic and cruise missiles, which carry warheads weighing hundreds of kilograms and can penetrate obstacles because of their high kinetic energy.

Likewise, Ukraine’s military, which has not yet received large numbers of missiles with a range of more than 300 kilometers (186 miles), prefers relatively “soft” but economically important targets: oil refineries, warehouses, and now data centers. Ukraine tries to strike Soviet-era industrial facilities with missiles such as the Flamingo cruise missile, but it does not yet have enough of them to achieve an effect of strategic scale.

Ukraine’s army has also used drones to damage facilities that are strategically important to Russia and its military. In most cases, though, foreign companies built the buildings housing these facilities using metal structures.

Optical Fiber Systems JSC in Saransk, Russia’s only major fiber-optic producer, was built turnkey by a Finnish company in the late 2000s. The plant was important to the Russian military because fiber optics are used, among other things, to make fiber-optic-guided drones for the front line. In 2025, Ukrainian drone strikes effectively destroyed the building and its equipment. Rebuilding it will take several years, Russian authorities reported. Other successful attacks on workshops built from metal structures have also been recorded.

Beyond the vulnerability of the buildings themselves, Yandex and Sberbank also erred in choosing where to build. By the fifth year of the full-scale war, facilities in and around Moscow had gained a major competitive advantage: the military and Russian authorities have clearly chosen to allocate air defense resources to protect the capital, just as Ukraine’s leadership has done for Kyiv.

Traditional short-range air defense systems, the Tor and Pantsir families, remain the backbone of Russia’s drone defenses, and there clearly are not enough of them to protect the country’s entire territory. Concentrating these systems around Moscow, however, has made hitting targets in the capital difficult.

Difficult, but solvable: massing drones in a single wave sometimes lets Ukraine’s military break through the defenses around Moscow and reach particularly important targets, such as the Moscow oil refinery. Many attacks fail, however: videos and photos of drones shot down around Moscow circulate often, with no verified evidence that targets inside the city were struck.

Most of Russia’s key internet infrastructure nodes are located in Moscow and St. Petersburg. M9 (MSK-IX), the most important node, houses the infrastructure for the root DNS servers and sits in the southwest of the capital. During a drone attack on August 18, a fire broke out for unknown reasons at the CHPP-20 power plant, which supplies M9 with electricity, causing problems for thousands of websites. However, the data center itself was not damaged at the time.

How could these fragile targets be defended, in theory?

Methods of protection fall into two categories: passive and active. Passive measures include building physical protective structures around a facility or, where possible, dispersing production.

Building protective structures requires large capital investments with no guarantee the method will work. Russia also used to require government authorization to build these structures, but a 2026 law repealed that rule.

The problem is that not all structures are effective. Expensive protective structures, naturally, have a better chance of working. The same cannot be said for the ordinary anti-drone nets used at the front to counter small drones: they are not very effective against fixed-wing drones carrying warheads of dozens of kilograms.

This fall, Russian oil refineries and oil depots began installing sturdier metal nets of various designs. There is still no data on how much this protection helps. A video showing nets being installed at the Moscow oil refinery was published September 21, while the most recent attack — which again damaged unnamed equipment at the plant — had occurred the day before. The video was probably filmed before that strike, so doubts remain about how effective the netting is. There is also a risk that these barriers could be breached by repeated strikes on the same spot.

Previous experience has also failed to prove the method’s effectiveness. Bashneft, for example, began installing metal nets around its primary oil-refining units in the spring of 2024, yet drone strikes knocked the company’s plants out of operation in 2026.

That doesn’t mean more expensive, complex structures won’t offer protection. These experiments — sturdy metal cages and nets — are being conducted in Gulf states, though they, too, have not yet been tested in combat. Iran and its allies, the Houthis, have not recently used drones for strikes on land, preferring missile attacks instead. Russian companies, however, have already begun building these “fences” at their refineries.

Reliable passive drone defense might force an adversary to use more expensive munitions — missiles above all — to hit targets. Russian enterprises are already trying to build more reliable defenses that could also stop missiles in theory. At some power plants, for instance, construction has begun on structures resembling reinforced concrete sarcophagi.

Ukraine has chosen a second path of passive defense: dispersing potential targets. Fire Point, a manufacturer of drones, cruise missiles, and ballistic missiles, has said more than 20 camouflaged production sites are working on its ballistic missile project. This approach naturally reduces production efficiency, if it doesn’t rule out mass-producing complex products altogether.

Ukraine is helped by its ability to move some production outside the country. In Russia, the equivalent might be relocating sensitive facilities en masse to the Far East, but a shortage of production factors there, labor among them, and complicated logistics stand in the way.

Active defense — air defense and electronic warfare assets — also has its drawbacks. Russia’s model relies on a network of traditional short-range air defense systems backed by mobile fire teams equipped with man-portable air-defense missile systems, small arms, anti-aircraft artillery, interceptor drones, and mobile radars. Covering the entire territory from the Ukrainian border to targets deep inside the country is impossible: Russia’s Aerospace Forces and Ground Forces had 129 Tor-M½ systems and just over 50 Pantsir systems at the start of the year, according to the Military Balance 2026 reference guide. Even mounting them on towers and tall buildings, a widely used practice, does not allow them to detect, track, and hit a low-flying drone at a range of more than 15 kilometers (9 miles).

Saturating the defenses with hundreds or thousands of mobile fire teams, each capable of hitting targets within hundreds of meters or, at most, a few kilometers of itself, is also impossible: the Russian military lacks the personnel for it. The Kremlin has tried to solve the problem by calling up reservists through the Combat Army Reserve of the Country program, created in 2021, under which participants receive small payments and attend annual military training while keeping their regular jobs. Russia, however, appears to have not found enough reservists.

Russia has not yet built a layered system of sensors and interceptor drones similar to Ukraine’s, though individual elements, such as mobile groups with interceptors, have been deployed. Russian Defense Minister Andrei Belousov promised in the spring that the system would be ready by November. Work is underway: new regional structures are being created, and the outlines of a defense are taking shape.

Even so, Ukraine’s layered defense isn’t perfect: Russian forces have managed to temporarily neutralize it by quickly shifting to producing thousands of faster jet-powered drones and miniature cruise missiles. Neither Ukraine’s interceptor drones nor the sensors supporting them are designed for these targets, so Ukraine’s military now has to build a new system and new production lines to counter the Russian drones. Both the jet-powered drones and the tools to counter them have turned out to be far more expensive than the previous generation of equipment.

As a result, Russia’s anti-drone air defense still tends toward protecting individual sites, but there are so many potential targets that protecting all of them is impossible. And where this protection does exist, attackers can overwhelm it by saturating the defenses with a mass of drones.

The Kremlin is trying to get the owners of these facilities to pay for their own drone defenses. A decree now allows the state to temporarily take over management of enterprises that fail to provide their own protection. Beyond passive protection measures, though, enterprises have few tools available for defense. Companies are allowed to “rent” air defense systems from the Defense Ministry, for instance. However, many large companies are trying to build their own radar and interceptor-drone systems. This effort is hindered, among other things, by aviation regulations, which there are now proposals to amend urgently.

A separate problem for private air defense is the inability to use explosive warheads on interceptors. Despite some successes, it is unlikely that fixed-wing drones can be reliably shot down using only the kinetic energy of a small, low-speed interceptor, though manufacturers claim otherwise.