When Alexander Olshansky received a call in September telling him that the data center hosting his company's infrastructure in Kyiv had been destroyed by a Russian attack, he made a beeline for the scene.
“As I was driving up to the data center, I saw a column of black smoke, a block cordoned off by the police and fire trucks,” recalls Olshansky, president of the Ukrainian domain registration and Web hosting provider MiroHost. The data center was damaged, but Olshansky’s employees had been sheltering elsewhere when the attack happened.
Despite the facility’s destruction on September 23, just around one in 20 of MiroHost’s customers were affected. The company had reserved enough computing capacity in Poland, the Czech Republic and Slovakia to back up its Ukrainian infrastructure in the event of an attack.
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
Other data centers haven’t fared as well. In October Ukrainian drones struck three data centers operated by the Russian technology giant Yandex, disrupting services and damaging artificial intelligence infrastructure. Earlier this year Iranian drones damaged Amazon Web Services facilities in the United Arab Emirates and Bahrain, causing Web outages across the region.
What is inarguable is that, like them or not, data centers are increasingly important parts of our lives, and as such, they’re increasingly seen as fair targets in war. How they are secured is a matter of national—and even international—importance.
“I would say 2026 is going to be the first year of drone strikes taking out data centers being a thing,” says Doug Madory, head of international Internet analysis at the cybersecurity company Infoblox. “I just don’t think that anybody had anticipated this as a risk to interrupt service.”
Because of their vital role in the economy, data centers are designed with multiple layers of security. These include restricted access to the site, constant surveillance and backup power systems. In the event of fire, suppression equipment keeps flames at bay. But those defenses are mostly focused on stopping bad actors from getting inside or on keeping services running when equipment fails—not on withstanding attacks from the air.
“Most data center security standards in the industry focus on physical access restrictions,” says Connor Martin, an international affairs fellow in national security at the Council on Foreign Relations. But protecting facilities against drone or missile strikes is a different challenge—and one the sector must start focusing on. Data centers can seem like sitting ducks from the air because they’re massive, cavernous buildings containing enormously expensive equipment in often remote areas. They “can’t pick up and move,” Martin says.
Still, some protection is possible without going as far as installing missile defenses at key data center locations. Peter Judge, senior research analyst at the Uptime Institute, says operators can build shields around vulnerable equipment such as generators and air-handling units and use overhead netting or screens to hinder aerial surveillance. Yet more sophisticated systems might combine radar, cameras and radio sensors to identify approaching drones or aircraft.
But if a craft is spotted, what can actually be done is trickier. Aviation laws typically prevent jamming drone signals—scrambling their radio signals—or bringing them down without authorization. Some newer drones don’t transmit radio control signals at all.
For his part, Olshansky isn’t convinced physical protection is viable in a war zone anyway. “No fire suppression system is designed for a direct hit by a bomb, missile or drone,” he says.
Truly protecting such a facility could mean burying it deep underground, which isn’t feasible. Instead, the industry’s best approach may be in redundancy—distributing services across multiple facilities so that when one is destroyed, another can take over. It works, as MiroHost showed, but it also costs more: Olshansky says his company effectively doubled its available computing capacity to prepare for an attack.
Madory points out that cloud providers already offer ways to distribute workloads across different geographic regions. The problem is that many customers don’t bother because of the additional cost and technical complexity. “In theory, you could be resilient, but in practice, a lot of stuff is not,” he says.
The recent attacks could change where companies choose to build their data centers, Martin says. The Gulf states have invested heavily in attracting those kinds of instalments, but their proximity to regional conflicts could make future projects harder to justify. Larger countries such as the U.S. and China, meanwhile, have more opportunities to build facilities far from potential conflict zones. But even then, there are no guarantees. As Olshansky says, “It is always better to have two copies of something than just one, even if it is highly protected.”