What happened?
Overnight on October 11, Ukrainian forces launched a drone strike on a Yandex data center in Russia’s Vladimir region. It was the third attack in a row on the Russian tech giant’s infrastructure: On October 8 and 9, drones targeted facilities in Sasovo, in the Ryazan region, and in Kaluga, respectively.
Each strike caused widespread outages across the Russian internet. The disruptions temporarily took down Yandex’s own services, including Yandex Go, Yandex Eats, and Yandex Pay, which vast numbers of Russians rely on. Many other websites and services also went down. The attacks affected major banks, retailers, online marketplaces, classified ad platforms, news websites and apps, and much more. All these companies, including CIAN, Sports.ru, Magnit, and Vkusno i Tochka, used Yandex’s infrastructure to store their data.
Russians lost access to a range of everyday services: They couldn’t call a taxi, make payments, order deliveries, check their email, use the Alice voice assistant, and so on.
Wow! How did just three strikes bring down the whole Russian internet?
Because too much of the data storage market depends on Yandex’s infrastructure. And when the company designed its data centers, it didn’t anticipate drone attacks. That’s apparent from an October 11 update to its user agreement: Yandex classified attacks “using drones, missiles, and other weapons” as force majeure events and disclaimed liability for their consequences.
According to BBC News Russian, the company regularly ran drills in which it shut down one of its six data centers and shifted the load to the others. But Ukraine has now attacked three data centers, and two of them — in Sasovo and near Vladimir — were shut down entirely. That makes restoring even some services much harder.
For comparison, Iran attacked Amazon data centers in the Middle East in the spring of 2026. On September 15, the company said customer data stored in one particular availability zone in the UAE (mec1-az2) and in all availability zones in Bahrain had been permanently lost. Efforts to recover data in two other UAE zones (mec1-az1 and mec1-az3) were still incomplete at that point — six months after the strikes.
Related reading
So Ukrainian forces have already knocked out half of Yandex’s data centers?
At least. Three of the company’s six major data centers have so far escaped attack: another one in the Vladimir region and one each in Ivanteyevka and Mytishchi, near Moscow.
Yandex has acknowledged that its cloud data storage platform, Yandex Cloud, switched to emergency mode after just the third strike on the company’s infrastructure. This means the company has “run out of spare capacity,” and “that’s a very bad sign,” Eldar Murtazin, lead analyst at Mobile Research Group, told Fontanka. Any further strike, whether on data centers already attacked or on those Ukrainian forces have yet to target, would clearly only deepen the crisis.
What should customers do?
Yandex advised them to arrange backup capacity with other providers: Selectel, K2Cloud, and VK Cloud. That means backing up their data and renting servers in competitors’ data centers.
Selectel has its own data centers in Moscow and St. Petersburg, as well as a partner facility in Novosibirsk. K2Cloud lists three availability zones in Moscow and one in St. Petersburg on its website. VK Cloud has four availability zones in Russia and another two in Kazakhstan.
Incidentally, Yandex also set up its own server infrastructure in Kazakhstan back in 2024.
Actually, wouldn’t it be easier for Russians to send their data somewhere abroad, beyond the reach of Ukrainian drones?
In theory, that’s an option. But Russian companies are required to store certain data exclusively within Russia, so they have to choose among Russian data centers.
Under the Yarovaya laws, for example, telecom operators must store all user traffic from the past six months and all its metadata from the past three years inside the country. All companies are prohibited from storing customers’ personal data outside Russia.
Federal Law “On Communications”
Article 64. Obligations of telecom operators and restrictions on the rights of telecom service users during law-enforcement investigative operations, measures to ensure the security of the Russian Federation, investigative procedures, the detention of criminal suspects and defendants, and the enforcement of prison sentences
1. Telecom operators must store the following within the Russian Federation:
1) Information about the receipt, transmission, delivery, and/or processing of telecom service users’ voice communications, text messages, images, sounds, video messages, or other messages — for three years after these activities have concluded;
2) Telecom service users’ text messages, voice communications, images, sounds, video messages, and other messages — for up to six months after their receipt, transmission, delivery, and/or processing has concluded. The Government of the Russian Federation shall establish the procedures, retention periods, and volume of information to be stored under this subparagraph.
Federal Law “On Personal Data”
Article 18. Obligations of data controllers when collecting personal data
5. When collecting personal data, including through the internet, data controllers are prohibited from using databases located outside the Russian Federation to record, organize, accumulate, store, correct (update or modify), or retrieve personal data belonging to citizens of the Russian Federation, except in the cases specified in paragraphs 2, 3, 4, and 8 of Part 1 of Article 6 of this Federal Law.
VK’s and Yandex’s infrastructure in Kazakhstan can only handle data relating to customers in that neighboring country.
This restriction doesn’t apply to ordinary users, however. So you could try switching from Yandex Disk to Google Drive. That comes with a different risk, though: Russian authorities could try to block these foreign services at any time, without explanation.
Related reading
Why didn’t anyone think about the risk of strikes on data centers sooner? Didn’t the attacks on online marketplaces teach them anything?
We don’t know why Yandex, specifically, didn’t pay enough attention to protecting its infrastructure. But the data storage industry certainly studied what happened to online marketplaces.
- First, data centers are just as easy a target for drones as marketplace warehouses: They, too, are poorly protected stationary facilities at known locations, packed with expensive equipment. Attacks on them can cause losses across Russia’s economy and make people more inclined to protest.
- Second, Russia’s armed forces themselves gave Ukrainian forces a reason to target data centers. The Russian military had been striking the same kinds of facilities in Ukraine over the preceding month, even mockingly calling it a “digital detox” on the Defense Ministry’s Telegram channel. It seems naive to have expected Kyiv to pass up a chance to respond in kind.
- Third, there is concrete evidence that people were discussing the need to protect Russian data centers. According to BBC News Russian, just a couple of days before the first strike on a Yandex data center, Russian Deputy Digital Development Minister Yevgeny Filatov said these facilities needed to be distributed across locations deeper inside Russia, “somewhere beyond the Urals, where, fortunately, the strikes haven’t reached yet.” Some companies, including VK, MegaFon, and Rosatom, were buying protective frames and netting for data centers, purchasing drone detectors, and designing shelters for employees. On October 12, Digital Development Minister Maksut Shadayev said his ministry was “working with the Defense Ministry to arrange protection” for data centers.
Great timing! And it’s not just Yandex’s services that are down. What happened to the rest of the Russian internet?
As we said above, Yandex’s data centers are very popular. The company uses them for its own services and also actively rents out computing capacity and disk space for data storage. Companies without a backup plan to switch quickly to other servers and recover inaccessible data were unable to operate normally for a time. It’s still hard to predict which companies will be unable to recover from the strikes on Yandex’s infrastructure and whose data will never be restored.
Because of this, services many Russians rely on and their favorite websites have been down for four days now. When will everything finally be fixed?
We don’t know. A source in the IT industry told Kommersant that much will depend on how quickly Yandex can find equipment to replace its damaged infrastructure. Delivery times for this equipment can currently be as long as six months, the source said. Amazon’s experience in the Middle East, described above, gives little reason for optimism either: A full recovery will probably take months in any event.
Further reading
And everyone’s losing money in the meantime!
That’s right. ComNews Group CEO Leonid Konik told Vedomosti that Yandex’s own losses could be as high as a day’s revenue if all its services were down everywhere at the same time. That would amount to about 4 billion rubles a day. The actual figure is “much lower,” since the outages were only partial. Still, including the losses of dozens of other major companies, the combined damage runs to billions of rubles a day.
One last thing: let’s explore what how a real catastrophe might occur
As we said above, Ukrainian forces could try to disable Yandex’s remaining major data centers. If that happens, the company may be unable to repair its infrastructure without moving at least some of its capacity to competitors’ facilities.
The Ukrainian military could also start destroying other Russian companies’ data centers. We’ve already seen something similar with online marketplaces: Initially, only Wildberries warehouses were targeted, but drones later began striking Ozon logistics centers as well.
If events unfold this way, Russia’s IT industry faces a major setback. Rebuilding these data centers is slow and expensive. New facilities will also have to be built with potential drone attacks in mind. That could mean acquiring reliable air defenses, using underground protective structures (bunkers), or building several small data centers in different locations instead of one large one. According to BBC News Russian, manufacturers of mobile data centers the size of a standard shipping container are among the beneficiaries of the Ukrainian attacks. These could be a solution for some organizations, but they are unlikely to replace Yandex’s data centers fully.
At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.
If you find any errors in this translation, please contact us at reports@meduza.io.
To read Meduza’s exclusive content in English, please subscribe to our newsletter.