How Drone Strikes on Yandex Exposed Russia's Internet Fragility
Three Ukrainian drone attacks on Yandex data centers shut down much of Russia's internet for days. The crisis reveals how dangerously concentrated digital infrastructure has become — and why rebuilding will take months.
Three strikes brought down a country’s internet. What happened next matters more than the outages themselves.
On October 11, Ukrainian drones hit a Yandex data center in Russia’s Vladimir region. It was the third major facility targeted in four days — following strikes on sites in Sasovo and Kaluga. By the end of the day, millions of Russians couldn’t call a taxi, pay for groceries, check email, or access nearly any website that didn’t have an immediate fallback.
This was not a cyberattack. There was no sophisticated code inserted into Russian servers. A small military force from another country physically destroyed critical infrastructure, and the knock-on effects rippled across an entire national internet ecosystem.
The implications extend far beyond Russia.
The concentration problem
Yandex operates six major data centers in European Russia. Three have now been struck. Two were shut down entirely. The remaining three are either carrying unsustainable load or sitting idle because Yandex has exhausted its ability to redistribute capacity across its own network.
When Yandex’s cloud platform switched to emergency mode after the third strike, the company admitted something stark: it had run out of spare capacity. Any further attack would deepen the crisis.
This is the same vulnerability that plagued Amazon during Iranian strikes on Middle Eastern data centers earlier in 2026. Six months later, Amazon was still recovering data from certain availability zones. Yandex’s situation is structurally similar — except that Russia has fewer alternative providers, stricter data localization laws, and far less redundancy built into its digital economy.
The concentration risk is the real story here. Yandex’s data centers serve not only its own services — Yandex Go, Yandex Eats, Yandex Pay, Alice — but also CIAN, Sports.ru, Magnit, Vkusno i Tochka, and dozens of banks and retailers that store their data on Yandex Cloud. When one provider hosts too much of an economy, a single physical attack becomes a systemic event.
Who wins, who loses, and what comes next
Ukraine has demonstrated something that few analysts fully appreciated before these strikes: drone swarms can cripple cloud infrastructure. This is not theoretical anymore.
The winners from Russia’s perspective are the few competitors Yandex is now telling customers to back up onto. Selectel, K2Cloud, and VK Cloud are all advertising emergency capacity. VK already operates infrastructure in Kazakhstan, as does Yandex itself since 2024 — though that Kazakh capacity can only serve customers located in Kazakhstan, not Russia.
Manufacturers of mobile data centers — the container-sized, rapidly deployable alternatives — are seeing demand surge. BBC News Russian reported that these smaller facilities cannot replace Yandex’s massive central hubs, but they may become the new standard for organizations willing to accept the trade-offs.
The losers are everyone who depends on services that cannot recover quickly. Financial estimates from ComNews Group CEO Leonid Konik put Yandex’s losses at roughly 4 billion rubles per day if all services were fully down. That figure is lower in practice because outages were partial, but combined with losses across dozens of other companies, the daily total runs into billions. Customers who lose data permanently will never recover it.
The legal trap
Russian companies cannot simply move their data offshore to escape the threat. Federal Law “On Personal Data” prohibits storing Russian citizens’ personal information in databases outside Russia, with narrow exceptions. The Yarovaya laws impose similar restrictions on telecom operators, requiring six months of stored traffic and three years of metadata retention within the country.
This creates a contradiction: the same laws designed to protect Russian digital sovereignty make the country’s internet infrastructure vulnerable to targeted strikes. Offshore options exist but are legally unavailable to most businesses. Domestic options are concentrated and increasingly targets.
Ordinary Russians can sidestep the restriction by switching to Google Drive or similar foreign services — but those services could be blocked overnight by Russian authorities without explanation.
The warning that came too late
Just days before the first Yandex data center was hit, Deputy Digital Development Minister Yevgeny Filatov told BBC News Russian that data centers needed to be distributed deeper inside Russia, “somewhere beyond the Urals, where, fortunately, the strikes haven’t reached yet.” Companies including VK, MegaFon, and Rosatom were reportedly purchasing protective frames, drone detectors, and designing shelters. On October 12, Digital Development Minister Maksut Shadayev said his ministry was coordinating with the Defense Ministry on data center protection.
The timing is notable. Russian forces had been striking Ukrainian data centers and logistics facilities throughout September, even mockingly labeling it a “digital detox” on the Defense Ministry’s Telegram channel. Ukraine clearly saw an opportunity to respond in kind — and the open-source evidence suggests it was a rational calculation, not a reckless escalation.
Wildberries warehouses were struck first. Then Ozon logistics centers followed. The pattern is hard to mistake: this is hybrid warfare adapting in real time.
How long will the recovery take?
No one knows for certain. An IT industry source told Kommersant that equipment replacement timelines could stretch to six months. Amazon’s Middle East experience suggests that number is realistic at minimum, possibly long.
The question is not just whether Yandex can rebuild its data centers but whether the model itself survives. If future attacks target the remaining three facilities — or shift to other providers’ infrastructure — the entire architecture may need redesigning: smaller distributed sites instead of megasites, underground facilities, robust air defense integration.
This will cost money and time. It will slow innovation. It will make Russian digital services more expensive and less reliable. And it will set a precedent for every other country watching closely.
The strikes did not just disable services for a few days. They exposed a structural weakness that was there all along — waiting for the right weapon, at the right moment, to make it visible.