- 404 Media reports four Ukrainian strikes on Russian data centers in a week. Three hit Yandex and took two of its six sites offline, disrupting email, taxi apps and freight paperwork.
- Many data centers serve civilian and military users together, and the law on targeting them is unsettled, according to researcher Klaudia Klonowska.
- Leaders should map which critical services depend on one provider's buildings, and test a second site and separate backups.
The building is part of the service
Most of us think of the cloud as software. A taxi app, an email account and a shipping record all feel weightless. The recent strikes on Russian data centers show the other side. Each of those services runs inside a physical building. Buildings can be hit.
This is WebPulse's view: where your provider keeps its machines is now a business risk, not just a technical detail. The people who feel a loss first are rarely the target. They are the customers.
What happened
404 Media reports that Ukrainian drones hit what it calls Russia's largest data center on Wednesday. It was the fourth Ukrainian strike on Russian data centers in a week.
Three of the strikes hit Yandex, a Russian technology company that 404 Media calls Russia's Google-equivalent. They also damaged supercomputers that held some of its AI models. The fourth hit a data center run by Sberbank, Russia's largest bank. 404 Media says it is too early to judge the effect of that one.
Ukraine's president, Volodymyr Zelenskyy, acknowledged the attacks in a post on X. He named data centers and oil refineries together and called the campaign a "symmetrical response" to Russian aggression.
How one company's outage reaches so many people
404 Media describes Yandex as part of daily life in Russia. Its products range from payments and email to taxi and bus apps, plus an app store and dating services. The company runs six data centers in Russia. The strikes took two of them fully offline.
404 Media says people lost access to their email. Some data seems to be gone. Taxi and bus apps work only some of the time.
The researcher ChrisO_wiki, who is anonymous and translates Russian social media posts, has tracked the impact on ordinary people. ChrisO_wiki described a taxi driver in Yekaterinburg who can no longer see an order history. Trip statuses reach the driver late.
ChrisO_wiki also described harm to commercial logistics. Businesses that use electronic document management cannot register incoming goods. In ChrisO_wiki's words, this is severely affecting manufacturers and distributors.
The sources do not say how Yandex built its systems. They do not explain why two lost sites touched so many services. The pattern suggests a concentration problem. When many services run from a few buildings, losing some of them can hit everything at once. If backups and records, such as order histories, sit in those same buildings, there may be nothing to fall back on. 404 Media does not confirm that this happened here.
The wider point holds either way. When many services share one provider, that provider's outage can become everyone's outage.
One online rumor said the strikes had shut down Russian bot farms. 404 Media says that was not true. The damage fell on everyday users.
Not a one-off
404 Media places these strikes in a longer run. Russian forces have been hitting Ukrainian data centers for months. In March, Iran struck Amazon Web Services data centers in Dubai, knocking out digital infrastructure in the Middle East.
These are separate events in separate conflicts. Together they show that attackers have chosen data centers as targets more than once this year.
The legal line is blurry
Klaudia Klonowska studies emerging technology and international law. She told 404 Media that the law on attacking data centers is still developing.
Many data centers, perhaps most, serve civilian and military users at once. That makes it hard for an attacker to know who is using a building. She said that if a site handles only military data, it could be a lawful target. Retaliation alone, she added, does not make a site lawful.
She also asked a harder question. Why have militaries been allowed to use civilian commercial data centers? By relying on them, she said, they may have made those buildings military targets. She pointed to a French underground data center near Paris. France announced it as military-only.
There is a practical side for companies. If you share a provider with a government customer, you may share its risk. The law does not clearly settle that today.
Why this reaches beyond war zones
In Michigan, a township attorney has called a proposed data center a "high value target" in future wars. The site would be built in Ypsilanti Township by Los Alamos and the University of Michigan.
Los Alamos rejected that wording in a September letter. It said the term was created "without basis" and was not evidence of a known threat. It listed controlled access, cameras and on-site security staff.
That is one local dispute. It shows that where a data center sits is now a question for residents and executives alike.
Questions to put to your team
Ask which critical services run in one provider's facilities. Ask whether a second provider or region could carry your core work. Ask when you last tested that.
Ask whether your backups sit outside the provider that runs your main systems. Ask what staff can do if email and document systems fail together. The freight example shows the cost when paperwork cannot move.
Finally, ask your provider which of its sites serve government or military customers. Ask whether your contract says.
Data has been called the new oil. The strikes show that the places where it is processed can be targeted like refineries. The lesson for leaders is to know which buildings their business depends on.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: 404 Media.
