- The Record reports that drones struck three of Yandex's six Russian data centers in a week, disrupting cloud customers and consumer services.
- Yandex advised customers to plan recovery beyond its own cloud, and updated its terms to exclude liability for drone strikes and other attacks.
- Leaders should check whether backups share a provider with primary systems, and what contracts say about attack-related outages.
Backup protects you from bad luck. It does not protect you from a sustained attack on one operator. It also does not cover choices that provider makes for all its customers at once. The strikes on Yandex's data centers show where that line sits.
What happened
The Record reported that Ukrainian drones hit three Yandex data centers in Russia within about a week. The first strike came overnight on October 7-8 at Sasovo, in the Ryazan region. It started a fire, and Yandex shut the site.
On October 9, a strike damaged part of the Kaluga site. The third hit Vladimir overnight on Sunday. Yandex said the Vladimir site "has shut down completely, and the remaining infrastructure is unstable."
Two sites shut down completely, and a third was damaged. Together the three hold about 115 megawatts of capacity.
How one outage reaches so many people
Yandex Cloud rents computing power to other businesses. The Record says it had about 64,000 customers in mid-2026. That figure comes from Yandex's financial disclosures. Yandex has not said how many customers were affected.
The Record also lists more than a dozen outside services on Yandex infrastructure that were reportedly hit. They include retailers, internet providers, an online therapy service, fitness businesses and TikTok's Russian arm.
Here is our own point. Each of those services has customers of its own. Many of them may not know their supplier runs on Yandex. They face the outage without ever choosing the risk.
Russia's internet watchdog said users also struggled to read email, book taxis and order food. Payments through Yandex Pay were hit too. In some homes, the Alice voice assistant and smart devices stopped working.
What Yandex told its customers
After the third strike, Yandex advised customers to consider other recovery plans. It said they should not rely only on switching between parts of Yandex Cloud's own network.
The sources do not say how Yandex's sites are linked. They do not say whether moves between its sites failed. Yandex also said it is very difficult to give a timeline for restoring the equipment.
Russian state media reported that Yandex had made deals with rivals Selectel, K2Cloud and VK Cloud. The aim was to help affected customers move faster.
What multi-site backup does and does not cover
Several sites inside one provider guard against local trouble. A power cut, a fire or a bad update at one site is the typical case. The sites fail one at a time, so the others carry the load.
An attack on many sites of one operator is a different problem. So is any decision the provider makes for all customers at once. These risks sit above the sites. Adding more sites does not remove them.
That is the lesson for buyers. Count how many independent parties stand between you and a single point of failure. Sites inside one provider count as one.
The contract changed during the outage
On Saturday, Yandex updated its terms of service, according to The Record. The new terms exclude liability for missed obligations caused by drone strikes and other attacks. The Record notes this may limit customers' chances of compensation.
This shows who carries the cost. The provider can rewrite the terms. The customer who cannot take payments or run deliveries absorbs the loss. Your service agreement is part of your resilience plan. It can change under you.
Compute is concentrated, and the conflict runs both ways
Sasovo opened in 2014. The Record says it reportedly holds two of Yandex's three AI-training supercomputers. Vladimir hosts Galushkin, a supercomputer the report calls one of Russia's most powerful. Yandex has not said whether any supercomputer was damaged.
The strikes followed Russian attacks on Ukrainian facilities in late September. The Record says at least six Ukrainian data centers were damaged. Kyivstar and Ukrtelecom infrastructure was also hit.
Ukrainian officials said a September 23 strike cut fixed-line internet for about 100,000 households in and around Kyiv.
Moscow has claimed that Ukrainian data centers supported Ukraine's armed forces. President Zelensky acknowledged the attacks on Russian data centers. He described them as a response to Russian strikes.
Russia's digital minister said his ministry is working with the Defense Ministry on protecting the sites.
Questions to put to your team
First, which critical systems run on one provider? Do the backups sit with the same provider?
Second, which of our suppliers run on a single cloud? Have we asked them?
Third, can we move a key service to a second provider? When did we last test it?
Fourth, what do our contracts say about liability when physical sites are attacked? Can the provider change those terms without our consent?
Physical sites are part of your risk, not only software. A recovery plan that stays inside one provider covers a smaller problem than the one Yandex's customers just faced.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Ars Technica.
