Over four days in October 2026, Ukrainian drones hit three data centers belonging to Yandex, Russia’s largest technology company, in what NBC News reported as the first major attack of the war on Russian cloud infrastructure. A facility in Ryazan region was struck overnight on 7–8 October, a second in Kaluga followed around 9 October, and a third in Vladimir was hit overnight on 11 October — the one Yandex itself described as leaving operations “completely suspended.” By the time the third strike landed, Yandex Cloud was telling its own customers to activate their disaster recovery plans, because the platform they were depending on no longer could.
Three sites, one company’s “iron heart”
Yandex runs Russia’s largest search engine, its biggest ride-hailing and food-delivery apps, a cloud computing division used by major Russian retailers, and YandexGPT, one of the country’s leading generative AI models. The three facilities hit — Sasovo in Ryazan region, a site in Kaluga, and one in Vladimir — aren’t peripheral infrastructure; Yandex described them as the company’s “iron heart,” the physical plant behind services used by millions of people daily and hundreds of thousands of businesses. The Sasovo site alone reportedly housed two of the three supercomputers Yandex uses to train its AI models.
That concentration is exactly what made three strikes in four days possible as a single campaign rather than three unrelated incidents. Hitting a handful of named, geographically identifiable buildings was enough to reach a meaningful share of one of Russia’s largest technology companies — a vulnerability that has nothing to do with Yandex’s software and everything to do with how much of its capacity sits in a small number of physical locations.
What “emergency mode” actually meant for customers
Yandex’s own language tracked the severity of each strike. After Kaluga, the company said “several data center modules are completely disabled.” After Vladimir, it went further: operations “completely suspended,” with the remaining capacity “considered unstable.” On 11 October, Yandex Cloud told customers directly to switch to “any available alternative disaster recovery plans” and warned that support channels themselves might be unreliable — an unusual admission that the company couldn’t fully guarantee even its own crisis-response channel.
The practical fallout, as reported across Russian and Western outlets, reached more than 80 Yandex Cloud services: compute, databases, storage, the YandexGPT API, the Alice voice assistant, Yandex Music, Telemost video conferencing, and smart-home controls. Downstream, retailers and chains running on Yandex Cloud — including the grocery chain Magnit, fast-food operator Vkusno i Tochka, and electronics retailer M.Video — reported disruptions, as did users in Kazakhstan, Kyrgyzstan, Uzbekistan and Armenia, where Yandex services extend well beyond Russia’s own borders. Yandex’s fintech division moved quickly to head off a panic specific to financial services, with its CEO stating that customer funds were never at risk because “the money itself isn’t stored in the data center” — a distinction that mattered for deposits, even as the payment app built on top of that money sat offline.
The physical damage behind the outage
This wasn’t purely a network event. The Vladimir regional governor said the strike there started a fire and knocked out two electrical substations supplying 5,000 residents, who had to be evacuated from the immediate area. Russian reporting cited nine people injured in the Kaluga strike and roughly 1,600 customers losing power in Vladimir region as a direct result of the attack on the facility, not as a side effect of the cloud outage itself. That’s the detail that separates this from an ordinary outage post-mortem: the fix here isn’t a failover script or a configuration rollback, it’s structural and electrical repair to buildings that were set on fire, on a timeline Yandex didn’t control and couldn’t accelerate with engineering effort alone.
A declared tit-for-tat, not a covert operation
Ukrainian President Volodymyr Zelensky was explicit that the strikes were retaliatory, telling reporters Ukraine responds to Russian strikes on its own data centers “in mirror-like fashion.” Russia had struck Ukrainian data centers in September, with Russian officials claiming — without public evidence cited in Western reporting — that those facilities supported Ukrainian military intelligence. Whatever the merits of that claim, the exchange establishes data centers as a declared, acknowledged target category in this war, on both sides, rather than infrastructure incidentally caught in a broader campaign.
One side effect went viral faster than it could be verified: posts citing Cloudflare Radar data claimed bot and troll-farm activity tied to Russia dropped sharply after the strikes, with some suggesting a direct causal link to disrupted disinformation operations. Ilya Lozovsky of the Organized Crime and Corruption Reporting Project pushed back specifically on that reading, noting the cited metric measures search-engine request volume, not social-media bot activity, and that accompanying charts had no sourcing and visible errors. The outage was real and well-documented; the specific claim that it silenced Russian influence operations was not something the data actually being cited could support.
The lessons that generalise
Physical concentration is an availability risk regardless of how good the software is. Yandex’s cloud architecture, redundancy design and failover tooling are irrelevant once the buildings housing the hardware are on fire. The October 2025 AWS outage showed how a single region’s software failure can cascade across dependent services; this is the physical-world version of the same lesson — a small number of named, locatable facilities is a single point of failure no matter how resilient the code running inside them is.
“Switch to your disaster recovery plan” is a real instruction only if customers built one in advance. Yandex telling customers to activate alternative DR plans mid-crisis assumes those plans already exist, tested, and don’t themselves depend on the same provider. Many customers almost certainly discovered in real time whether that assumption held.
A cloud provider’s blast radius extends past its own customer list. Grocery chains, electronics retailers, and users in four other countries felt this outage because Yandex Cloud sits underneath infrastructure that has nothing to do with Russia’s war — a reminder that concentrated dependence on one provider exports that provider’s risk to everyone downstream of it, war or no war.
Viral claims attached to a real event deserve the same scrutiny as the event itself. The data center strikes were confirmed, documented and substantial. The bot-farm-silencing narrative layered on top of them, by contrast, rested on a metric that measured something else entirely — a reminder that a real, well-sourced story and an appealing but unsupported inference about its consequences can travel at the same speed on social media.
Tech-Bee is an independent technology publication. This piece is drawn from reporting by NBC News, Al Jazeera, The Moscow Times and Help Net Security on the October 2026 drone strikes against Yandex’s data center infrastructure in Russia.