Having previously attacked each other’s energy infrastructure and ships in the Black Sea, Russia and Ukraine now have each other’s data centers in their sights. In September, the Russian Defense Ministry announced it had bombed Ukraine’s Omega Telecom and Kyivstar data centers, followed by a strike against a Tenet data center in Odesa on October 11. In response, Ukraine has targeted data centers belonging to the Russian internet giant Yandex in three different regions of Russia, as well as another belonging to the state-owned bank Sberbank.

While in Ukraine the attacks resulted in the temporary loss of internet access for customers of several internet providers (about 100,000 households), in Russia the fallout was greater. Almost half of Yandex’s infrastructure went down, causing problems for dozens of major companies using Yandex Cloud, Yandex Pay, and other services.

Yandex had to arrange for other cloud providers to host its clients’ resources. The company warned it was not certain whether its systems could be restored, which could have serious implications given that Yandex only has six data centers (according to publicly available information, at least), and that all three of its supercomputers were located in two of the attacked centers.

One reason why the consequences were more serious in Russia is that the two countries have fundamentally different approaches to the location and protection of digital infrastructure. After the start of the full-scale invasion, the Ukrainian government relocated its internet servers and critical data abroad. Private companies followed suit. Following the recent attacks on data centers, the Ukrainian authorities said they were considering moving computing capacity underground and abroad.

For the last decade, Russia has taken the opposite approach and insisted on keeping everything on its own territory. In 2015, the country passed a law that requires all services that process the personal data of Russian citizens to keep that data on servers inside the country. 

By 2019, state rhetoric about a “sovereign Runet” (Russian internet) was gaining momentum, and corresponding legislation was brought in mandating centralized control of the country’s internet infrastructure by the state communications agency, Roskomnadzor. Russia also created a national Domain Name System (DNS) with its own copies of root DNS servers: Russia’s Security Council had long viewed root DNS controlled by the U.S.-based Internet Corporation for Assigned Names and Numbers (ICANN) as a threat. 

Roskomnadzor had issued a recommendation for companies to host their websites on domestic providers as early as 2014. In 2017, that message was reiterated with some force when many Russian sites found themselves collateral damage in Roskomnadzor’s attempt to block the Telegram messaging service. During the communication watchdog’s ultimately unsuccessful campaign, it ordered the blocking of millions of IP addresses used by Amazon Web Services (AWS), DigitalOcean, and other cloud services.

After the start of the full-scale war against Ukraine, Roskomnadzor began blocking access to certain foreign services such as Cloudflare and AWS, and again advised owners of internet resources to stop using them. Russia’s digital development minister went as far as to propose banning big businesses outright from using foreign cloud services.

Russia’s digital isolation was further exacerbated by the response of foreign companies to Russia’s full-scale invasion of Ukraine and the first international sanctions, after which Microsoft Azure, AWS, and Google Cloud limited their dealings with companies from Russia. Meanwhile, Yandex’s data center in Mäntsälä, Finland, had its power supply cut off by the local energy company following the invasion. Such incidents only reinforced the Russian government’s push to locate all of Russia’s web resources inside the country.

Now that concentrated infrastructure is under attack, however, it is clear how vulnerable the battle for a “sovereign internet” has made Russia: Half the data centers of a major IT company can be taken offline in just four days.

In August this year, internet services across Russia collapsed when the power went out at the MMTS-9 telecom hub in Moscow, which houses the country’s biggest internet exchange point and the root DNS servers for the .ru domain.

The incident laid bare the fatal flaw in the state policy of a “sovereign internet”: Concentrating data and infrastructure within the country does not necessarily make them more secure, and digital autonomy does not equate to a protected network. That would require a broad geographical distribution of infrastructure, backup platforms, and the ability to swiftly relocate resources.

High concentrations of computing capacity and the dependence of many services on the same infrastructure platforms create the risk of cascading failures. All that was needed for Ukraine to disrupt the work of online marketplaces, electronic payment and accounting systems, taxi services, and smart home functions was to disable the infrastructure of a single cloud provider.

One of the most serious long-term consequences of the attacks, both for Yandex and for the Russian government, is the damage to the development of artificial intelligence. There is a chance that the strikes against data centers have damaged Yandex’s supercomputers, which will inevitably slow down work on training large language models, because it will be very difficult to replace that equipment.

All three of the company’s supercomputers were built using U.S. technology: AMD server processors and Nvidia A100 graphics accelerators. Those components are now hard to come by—even legally—due to a global deficit caused by the AI race, not to mention the difficulty of procuring them for a sanctioned country.

This is a significant blow to Russian AI. Despite government insistence that Russia remains a contender in the global AI race, the key developers of AI models in Russia—Yandex and Sberbank—were complaining of a severe computing capacity shortage even before the attacks. If Yandex has lost any of its supercomputer capacity at all, that gap will only become wider.

The attacks on data centers came soon after President Vladimir Putin signed a decree in August allowing the state to take temporary control over a company’s assets if they fail to protect critical facilities from drone attacks: criteria that could now apply to Yandex. Thinly veiled criticism has already been made of Yandex in the State Duma for not doing enough to protect its facilities, albeit without naming the company outright.

In reality, however, the state is unlikely to seize control of the company. So far, the Russian authorities have mainly used the temporary management mechanism to take control of the assets of foreign companies such as Danone, Carlsberg, Auchan, and Nestlé.

Yandex is in any case already controlled by people close to the Kremlin. Its founder, Arkady Volozh, who has spoken out against the war in Ukraine, quit the company in 2022, and its Russian operations were subsequently sold in 2024. A major stake in the company was bought by people linked to Bank Rossiya, which belongs to the oligarch and close Putin associate Yury Kovalchuk.

For Yandex, therefore, the decree is less of a real threat of a takeover than additional leverage over the company. It could be used to force the company to restore its full operating capacity faster, for example, or to invest in the security of its sites (at its own expense, naturally). But there is little risk of Yandex being appropriated by the “right people” anytime soon: They already own it.