Ukraine Targets Yandex Data Centers in Russia, Triggering Emergency Cloud Mode

Ukrainian forces executed physical strikes on Russian infrastructure, disabling key Yandex data centers and forcing the cloud provider into emergency operations. The attacks required no digital exploit, relying instead on kinetic impact to sever power and connectivity. This approach bypassed traditional cybersecurity defenses, demonstrating that physical resilience is a critical component of service availability for managed service providers overseeing critical infrastructure.

How it unfolded

• On the night of October 7, drones struck the Sasovo facility, causing serious damage and halting operations.
• On the morning of October 9, the Kaluga data center was attacked, knocking out part of its infrastructure.
• On the night of October 11, a strike on the Vladimir facility shut it down, triggering emergency mode.

Who is affected

Yandex Cloud advised customers to activate their own disaster recovery plans after the Vladimir strike, citing unstable resource configurations. The outages disrupted shopping and taxi applications in major Russian cities. According to Reuters, Sasovo houses two of the three supercomputers Yandex uses for AI development. A Cloudflare report noted that online bot traffic migrated to other hosts rather than disappearing entirely.

View the original post on X

The fix

Yandex stated that engineers are continuing recovery efforts and that the platform remains operational in a limited mode. The company did not disclose whether any customer data stored in the damaged facilities was permanently lost. No software patch or configuration update was mentioned as a remedy for the physical damage sustained by the hardware and power infrastructure.

What made it possible

Physical infrastructure attacks bypass network security controls entirely, targeting the foundational hardware required for service continuity. Teams usually assess geographic risk when selecting data center locations to mitigate such kinetic threats. Check whether existing disaster recovery plans account for total site loss rather than just logical failure. Ensure that critical workloads are distributed across geographically distant facilities to maintain availability when one location suffers catastrophic physical damage or power loss.

Background: Disaster recovery plans

The incident commander or designated recovery lead holds sole responsibility for activating the disaster recovery plan. This single point of authority prevents decision paralysis. Teams must pre-assign this role and define clear triggers, such as data loss severity or service duration, to ensure immediate execution without debate during a crisis.

Read the full guide: Who Is Responsible for Activating the Disaster Recovery Plan?

What to do and how to stay safe: Yandex

• Review disaster recovery plans to ensure they address total site unavailability due to physical destruction.
• Verify that critical workloads are replicated across geographically diverse data centers to maintain service continuity.
• Monitor vendor status pages for emergency mode declarations and follow their guidance on alternative recovery paths.
• Assess supply chain dependencies to identify single points of failure in physical infrastructure providers.

Step-by-step guide: Difference Between Cyber Espionage and Cyber Warfare: How to Tell

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Yandex data centers were hit by drones?

Facilities in Sasovo, Vladimir, and Kaluga were struck, with Sasovo and Vladimir shutting down completely.

Did any employees get hurt in the attacks?

Yandex stated that none of its employees were hurt during the strikes on its data centers.

Is any customer data lost?

The company did not disclose whether any customer data stored in the damaged centers was lost for good.