Physical drone strikes on Yandex data centers disrupt Russian cloud and AI services
Ukrainian drone attacks on three Yandex facilities force emergency mode and raise concerns about data loss and AI training delays.
Key points
- Yandex confirmed drone strikes on data centers in Sasovo, Vladimir, and Kaluga, forcing the platform into emergency mode.
- The Sasovo facility, which houses AI supercomputers, was seriously damaged and stopped operating.
- Cloudflare reports that bot traffic associated with disinformation campaigns migrated to other hosts rather than disappearing.
Physical drone strikes on Yandex infrastructure have disrupted key Russian digital services and AI development capabilities. According to Help Net Security, Ukrainian forces targeted three data centers, forcing Yandex Cloud to operate in emergency mode. This incident highlights the vulnerability of centralized cloud infrastructure to kinetic attacks, a risk Sandbox Desk previously noted when AI training was halted after a strike on a supercomputer facility.
Which facilities were damaged and how?
Yandex confirmed that drones hit data centers in Sasovo, Vladimir, and Kaluga. The Sasovo facility in the Ryazan region was seriously damaged on the night of October 7 to 8 and ceased operations. The Kaluga site was attacked on the morning of October 9, with partial infrastructure knocked out. The Vladimir data center went offline following a strike on the night of October 11. Yandex stated that no employees were hurt in these incidents.
View the original post on X
How is Yandex responding to the outage?
On October 11, Yandex Cloud advised customers to switch to their own disaster recovery plans, noting that the remaining resource configuration was unstable. The company described its data centers as the "iron heart" powering services for millions of users and hundreds of thousands of businesses. Engineers are continuing recovery efforts, but technical support communication channels may remain unstable. The platform continues to operate in a limited mode.
What impact did this have on AI and other services?
The Sasovo facility houses two of the three supercomputers Yandex uses to develop its AI models, according to Help Net Security. The disruption affected shopping and taxi apps in major Russian cities. Additionally, Cloudflare reported that while online bot activity appeared disrupted, the traffic merely migrated to other hosts rather than vanishing. Yandex has not disclosed whether any customer data stored in the damaged centers was permanently lost.
What is the broader context of these attacks?
Ukrainian President Volodymyr Zelenskyy stated that the strikes were a response to Russian attacks on Ukrainian data centers, describing the action as mirror-like. Tom's Hardware notes that Russia has also targeted Ukrainian infrastructure, but Ukraine’s reliance on distributed cloud platforms like Amazon Web Services provides greater resilience. Russian attacks on Ukrainian centers have caused disruption, but services can often be migrated quickly to other locations.
What analysts watch for
Security teams usually monitor for sudden shifts in traffic patterns when physical infrastructure is compromised. Analysts examine whether compromised services are redirecting users to alternative endpoints, which may indicate a loss of integrity. It is critical to check if authentication mechanisms remain functional during failover events. Teams should verify that disaster recovery plans are tested and that data synchronization has not been interrupted. Monitoring for unexpected changes in API responses helps detect partial service degradation.
Background: Disaster recovery plans
Start by mapping critical systems and defining recovery time objectives. Build automated backups to isolated storage. Test restoration quarterly. Document procedures clearly. Assign specific roles. Update the plan after every infrastructure change. Verify success by measuring actual recovery speed against targets.
Read the full guide: How to Create Disaster Recovery Plan: The 7 Step Rollout
What to do and how to stay safe: Yandex
- Verify the status of your cloud provider's infrastructure and check for official service alerts.
- Test your own disaster recovery plans to ensure they function independently of the affected provider.
- Monitor your application logs for unusual latency or error rates that may indicate underlying instability.
- Ensure that critical data backups are stored in geographically diverse locations to mitigate physical risks.
General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the drone attacks cause permanent data loss for Yandex customers?
Yandex has not disclosed whether any customer data stored in the damaged data centers was lost permanently.
Were any Yandex employees injured in the drone strikes?
Yandex stated that none of its employees were hurt in the attacks on the three data centers.
How did Ukrainian officials justify the strikes on Yandex facilities?
President Volodymyr Zelenskyy said Ukraine was responding to Russian attacks on Ukrainian data centers in a mirror-like fashion.
