The attack on Yandex's data centers is a lesson for every company in the cloud

Damage to three facilities of a single provider was enough to knock out more than 80 services in Russia, from search to banking. War is an extreme scenario, but an outage unfolds similarly during a fire or a widespread power failure, so it concerns every company in the cloud.

Three facilities, dozens of services

Between October 8 and 11, Ukrainian drones struck three Yandex data centers. It is one of Russia's largest internet companies, and its search engine has about 70 percent of the market in Russia. The facilities in Sasovo (Ryazan Oblast) and Vladimir stopped operating completely. The center in Kaluga was also damaged, one of the largest in the country, with a capacity of 63 MW and more than 3,800 server racks. According to local authorities in Kaluga, nine people were injured.

The effects quickly spread beyond the buildings. More than 80 Yandex services had problems, and Tom's Hardware, cited by Spider's Web, counted at least 84. The search engine, ride-hailing, food delivery, e-commerce, payments, email, maps, and the Yandex Cloud platform failed. On October 8, Downdetector recorded more than 1,300 reports concerning Yandex Cloud as well as the office tools Yandex Documents and Yandex Tables. Russian Railways, operator MegaFon, T-Bank, and classifieds service Avito were also affected, among others. Disruptions were even recorded in Kazakhstan.

The strikes were a response to the Russian campaign against Ukrainian data centers and telecommunications networks. Since the end of September, Russia has damaged the infrastructure of at least eight Ukrainian companies, and one of the attacks cut off internet access for about 100,000 households in Kyiv. For companies outside the conflict zone, however, the course of the outage itself is more important than the wartime context. A fire, flood, or prolonged power outage triggers the same chain of consequences.

Centralization was an advantage until it became a weak point

For years, Yandex built a convenient ecosystem: one company, one account, dozens of services on shared infrastructure concentrated in a few large hubs. The Russian military blogger writing as Ratio Militaris, whose posts were translated by researcher ChrisO_wiki and cited by Ars Technica, assessed that this very hyper-centralization, both market and technical, turned Yandex's advantage into a weak link.

Ukraine is the opposite example. Its digital services rely on smaller, distributed data centers. Some of the equipment was moved underground or abroad, and AWS (Amazon's cloud) stores more than 15 petabytes of data from more than 60 Ukrainian government institutions. According to the Russian blogger Artjockey, also translated by ChrisO_wiki, Russian companies are hindered from making a similar move by, among other things, the 2019 law on the “sovereign internet.”

For a company that will never be a drone target, the conclusion is simple. Concentrating infrastructure lowers costs and simplifies management, but it means a single physical event hits everything at once.

The lesson from Bahrain: a few zones are not always enough

For customers of Western clouds, the AWS case is more instructive. On March 2, drones damaged two of the three availability zones of the AWS region in the United Arab Emirates (UAE) and a facility in Bahrain. An availability zone is one or more physically separate data centers within a single cloud region. Spreading systems across multiple zones (so-called multi-AZ) is a standard safeguard against hardware or power failures.

In September, almost half a year after the attacks, AWS admitted it would not recover resources stored exclusively in the Bahrain region or exclusively in the mec1-az2 zone in the UAE. According to the company, the damage “exceeded the resilience designed for regional services and multi-AZ solutions.” AWS encourages customers to restore systems from backups stored outside the affected region. Those who did not have such backups lost access to their data.

Recovery takes months, not hours

Yandex did not provide a date for restoring the facilities. It advised customers to launch their own disaster recovery procedures, offered replacement servers, and reached agreements with three Russian cloud providers: Selectel, K2Cloud, and VK Cloud. They are supposed to help transfer customers' data and services.

Unofficial estimates of the recovery time vary because they refer to different things. A source for the daily “Kommersant” speaks of up to six months to replace hardware. Experts cited by ITwiz estimate that rebuilding full computing capacity for AI may take until 2028, because sanctions block the official purchase of Nvidia chips. Building a new data center from scratch costs around 6-7 billion rubles.

For the customer, one thing follows from this. An emergency plan that assumes the provider will be back after a few hours does not cover the most serious scenarios. And the advice to launch your own recovery procedures helps only those who have them and have tested them.

Questions for the cloud and SaaS provider

Most companies do not maintain their own servers; they buy software in the SaaS model (subscription-based services available through a browser). That makes it even more important to know what is underneath. When renewing a contract or reviewing risk, we should ask the provider a few questions:

• In which regions and zones is our data stored, and are copies kept outside the region?
• How quickly, and to what point, will you restore data after the loss of an entire region?
• When did you last test recovery, and what was the result?
• Can we export the data at any time in an open format?
• On whose infrastructure does the service run, and what happens if that subcontractor fails?
• Which functions work offline or in emergency mode?

A manager should ask the same questions inside their own company: which processes will stop if one service disappears for a week, and whether a copy of critical data exists outside the same provider.

Resilience costs money, so it must be calculated

This does not mean every company must immediately spread systems across several providers (multi-cloud). Deloitte points out that some organizations consciously stay with a single provider after analysis, because the complexity of multiple environments carries its own risks. What consultants do recommend is knowing where concentration lies, understanding dependencies between services, and regularly testing recovery plans.

In the financial sector, this is already an obligation. The EU's DORA regulation (Digital Operational Resilience Act), applicable since January 17, 2025, requires financial institutions to assess concentration risk at ICT providers (information and communications technology). For other companies, it is a good model.

A sensible minimum is a copy of critical data outside the main provider's region, a tested recovery procedure, and a written list of processes that must work even without the cloud. Such a set costs less than a week of downtime and is also useful when the cause of the outage is an ordinary power failure rather than a drone.