Russia's decade-long drive to keep all of its internet infrastructure on home soil has made it a sitting duck. Ukrainian drones have knocked out almost half of Yandex's capacity in only four days, causing chaos for everyone from taxi customers to firemen, according to an analysis from Carnegie Politika published on October 16.

"Concentrating data and infrastructure within the country does not necessarily make them more secure, and digital autonomy does not equate to a protected network," writes Maria Kolomychenko, special correspondent for The Bell. "Half the data centers of a major IT company can be taken offline in just four days.”

It started with oil refineries and then worked up to retail logistics hub. Now the two countries now have each other's data centres in the crosshairs – and that is a much bigger problem for Russia than it is for Ukraine. Russia keeps its data at home; Ukraine moved its offshore as soon as the war started.  

Russia's defence ministry said in September it had bombed the Omega Telecom and Kyivstar data centres, and it struck a Tenet data centre in Odesa on October 11. Ukraine has hit Yandex sites in three Russian regions and one belonging to state-owned Sberbank, which confirmed a drone attack on its Balakovo centre.

The damage was lopsided. In Ukraine, customers of several internet providers, about 100,000 households, temporarily lost access. In Russia, nearly half of Yandex's infrastructure went down, disrupting dozens of large companies that rely on Yandex Cloud, Yandex Pay and other services. Yandex Bank is also reported to be close to collapse.

Yandex had to move clients' resources to other cloud providers and has said it is not certain some of its systems can be restored at all; the company faces a minimum six-month wait to replace the destroyed sites. It runs only six publicly known data centres, and all three of its very expensive supercomputers were in two of the centres that were hit.

Kolomychenko traces the gap to opposite policies. After the full-scale invasion, Kyiv moved government servers and critical data abroad, and private companies followed. Moscow did the reverse. A 2015 law forced services handling Russian citizens' personal data to keep it on servers inside the country, and 2019 legislation on a "sovereign Runet" put the network under the central control of the regulator Roskomnadzor and created a national domain name system with its own copies of the root servers.

Roskomnadzor had been urging companies to host websites at home since 2014. Its failed attempt to block Telegram in 2017 cut off millions of IP addresses belonging to Amazon Web Services, DigitalOcean and other cloud providers, and after 2022 it blocked services such as Cloudflare and AWS. Western cloud companies limited dealings with Russian clients, and Yandex's data centre in Mantsala, Finland, lost its power supply after the invasion, which only strengthened the push to keep everything in Russia.

These weaknesses were already visible before the strikes began. In August, internet services across Russia collapsed when power failed at the MMTS-9 hub in Moscow, which houses the country's biggest internet exchange point and the root DNS servers for the .ru domain.

"All that was needed for Ukraine to disrupt the work of online marketplaces, electronic payment and accounting systems, taxi services, and smart home functions was to disable the infrastructure of a single cloud provider," Kolomychenko writes.

The longer-term cost may fall on artificial intelligence. Yandex's three supercomputers were built on US technology, AMD server processors and Nvidia A100 accelerators, which are scarce worldwide because of the AI race and harder still for a sanctioned country to buy. Yandex and Sberbank, Russia's main developers of AI models, were already complaining of a severe shortage of computing capacity before the attacks. "If Yandex has lost any of its supercomputer capacity at all, that gap will only become wider," she writes.

The strikes also expose Yandex to an August decree from President Vladimir Putin that lets the state take temporary control of a company's assets if it fails to protect critical facilities from drones, and Duma deputies have already hinted that the company did too little. Russian officials have since called for underground data centres.

Kolomychenko doubts a takeover. Founder Arkady Volozh, who is one of only two of Russia’s top businessmen to have publicly condemned the “barbaric war” with Ukraine, quit in 2022, the Russian business was sold in 2024 and a major stake went to people linked to Bank Rossiya, which belongs to Putin associate Yury Kovalchuk. The decree is leverage to make Yandex restore capacity faster or pay for its own protection, she argues. "There is little risk of Yandex being appropriated by the 'right people' anytime soon: They already own it.”