Consequences of Ukrainian attacks on Yandex data centres

Between October 7 and 11, 2026, Ukrainian forces carried out drone attacks on Yandex data centres[1]. Three of the Russian tech giant’s six data centres (according to official figures) were targeted. In the days that followed, numerous reports—including some in Poland—suggested that the Ukrainian attacks had led to a decline in the intensity of Russian propaganda and disinformation efforts (such as those supporting the AfD in Germany or the MAGA movement in the U.S.). These claims were not substantiated; the activity of Russian bots and trolls did not decrease. However, the attacks did result in serious consequences of a different nature.

Reports on the curbing of Russian propaganda. Following Ukrainian attacks on Yandex data centers, many internet users, commentators, politicians, and others suggested that the intensity of pro-Russian propaganda—particularly on social media—had decreased. Infographics and charts were even circulated to support this claim; however, it later emerged that these had been generated by artificial intelligence. Organizations that monitor cyber threats, as well as Russian disinformation and propaganda, found no such reduction in pro-Russian online activity. Experts pointed out that the attacks had merely limited the activity of “crawlers”—bots used to index web pages for the search engine—rather than the automated accounts that spread disinformation on social media. Furthermore, it was noted that Russia’s “troll farms” rely on a different technological infrastructure, one entirely independent of Yandex.

The actual effects of the attacks. The attacks on Yandex have, in fact, led to serious consequences for Russia. Dozens of Yandex services experienced disruptions; some ceased to function entirely, while others operated significantly more slowly. These included Yandex Go (an equivalent to Bolt), Yandex Pay (an equivalent to Google Pay), Yandex Music, the AI assistant Alice, the video conferencing service Telemost, email, Yandex Cloud services (such as the dating app Twinby), and numerous retail and food delivery services—affecting over 80 services in total.These issues affected not only Russia but also countries where services based on Yandex’s solutions and network infrastructure are popular—for example, Moldova, Uzbekistan, Kazakhstan, Armenia, and Belarus. The heavy reliance of other Russian technology entities on Yandex’s services triggered a domino effect, leading to the collapse of numerous other cloud services, networks, and platforms. Furthermore, the attack on data centres hindered the development potential of Russian artificial intelligence.

Conclusions. Ukrainian attacks on Russian data centres were a response to similar actions taken by Russia against Ukraine’s digital infrastructure. However, their significance extends beyond reciprocal strikes on an adversary’s technological backbone. They demonstrate that the infrastructure underpinning the functioning of society and the economy—both of which are increasingly dependent on digital services—has become a new front in modern warfare. By decentralizing its infrastructure and relocating parts of it abroad, Ukraine has proven less vulnerable to such attacks. In contrast, nearly 80% of Russia’s data centres are located in or around Moscow, which increases their susceptibility to strikes by Ukrainian drones. It should be noted that in October, attacks were directed not only at Yandex’s infrastructure but also at the data centres of the VK group (which operates, among other things, the social network VKontakte and the messaging app Max) and those of Sberbank, Russia’s largest financial institution.

The attacks have exposed weaknesses in the Russian model of digital infrastructure development. The decade-long effort to build a “sovereign internet” (Runet)—which entails keeping infrastructure and data within Russian territory and subjecting them to state control—was intended to increase independence from foreign solutions. In practice, however, it has led to a concentration of resources and the creation of interdependencies between various services and technology entities. Disruptions in Yandex’s operations triggered a domino effect that also affected numerous services provided by other companies. In this way, an attempt to bolster digital sovereignty simultaneously exposed the vulnerability of the Russian system to strikes against its key components. Consolidating many services under a single provider has left the functioning of the entire Russian economic ecosystem exposed to risk.

The consequences of the attacks may be felt in Russia for a long time. Restoring full-service functionality will require both time and significant financial investment. Further complicating matters are the sanctions, which have limited the availability of Western components and technologies used in the construction and equipping of data centres. The disruptions affect not only individual users but also businesses—particularly in large cities—and may lead to an increase in the cost of services. In the long term, these technical issues could also weaken Yandex’s market position in countries where its solutions are popular.

However, there is no confirmation that the attacks led to a reduction in Russian propaganda and disinformation on social media. Any decline in the activity of certain accounts may have been temporary and the result of technical disruptions; it did not, however, signify the dismantling of the infrastructure behind Russian information operations. Significantly, the very reports claiming that this propaganda had weakened turned out to be an instance of disinformation itself. It is also worth noting that AI will become an increasingly important tool for creating and lending credibility to false content.

Ukraine has announced that it will continue these operations, the results of which can be considered a significant operational success. However, this should not be equated with a weakening of Russian information operations. The significance of these attacks lies primarily in exposing the vulnerabilities of Russia’s digital infrastructure, imposing tangible economic and technological costs, and demonstrating that, in the context of modern conflict, digital infrastructure has become a target just as critical as other components of a state’s support system.

This issue has broader implications for the security of Western nations, which must also account for the risk of attacks on digital infrastructure. The reciprocal strikes between Russia and Ukraine are not the only example of this type of warfare. In March and April 2026, Iran launched drone attacks against Amazon Web Services (AWS) data centres in Bahrain and the United Arab Emirates. This led to the suspension of Amazon’s operations in the region and caused disruptions to banking services and digital infrastructure reliant on the AWS cloud. Six months later, the company acknowledged that a significant number of resources and data had been irretrievably lost.

Digital infrastructure—increasingly vital to the functioning of states, their economies, societies, and military capabilities—will be a target for attacks, as striking it can yield strictly military advantages while simultaneously undermining societal resilience by disrupting civilian services. The case of Russia demonstrates that attempting to build digital sovereignty through the isolation and centralization of infrastructure is a mistake.

[1] The largest Russian technology company, which, following ownership restructuring forced by Western sanctions, has been de facto state-controlled since 2024. Much like Google, it offers a wide range of services, including a search engine, email, maps, navigation, a payment system, an AI assistant, cloud services, and more.

[Photo Anastasia Barashkova / Reuters / Forum]