Drones hit two Yandex data centers, and a Kremlin decree sets terms for state management

Editor’s Note: Drones shut one Yandex data center and knocked part of a second out of service within two days this week. Yandex Cloud says a fire caused by the drone attack on its Sasovo site took down one of its availability zones, still down on Oct. 10.

For cybersecurity, data privacy, regulatory compliance and eDiscovery professionals, the strikes matter as much for custody as for combat. Russia’s Decree No. 604, signed in August, lets the government place the property of businesses that fail to secure or restore critical facilities under temporary state management, and its definition of covered entities reaches foreign controlling persons of Russian legal entities. The Institute for the Study of War reads the decree as setting conditions for nationalization, a reading Putin has rejected, and no source reviewed reports any step to apply it to Yandex. The same week brought Russian strikes on Kyiv data centers, a U.S. license for Russian diesel and Montenegro’s move to deport the Rybar founder.

Watch for any move to apply the decree to damaged digital infrastructure, for how long the affected Yandex zone stays down, and whether organizations with Russian-hosted data keep systems and backups beyond a single zone.

News Analysis – Geopolitics Beat

Drones hit two Yandex data centers, and a Kremlin decree sets terms for state management

ComplexDiscovery Staff

Yandex calls its data centers “the iron heart of Yandex,” and within two days this week drones shut one of them down and knocked part of a second out of service.

The company’s own cloud records trace what the first strike did to customers. Yandex Cloud’s incident notice says a fire caused by a drone attack on the Sasovo data center knocked out one of its availability zones, ru-central1-b, and an update early on Oct. 10 said the zone remained unavailable. The notice lists 32 cloud services as unavailable there. The other zones were working, Yandex said.

The strikes landed in a week when data infrastructure was under fire on both sides of the front. Washington eased one set of Russia sanctions on Oct. 9, while the Institute for the Study of War (ISW) assessed that other sanctions will very likely slow Yandex’s repairs. And a decree Russian President Vladimir Putin signed in August already lets his government place companies’ property under temporary state management when they fail to protect or restore critical facilities. For anyone who manages where data lives and who can reach it, a military story became a custody story.

Two strikes, and how each was attributed

The first strike came on the night of Oct. 7 to 8. Yandex said a drone attack seriously damaged its Sasovo data center, in Russia’s Ryazan region, and that the site was completely shut down. ISW, a Washington research group whose daily assessments rely on publicly available information, said geolocated footage showed fire at the site. Satellite imagery showed fire damage to the part of the building housing the data center, ISW said. In its Oct. 8 assessment, ISW said Ukrainian forces “may have” struck it.

The second strike hit Kaluga the next morning. Yandex said another of its data centers had been attacked there and that part of its infrastructure was out of service, adding that no employees were hurt at either site. Kaluga Governor Vladislav Shapsha said drones had attacked the region and injured nine people, without naming the facilities hit, according to Meduza and the Kyiv Post.

The most specific claim of responsibility in the sources reviewed came from a manufacturer rather than a ministry. Fire Point, a Ukrainian defense company, said Ukrainian forces struck Yandex’s biggest data center of five, a 63-megawatt site in Kaluga, and that it was the second Yandex facility targeted, according to ISW. ISW wrote that Fire Point’s account implied the Sasovo strike was Ukrainian too, and by Oct. 9 it described Kaluga as the second Ukrainian strike on a Yandex data center in two days. Yandex’s Oct. 9 statement on its English-language site refers only to a drone attack; ISW, citing the Russian state news agency TASS, said Yandex had attributed the Sasovo fire to a Ukrainian drone strike.

The disruption reached well beyond Yandex’s own apps. After the Sasovo strike, users reported problems with services that included Russian Railways and the telecom operator MegaFon, according to Meduza and the Kyiv Post. ISW, citing a 2021 Yandex announcement, said two supercomputers that Russia uses for neural network training, built on Western graphics and central processors, were located at Sasovo. Reuters reported that the site houses two of Yandex’s three supercomputers, according to DatacenterDynamics.

Kyiv’s data centers have been hit for weeks

Ukrainian President Volodymyr Zelensky addressed the first strike on the evening of Oct. 8 and presented it as a reply. He said Russia had struck and was still striking Ukraine’s data centers and that Ukraine was responding. He said he could not share all the details, according to Meduza and to Reuters remarks quoted by DatacenterDynamics.

That reply points back to a campaign under way for weeks. On Sept. 23, Ukrainian internet providers UTELS and Pavutyna said Russian strikes had damaged their data centers in Kyiv, according to ISW. Ukraine’s Ministry of Digital Affairs said about 100,000 Kyiv households experienced internet disruptions, ISW reported. Russia’s Defense Ministry claimed the same day that it had hit two Kyiv data processing centers, New-Telco and United DC, which it said provide internet service to Ukraine’s Defense Ministry and special services. DatacenterDynamics names eight Ukrainian operators whose facilities have suffered drone damage, among them Datagroup, Vodafone Ukraine, De Novo and Ukrtelecom. Meduza separately counts at least eight companies whose data centers Russian strikes have damaged or destroyed since late September.

Moscow’s stated reason for the Kyiv strikes carries a lesson for shared infrastructure. A commercial data center that also carries government traffic is a site a belligerent can describe as military, and every tenant in its racks shares that exposure whether or not it knows who its neighbors are.

Export controls on one side, a diesel license on the other

Physical damage is only half of the repair problem for Yandex. ISW assessed on Oct. 9 that Western export controls and sanctions will very likely prevent the company from promptly replacing advanced semiconductors that were likely damaged. If processors at Sasovo were lost, replacing them is a sanctions question as much as a supply-chain one.

Fuel sanctions moved the other way the same day. President Donald Trump said he and Putin had agreed that Russia would supply over 300,000 tons of diesel to U.S. and global markets immediately, 500,000 tons in November and 1 million tons after that, according to Axios. He added that Russia would deliver 3 million tons within a short period. The Treasury Department’s Office of Foreign Assets Control issued General License 135 the same day. Its text authorizes transactions related to the sale, delivery, offloading and importation of diesel of Russian origin, including into the United States, through 12:01 a.m. EDT on April 7, 2027. It does not authorize debits to accounts held for Russia’s central bank, its National Wealth Fund or its Finance Ministry at U.S. financial institutions.

ISW called the waiver a unilateral U.S. concession and said diesel profits will help Russia keep funding the war. Zelensky called the decision a gift to Putin and proposed a different trade: Ukraine would halt its strikes on Russian refineries if Russia stopped attacking Ukraine’s energy infrastructure, according to Axios. Joseph Webster, an energy and geopolitics analyst at the Atlantic Council, doubted the volumes themselves. “These putative Russian export volumes are not only uncertain to materialize but are small in volume and wouldn’t address the global diesel shortage,” Webster said in an email to Axios. The announcement coincided with the arrival in Miami of Ukrainian and European delegations for meetings with U.S. negotiators Steve Witkoff and Jared Kushner, which Meduza reported were set for Oct. 9 and 10.

For compliance teams, the license reads differently from the announcement. Its text sets no volumes, carries its own expiration date and keeps the bar on debits to accounts of Russia’s central bank, wealth fund and Finance Ministry. The license itself, rather than a social media post or a news summary, is the document to read before any transaction touches Russian diesel.

Decree No. 604 and the question of custody

The longer exposure for data holders sits in a legal text, not in the air. On Aug. 24, Putin signed Decree No. 604, on measures to ensure the security of Russia’s critical infrastructure facilities, and it took effect on publication that day. In ComplexDiscovery’s translation of the Russian original, it allows the government, on the president’s instruction, to introduce temporary management over a business entity’s property in Russia, its securities, its shares in Russian companies and its property rights. The decree applies that term to organizations and individuals alike. Four kinds of failure can trigger it. An entity may fail to take security measures or take them late, violate security requirements, or create threats to a facility’s security or normal functioning, including where measures against drone attacks prove ineffective. It may also fail to restore a facility, or restore it late.

The text is specific about what the state’s manager receives. The Federal Agency for State Property Management serves as temporary manager by default, unless the government names another manager on the president’s instruction, and it exercises the owner’s powers, except the power to dispose of the property. The arrangement ends by government decision, again on the president’s instruction. The decree’s list of critical infrastructure names communications facilities and closes with a catch-all for other facilities of particular importance to security, economic stability and the life of the population, though it does not mention data centers by name.

Multinationals have a direct stake in one definition. The entities the decree covers include controlling persons of Russian legal entities that are foreign state institutions, state associations or unions, foreign organizations, foreign citizens or stateless persons. Read with the clause on shares in Russian companies, that definition appears to bring foreign parents of Russian subsidiaries within its reach.

ISW reads the decree more broadly than its wording. The text speaks of temporary management, while ISW describes the decree as setting conditions for nationalization.

The Kremlin rejects that reading. Putin dismissed it twice in early September, first at a press conference in Bishkek, according to the Russian business news site TKS, and then at the Eastern Economic Forum. At the forum, he said the state had never intended to nationalize anything and that the decree aims only to make businesses invest in protecting key facilities, according to the Russian outlet Expert. First Deputy Prime Minister Denis Manturov said facilities whose owners had already been told repeatedly of security shortcomings could be the first placed under temporary management, Expert reported. He also said the government does not plan to publish its list of covered facilities. Companies will be told if their own sites are on it, he said, according to TKS, which cited his interview with the state news agency TASS.

None of those statements settles how the decree would apply to Yandex. In its Oct. 9 assessment, ISW said the strikes may enable the government to nationalize Yandex under the decree. That outcome, ISW said, would let the Kremlin reach private data held in Yandex’s email and cloud storage services. No source reviewed for this article reports any step to apply the decree to Yandex. ISW sees a wider pattern all the same. On Oct. 7, according to ISW, state nuclear corporation Rosatom said it had acquired the remaining 51 percent of Delo Group, Russia’s largest logistics and transportation operator. ISW described the deal as the Kremlin consolidating logistics assets under state control amid Ukrainian strikes.

The information layer was contested too

Custody of infrastructure was not the only contest that week; custody of the message was another. Montenegrin police and the country’s National Security Agency detained Mikhail Zvinchuk, founder of the pro-war Russian Telegram channel Rybar, in the coastal town of Risan on Oct. 9, together with four other Russian citizens, including his wife. Police said the five could not stay in Montenegro and that a decision had been taken to deport them on national and internal security grounds, according to Vijesti, as reported by Ukrainska Pravda. The Moscow Times, drawing on Reuters, put the number expelled at four and described the channel as influential.

Prime Minister Milojko Spajić said Montenegro was protecting its interests and its path toward European Union membership, according to The Moscow Times. Dmitry Medvedev, deputy chairman of Russia’s Security Council, said Russia may need to detain European and U.S. citizens to build up its pool for prisoner exchanges, the same outlet reported. Rybar, which has about 1.5 million Telegram subscribers, said its team had entered the country legally.

Britain had already moved against the people behind the channel. On July 13, it sanctioned 10 people linked to Rybar LLC, according to the government’s sanctions notice, among them the company’s creative director, Valeriia Zvinchuk, whom The Moscow Times identifies as Zvinchuk’s wife. The designations include Britain’s internet services sanctions, under which social media services, internet access providers and app stores must take reasonable steps to keep UK users from reaching content the designated people provide. The U.S. State Department offered up to $10 million in October 2024 for information on people running Rybar-led channels.

Montenegro’s action targeted people; the Yandex outages showed what happens when the machines carrying information go dark. That second problem is the one most organizations can plan for.

What data teams can take from the week

The Yandex incident notice offers the cleanest lesson, and it is about failure domains. By Yandex’s own account, a fire at one physical site took down an entire availability zone. Within hours of the first outage report, Yandex said it had switched load to its other zones and that services there were operating normally, yet ru-central1-b was still down two days later. Organizations should confirm that their production systems actually run across zones, rather than assuming a provider’s multi-zone offering covers them, and should ask which facility sits behind each zone they depend on.

Yandex’s Cloud Backup service appears on the incident’s list of affected services, which shows that a backup service can be disrupted along with the zone it serves. By Oct. 10, Yandex was giving customers a small extra allowance of resources to restore from backups, including to move workloads to other sites. It had also arranged priority help from three other Russian cloud providers: Selectel, K2Cloud and VK Cloud. Teams should confirm that their backup copies, and the means to restore from them, sit outside the failure domain of the systems those copies protect. They should also confirm that the law governing the data allows it to move where recovery would take it.

For eDiscovery and information governance teams with matters or vendors that touch Russian-hosted data, two records are worth starting now. The first maps which systems sat with which provider and zone and when each became unreachable, because questions about lost information usually begin with what was hosted where. The second maps which counterparties, subsidiaries included, hold data on Russian infrastructure that could come under a state-appointed manager under Decree No. 604, along with what the governing contracts say about access and change of control. Manturov said owners will be told whether their sites are on the government’s unpublished list, but nothing in his account extends that notice to the owners’ customers. That second map therefore has to be built from what companies know about their vendors’ sites, and from asking those vendors directly, rather than from any official register.

Yandex chose its own metaphor for what was hit. A heart can be stopped by a drone in a single night, and under Decree No. 604, one that is not protected or restored in time can also be handed to a state-appointed manager. If the facility holding your data could be lost either way, who decides what happens to the information inside it?

News sources

• Указ Президента Российской Федерации от 24.08.2026 № 604 (Official Publication of Legal Acts portal, Government of the Russian Federation)
• What is happening to our data centers, the iron heart of Yandex (Yandex)
• Power failure in the ru-central-b availability zone (Yandex Cloud)
• General License No. 135: Authorizing Transactions Related to the Sale, Delivery, Offloading, and Importation of Diesel Fuel of Russian Federation Origin (U.S. Treasury Department, Office of Foreign Assets Control)
• Issuance of Russia-related General License (U.S. Treasury Department, Office of Foreign Assets Control)
• Sanctions Notice: 13 July 2026 (Foreign, Commonwealth and Development Office)
• Ukraine strikes Russian tech giant Yandex’s data centers for a second straight day as new peace talks involving Kyiv, the U.S., and Europe get underway in Miami (Meduza)
• Second Yandex data center hit in drone strikes in Russia (DatacenterDynamics)
• Ukrainian Drone Strike Disables Several Modules at Yandex Data Center in Kaluga, Company Says (Kyiv Post)
• Trump announces major diesel deal with Putin, infuriating Ukraine (Axios)
• Montenegro to deport Rybar propaganda network founder and four other Russians (Ukrainska Pravda via Yahoo News)
• Montenegro Expels Founder of Russian Pro-War Blog Rybar for ‘Security Reasons’ (The Moscow Times)
• Владимир Путин заявил об отсутствии планов по национализации критической инфраструктуры (Expert)
• Путин заявил, что государство не собирается национализировать защищаемые объекты инфраструктуры (TKS)
• Власти не раскроют перечень критических объектов, которые могут столкнуться с временным управлением (TKS)
• Russian Offensive Campaign Assessment, October 9, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, October 8, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, October 7, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, Sept. 23, 2026 (Institute for the Study of War)

Assisted by GAI and LLM Technologies

Additional reading

• A cell tower near Lyman and Russia’s fight over its own war record
• How a general’s walk across a bridge tested Putin’s claim to Svyatohirsk
• Germany names Russia for the Leipzig drone, and keeps most of its evidence out of view
• Estonia scrambled jets over a drone no official has identified
• Russia leans on drones and dissent-proofing as fuel crisis bites
• Senate passes Graham sanctions act, shifting Russia pressure from policy to statute
• Lithuania’s false-flag warning puts drone attribution on NATO’s eastern flank
• Three accounts from one wartime morning in Russia
• When an air defense engagement becomes a criminal case file
• The week the war reached Russia’s e-commerce supply chain
• The three silent hours: How Russia’s cyber war targets Ukraine’s newsrooms
• Confirmed versus claimed: reading the gap in Russia’s June offensive
• When the flag may be fake: Ukraine’s June war and the new burden of proof
• When the drone war reaches the reactor fence: Ukraine and the cyber-physical front
• When the refineries burn: Ukraine’s strikes turn Russia’s energy backbone into a cautionary tale
• The night Ukrainian drones exposed gaps in Moscow’s defenses and state TV gave it 60 seconds
• From warning to funding: Russia’s expanding media machine and the risk signals ahead
• Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.