Strikes on Yandex data centers: what broke in Russia's internet, and what didn't

Between the night of October 7 and the morning of October 11, 2026, drones hit three Yandex data centers: Sasovo in the Ryazan region, Kaluga, and Vladimir. Reuters called the first of them the first major drone attack on a Russian data hub. By Sunday, Yandex Cloud was running in emergency mode on two of its four main zones, taxi apps were failing from Moscow to Almaty, and Russia’s digital minister was calling the attack unprecedented in a Duma committee session.

Within hours, commentators were asking a tempting question: if Russia’s own computing burns, does Russia’s censorship burn with it? Some went further, suggesting that services forced to flee abroad would make Roskomnadzor’s blocking unworkable and kill the rumored fee on international traffic.

We spent the weekend testing that idea against routing data, measurement archives, Russian law and the record of official statements. The short answer: the strikes reached the servers Russians use every day, but they did not reach the boxes that censor them. The longer answer is more interesting, because what the strikes actually hit is the physical foundation of Russia’s walled-garden internet, and that foundation is concentrated around one city, nearly full, and legally forbidden from leaving the country.

What happened to Yandex's data centers in October 2026?

Three strikes in four days, each confirmed by Yandex itself.

The Kaluga site is the heaviest loss on paper: designed for 63 MW and more than 3,800 racks per Interfax, and described by Yandex itself in 2022 as its largest. The regional governor reported nine people injured across the region that morning, though none were reported at the site itself, and Yandex says no employees were hurt at any location. Russia's Investigative Committee opened a terrorism case after Sasovo. By October 9, Yandex told reporters it could not name restoration timelines, and Reuters reported the company could not confirm the Sasovo equipment was recoverable at all.

Nobody in Kyiv has formally claimed the strikes. President Zelensky said on October 8 that Ukraine had "hit back" after weeks of Russian strikes on Ukrainian data centers, which have damaged facilities of at least eight companies since late September, per Meduza. The drone maker Fire Point claimed the Kaluga and Vladimir strikes on Telegram; Ukraine's General Staff has said nothing.

Which services went down, and for how long?

The first strike was mostly a business-to-business event. Zone b hosted managed databases, storage and compute for part of Yandex Cloud's roughly 64,000 clients, so October 8 belonged to broken corporate systems: the real-estate portal CIAN confirmed an incident at an "infrastructure partner", Russian Railways' site stumbled, and business media reported disrupted internal systems at banks and retailers. Yandex's consumer apps largely held, and the company stressed its main services were running normally.

October 11 was different. With zone a gone while zone b was still dark, Yandex Cloud declared emergency mode: its status page listed more than 80 affected services, some databases dropped to read-only, storage writes failed intermittently, and the issuing of new resource quotas was suspended. This time Yandex's own apps failed with it. The outage tracker Detector404 logged around 2,100 complaints an hour for Yandex Go by 07:00 Moscow time, with Yandex Pay, Music, Alice smart speakers and Telemost close behind, and the Associated Press reported failures in dozens of Russian cities as well as in Kazakhstan, Belarus and Armenia; Russian outlets added Serbia, where Yandex Go also operates. Dodo Pizza, Magnit, M.Video and other chains reported problems the same morning.

Two widely repeated claims from those days do not survive checking. The massive Runet outage on the afternoon of October 8, which took down major media and bank sites, was not the strike: the DDoS-protection firm Curator publicly attributed it to its own engineer's configuration error. And the viral statistic that "Russian bot traffic collapsed to 0.4%" after the strikes misreads a Cloudflare dashboard category that counts automated requests such as crawlers, not propaganda accounts.

The most remarkable response came from Yandex itself: it advised cloud customers to activate disaster-recovery plans "not limited to" its own zones and, per RBC, arranged fast-track migration deals for its clients with competitors Selectel, K2Cloud and VK Cloud. A cloud provider spent the weekend helping its customers leave.

Did the strikes knock Russia off the internet?

No, and the way they didn't is the most instructive measurement of the week. We pulled the routing and reachability data ourselves.

In BGP, the global routing table, almost nothing happened. Yandex Cloud's network kept announcing the same 53 IPv4 prefixes through the whole period; exactly one more-specific block was withdrawn in the hours around the Vladimir strike, and even that space stayed covered by a larger announced route. What changed is what answered: in IODA's active probing data, reachable /24 host blocks in Yandex Cloud's network fell from a baseline of 519 to about 341 after Sasovo, a 34% drop, and to about 112 after Vladimir, 78% below baseline. A fall in probe responses can in principle also reflect filtering changes, but both steps land in the strike windows to the hour. In the hours after the first strike, Cloudflare Radar measured Yandex Cloud's traffic at roughly a third below the previous week. The routes stayed up; the hosts behind them went dark.

Note the middle marker: the Kaluga strike, against the largest facility of the three, produced no visible step at all. Yandex's biggest site was hit and the network-level needle barely moved, because damage inside a data center is invisible to global routing until a whole availability zone drops. Infrastructure failures and deliberate censorship look completely different in this data, which is exactly why measurement projects can usually tell one from the other.

Could the strikes weaken Roskomnadzor's VPN blocking?

This is the hypothesis that spread fastest, and the technical record says no. Russia's blocking does not live in data centers. It lives in TSPU, the state-supplied filtering units that the 2019 sovereign-internet law obliges every sizable ISP to install, placed where Roskomnadzor directs and managed centrally by its control center. Researchers who measured the system in a peer-reviewed study found the devices sitting in-path inside carrier networks, mostly within two hops of end users. Roskomnadzor's own technical arm said in late 2025 that more than 1,400 TSPU units carry 132.3 Tbit/s of traffic, and the government plans to grow that capacity to 954 Tbit/s by 2030. Nothing in the public record ties any of it to Yandex's data centers, and burning one does not touch a single filter.

Nor does traffic fleeing abroad overload the censors: TSPU already inspects subscriber traffic whatever its destination, with a stated goal of covering 100% of Runet traffic in 2026. There is one kernel of truth in the idea. Several recent blocking heuristics treat foreign hosting as inherently suspicious, from the throttling of Cloudflare-served sites to the silent freezing of mobile connections to foreign data centers after the first kilobytes. If major Russian services served users from foreign addresses, those rules would misfire more often. But Roskomnadzor already runs an exception process for that, with over 12,000 whitelisted IP addresses by 2025. For the censor it is a maintenance cost, not a capability loss.

No analyst we could find in Russian or English coverage argues the strikes weaken blocking. The closest expert comment runs the other way: digital-rights lawyer Sarkis Darbinyan warned that the authorities will likely use the attacks as a pretext for further restrictions in the name of security.

So what do the strikes actually threaten? The whitelist.

Russia's censorship has two layers. Blocking, which the strikes cannot reach, and the walled garden, which they just set on fire. During mobile internet shutdowns, which Russian regions now experience daily, carriers switch to whitelist mode: an allowlist of 500+ approved Russian services stays reachable and everything else goes dark. The digital ministry's stated condition for joining the list is blunt: all of a service's computing capacity must be located on Russian territory.

That condition is the hinge of the whole story. Whitelist mode only works because the approved services, Yandex among the first of them, run on domestic infrastructure the state can verify and control. And whitelist mode is no longer an edge case: by July 2026, measurements reported by Kommersant showed 51% of mobile sessions in Moscow and its region running in whitelist-only mode, more than 60% across the Central Federal District, and nearly 90% in the border regions. Russia logged more than 11,900 mobile shutdowns in 2025.

Now put the strikes against that architecture. A regime that pushes half the country's mobile sessions onto a shortlist of domestically hosted services has made those services, and the handful of clouds behind them, critical infrastructure. Two of the four zones of one of those clouds are offline. Every shutdown hour now costs more, because the fallback internet itself has become unreliable. The strikes do not free a single blocked site, but they make the walled-garden model measurably worse at the one thing it promises: keeping the approved services running while everything else is cut.

What about the fee on international traffic?

The idea that Russians should pay extra for foreign internet traffic has been floated, postponed, denied and revived across 2026, and it was never realized. The sequence matters: proposed in March at 15 GB a month with about 150 rubles per extra gigabyte, postponed in May until after the September Duma elections, publicly disowned by a deputy minister in July, quietly revived after the vote, and by October 5 shrunk, per Kommersant, to a discussion about 5G traffic above 50 GB a month only. Operators told the paper even that version is technically impossible today, since Russian 5G runs on LTE cores that cannot bill it separately. There is no law and no bill in the Duma.

The operators' own objection from the spring is the relevant one here: they cannot cleanly separate "foreign" from "domestic" traffic in the first place, partly because Russian services use foreign addresses and CDNs, while foreign traffic already runs to about 30% of Russian network volume and keeps growing. Any migration of Russian services abroad would push that share up and make the fee even less workable, billing users for reaching their own bank. But the causation the hypothesis needs runs backwards: the fee is not collapsing because services are fleeing abroad. It is stuck because it was always technically and politically awkward, and Russian services are not fleeing abroad at all, because they cannot.

Can Russian services move their data processing out of the country?

This is where the "everyone will just relocate" scenario dies, three times over.

Legally: since July 1, 2025, amended federal law prohibits collecting Russians' personal data into databases located outside Russia, closing the loophole that once allowed primary processing abroad. Government decrees require state information systems to sit on Russian territory. From March 2027, large AI models under the new law must run in Russian-owned data centers on Russian soil. And a whitelisted service that moved its computing abroad would, by the ministry's own stated criterion, forfeit its place in the only internet that works during shutdowns.

Physically: Russian Yandex has no foreign refuge. Its famous Finnish data center in Mäntsälä went to Nebius, the unrelated Amsterdam-based company, in the 2024 corporate split. Our own analysis of routing-registry data shows more than 98% of the address space of Yandex, VK, Sber and Selectel geolocates to Russia, with the foreign remainder being small CDN edge blocks and modest Kazakh cloud regions, nothing sized to carry a national service. One genuine curiosity surfaced in that check: every core prefix of Yandex's consumer network is also announced, with Yandex's own routing authorization and since mid-2023, by a small Serbian-registered network that buys transit from Western and Chinese carriers. That arrangement gives Yandex's search and mail a resilient international front door, but announcement is not hosting: the space still geolocates to Russia, and Yandex Cloud, the network that actually lost two zones, has no such twin.

Economically: there is nowhere to go inside the country either. About 76% of Russia's commercial data-center capacity sits in Moscow and its region, and Moscow's sites are about 95% full, with some 1,400 free racks and roughly 50 MW of free grid power left in the entire metropolitan area, against unmet demand estimated at 200 to 300 MW. For scale: a single Yandex hyperscale site of the kind just damaged is designed for 40 to 63 MW, about the size of Moscow's whole remaining power reserve. Displaced workloads are being absorbed by the same strained pool; the competitors Yandex is sending customers to lease capacity in the same region. Contrast Ukraine, which changed its law one week before the invasion to allow state data into foreign clouds and moved more than 15 petabytes from over 60 government bodies to AWS. Russia wrote the opposite law, and it is now locked inside it: the data cannot leave, and the buildings it lives in cannot be defended by legislation.

What happens if the strikes continue?

No public modeling can say what gets hit next, and we will not speculate. What the market data does support is a sober look at the pressure points.

Concentration is the vulnerability. Three quarters of commercial capacity around one city, a top-five of providers holding about 64% of racks, and all four of Yandex Cloud's general-purpose zones inside the Central Federal District, two of them, by Yandex's own description, less than a millisecond apart. Every further loss lands on a market with roughly 2% spare capacity and multi-year waiting lists for grid connections.

Dispersal was already ordered, and it accelerates. Two days before the first strike, a deputy digital minister urged moving computing capacity "beyond the Urals", and a December 2025 presidential instruction told the government to propose data-center siting in energy-surplus regions. New project announcements already tilt toward Yekaterinburg, Novosibirsk and Kazan, and analysts forecast Moscow's share falling toward half of the market by 2030. The strikes turn that slow economic migration into a security program, complete with vendors pitching mobile containerized data centers to worried operators. Digital minister Maksut Shadaev's answer on October 12 was not relocation but protection: his ministry and the Defense Ministry are discussing military cover for data centers.

The censorship gets harder, not softer. Official rationale ties mobile shutdowns to drone defense, even though researchers found only 78 of 230 confirmed shutdowns in May and June 2025 coincided with drone activity. More drones over data centers mean more shutdown pretexts, more whitelist hours, and more pressure to finish projects like the August 2026 plan to isolate whitelisted services into dedicated subnets. The censor's budget line was never the target and never at risk.

For ordinary users, all of this points the same direction it has pointed all year: when the open internet shrinks to a whitelist, demand for a way out grows. That dynamic, not any damage to the blocking machine, is what the strikes feed. We track the enforcement side in our reference on every Russian VPN law and block from 2017 to 2026, the practical side in our report on September's post-election blocking wave, and the country picture on our Russia page.

The bottom line

Russia's censorship does not live in data centers, so the strikes cannot burn it down. Russia's walled garden does live in data centers, three quarters of them around Moscow, nearly full, legally chained to Russian soil, and now demonstrably within reach of the war their country started. The whitelist model assumed the domestic cloud was the safe place. In October 2026, for the first time, it visibly wasn't.