Ukraine strikes Yandex data centres, disrupting Russian AI and cloud services
Physical attacks on Yandex facilities in Russia have caused widespread outages for its AI models, cloud computing, and consumer services, according to reports.
Key points
- A data centre in the Vladimir region was completely shut down following a third attack on Yandex.
- Two of the three supercomputers used for AI model development were housed in a facility near Moscow.
- Services including Yandex Music, Telemost, and the Alice voice assistant experienced significant disruptions.
Ukraine has targeted critical cloud and artificial intelligence infrastructure belonging to Yandex, causing widespread service disruptions across Russia and internationally. The attacks represent a shift from previous strikes on oil facilities to digital infrastructure, involving the physical destruction of data centres. This escalation highlights the vulnerability of physical hosting sites for major technology providers in conflict zones.
Root cause
The disruptions stem from physical strikes on Yandex’s data centre facilities rather than a software vulnerability or cyber intrusion. According to Reuters, the third attack on the company occurred on Sunday morning and resulted in the complete shutdown of its data centre in the Vladimir region. These physical destructions directly impacted the hardware required to run cloud services and AI training workloads.
Attack path
Ukrainian forces utilised purpose-built fixed-wing drones, including the AN-196 RS and FP-6, to strike deep inside Russian territory. These unmanned systems, described as exploding aircraft, were deployed by specialist divisions such as the 1st Separate Center of Unmanned Systems. The attacks targeted specific geographic locations where Yandex concentrates its computing resources, bypassing traditional network-level defences through kinetic physical damage.
Affected versions
- Yandex Compute Cloud, a provider of virtual machines, experienced extensive outages.
- Yandex Music and Telemost, a video conferencing service, were disabled.
- The Alice voice assistant and associated Station smart speakers lost functionality.
- Specialised cloud solutions for healthcare providers were impacted.
Mitigation
- Relocate critical data centres to geographically diverse locations to mitigate single-point physical failures.
- Implement robust data replication strategies across multiple independent infrastructure providers.
- Develop incident response plans that account for physical destruction of hosting facilities.
- Monitor service status pages for real-time updates during regional conflicts.
What to do and how to stay safe: Yandex
- Review your disaster recovery plans to ensure they address physical site destruction, not just cyber incidents.
- Identify single points of failure in your cloud infrastructure that rely on a single geographic region.
- Establish alternative communication channels in case primary cloud-based services go offline.
- Monitor official status pages of your cloud providers for any reports of physical infrastructure damage.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Yandex services were affected by the attacks?
Yandex Music, Telemost, the Alice voice assistant, and Yandex Compute Cloud experienced disruptions or outages.
Where were the targeted data centres located?
Facilities in the Vladimir region, Kaluga, and Sasovo near Moscow were targeted in the recent attacks.
What type of weapons were used in these strikes?
Ukraine used fixed-wing drones, specifically the AN-196 RS and FP-6 models, to destroy the infrastructure.
