Data centres are emerging as important targets in modern warfare, as attacks in Russia and the Middle East demonstrate how damage to digital infrastructure can disrupt essential services and complicate countries’ efforts to develop artificial intelligence (AI).
Ukrainian strikes on facilities belonging to Russian technology company Yandex and Iranian attacks on Amazon Web Services (AWS) infrastructure in the Gulf have highlighted the consequences of placing large amounts of computing capacity in vulnerable locations. The incidents also raise questions about how governments and technology companies can keep critical digital services running during armed conflict.
Connor Martin, an expert on the national security implications of cross-border capital flows and the risks posed by frontier technologies such as AI, examines the implications of this vulnerability.
Ukraine’s attacks on Yandex disrupt Russian digital services
Ukrainian drones struck three Yandex data centres in October, according to reports, in retaliation for Russian attacks on Ukrainian facilities. Yandex, often described as Russia’s Google, provides internet and cloud services used across the country.
The strikes caused disruptions to services including email, payments and navigation, illustrating the economic and practical consequences when widely used digital infrastructure becomes a military target.
The affected facilities also housed three Yandex supercomputers equipped with Nvidia A100 processors designed in the US. Access to advanced semiconductors has been a challenge for Russia since its invasion of Ukraine in 2022, making the replacement of specialised computing equipment more difficult.
Ukraine subsequently struck another data centre under construction for Sberbank, Russia’s largest bank, according to reports.
The attacks come as Russia faces wider obstacles in AI development, including restrictions on advanced chips and the loss of skilled engineers. Damage to computing facilities could add to these difficulties, although its long-term effect on Russia’s AI capabilities remains uncertain.
Iran’s strikes on AWS highlight risks beyond the battlefield
The consequences of attacks on data centres have also been visible in the Middle East. In March 2026, Iranian drones struck two AWS facilities in the United Arab Emirates (UAE) and damaged another in Bahrain.
The strikes damaged equipment, disrupted electricity supplies and triggered fire-suppression systems, causing additional water damage.
In September, AWS said it was “unable to restore access to the resources and data” hosted exclusively at two affected facilities. The company also said that “most customers have been able to re-establish their operations in other regions by restoring backups or copying data that remained accessible.”
The incident highlighted the difference between restoring a service and recovering the information it contains. Businesses with accessible backups may be able to resume operations elsewhere, while data stored only at a damaged facility could remain unavailable.
AWS, Microsoft, Oracle and Google operate data centre infrastructure in the Middle East, where renewed hostilities could threaten facilities and the subsea cables that connect them.
Why are data centres difficult to defend?
Unlike mobile military equipment, data centres are fixed installations that require reliable electricity, cooling systems and high-capacity communications networks. Their locations are shaped by these requirements, making rapid relocation difficult.
Their scale presents another challenge. Conventional data centres can occupy around 100,000 square feet, while facilities built for advanced AI computing can be substantially larger.
They also depend on several systems working together. Damage to power distribution or cooling equipment can disable a facility even if its servers remain intact. Repairs may take time, particularly when replacement components are expensive or difficult to obtain.
These characteristics have prompted security experts to consider data centres not simply as commercial properties, but as infrastructure with potential strategic importance during a conflict.
Existing physical-security standards largely focus on intrusion and unauthorised access, rather than aerial attacks during armed conflict.
Can cloud companies prevent disruptions during war?
Complete protection against military attacks is difficult, making recovery plans essential. Companies can reduce their dependence on individual facilities by maintaining backups, distributing workloads and ensuring that important information remains accessible from alternative locations.
Ukrainian providers have used servers in the European Union (EU) to back up information, according to reports. Russia’s strict data-localisation requirements can limit comparable options for companies operating there.
Governments face a related policy question: rules requiring information to remain within national borders may support regulatory objectives, but they can also restrict recovery options when domestic infrastructure is damaged.
Edge computing, which distributes certain processing tasks across smaller facilities closer to users, offers another way to reduce dependence on centralised sites. It cannot, however, replace the large computing clusters required to train advanced AI systems.
Companies are also exploring underground facilities and data centres in space, although these approaches face substantial technical and commercial barriers.
