In four days, drone strikes hit three of Yandex’s Russian data centres, shutting two down completely, and the company’s cloud platform is now running in emergency mode. Yandex has also reportedly changed its customer terms so that it is not liable for this kind of disruption, which is a lesson for every UK organisation that has signed a cloud contract.
What happened
The first strike came overnight on 7 to 8 October 2026 and hit Yandex’s facility at Sasovo in the Ryazan region. It started a fire and the site shut down completely. On 9 October drones hit a second site in the Kaluga region and took part of it offline. The third attack was early on Sunday 11 October, against the data centre in Vladimir. Yandex said operations there were completely suspended and described what was left of its infrastructure as unstable.
Ukrainian president Volodymyr Zelensky has presented the campaign as retaliation for Russian attacks on Ukrainian data centres and telecoms infrastructure in September. One of those attacks cut fixed-line internet for around 100,000 households in and around Kyiv. The Register puts Yandex’s Russian estate at five data centres and The Record at six; either way, at least half of its sites were hit within a week.
The effects reached a wide range of services. Yandex Pay, the company’s digital wallet, was still unavailable on 12 October. Dima Pirogov, head of Yandex’s fintech business, told users on Telegram that their money was safe but did not say when they would be able to get to it. Yandex Cloud was running in a limited mode with an unstable configuration. Netblocks measured its network connectivity at about 30 per cent of normal on 11 October. Email, taxis, food delivery, the Alice assistant and third-party businesses hosted by Yandex were also disrupted.
The commercial side of the story is what matters most here. The Record reports that on Saturday 10 October Yandex updated its terms of service so that it is not liable when drone strikes or other attacks stop it meeting its contractual obligations. The Record says this could limit customers’ ability to seek compensation. Russian state media said rivals Selectel, K2Cloud and VK Cloud had agreed to help customers migrate.
The detail
From a resilience point of view, the striking thing is what Yandex told customers. Its status updates did not promise failover between its own sites. Instead they told customers to use alternative hosting locations, reserve capacity elsewhere and fall back on any other disaster recovery plans they had. BleepingComputer quoted one update saying the platform was in an emergency operating mode. That is a provider telling customers, in plain terms, that its own redundancy was not enough.
Reporting from NV said the Vladimir site hosted the ru-central1-a availability zone, and monitoring channels counted over 80 affected cloud services. A customer quoted by BleepingComputer described failed file downloads and server errors from 8 October. The Record says Yandex Cloud had about 64,000 customers in mid-2026, but Yandex has not said how many were affected.
Several things failed together: the payment service, the consumer apps, the AI platform and third-party tenants. That is the pattern you get when many business lines share a small number of physical sites.
Why it matters for UK organisations
There is no sign that UK firms rely on Yandex, but the risk in this story is not specific to Russia. Physical attacks on data centres are now part of a live European conflict. Both sides have shown that cloud infrastructure is a legitimate target in their eyes.
The contract change is the part UK buyers should study. Most standard cloud terms already contain broad force majeure language. Yandex’s update shows how quickly a provider can narrow its obligations once a crisis starts. If a customer’s business continuity plan rests on service credits or a claim for damages, that plan can fail just when it is needed.
Insurance is the next gap. Many commercial property, business interruption and cyber policies exclude losses caused by war or state-backed hostile acts, and the wording differs a great deal between insurers. A business that loses revenue because a provider was hit by a drone or a state-sponsored attack may find that it is not covered.
The regulatory pressure is growing too. Under the FCA and PRA operational resilience rules, financial firms are expected to stay within impact tolerances for their important business services even when a third party fails. In-scope firms with EU operations have similar obligations under DORA. The Cyber Security and Resilience Bill will bring managed service providers and data centre operators further into the UK regime. In every case, “our provider was down” will not be an acceptable answer.
Expert view
When we review resilience arrangements, the most common gap I find is not technical. It is an assumption. Organisations treat multi-zone deployment inside one provider as equivalent to disaster recovery, and they never test what happens if the provider is unavailable across a whole region. Yandex’s advice to look for alternative recovery options shows that even the provider was not relying on that assumption.
In my experience, contract reviews for cloud and managed services focus on price, data location and service levels. Exclusion clauses get much less attention, and so does the provider’s right to change its terms on notice. Procurement and legal teams should treat the force majeure and limitation of liability sections as a security control, because that is what they turn out to be on the worst day.
None of this means every workload needs several clouds. The aim is to know which services you could not do without, and to check that a credible way out exists for each.
What to do now
- Map critical dependencies. For each important business service, record which provider, which region and which physical sites it relies on.
- Read the exclusions. Ask legal to review force majeure, limitation of liability and unilateral change clauses in your main cloud and managed service contracts. Push for notice periods and exit assistance commitments.
- Check your insurance wording. Ask your broker how war and state-backed attack exclusions would apply to an outage at your provider, and whether contingent business interruption cover applies.
- Test a regional exit. Run a recovery exercise that assumes an entire provider region is gone, not just one zone. Measure your real recovery time against your stated tolerances.
- Keep independent backups. Hold copies of critical data outside the primary provider. Make them immutable and test restores regularly. Cyber Essentials does not cover backup, so treat this as an extra layer, and apply its secure configuration and security update management controls to any systems you rebuild.
- Plan payments and access. If customers or staff rely on a single payment or identity provider, decide in advance what the manual or alternative route is.
Bottom line
The Yandex outage shows how quickly a cloud platform can fail when its physical sites are attacked, and how quickly the provider’s contractual promises can be narrowed. UK organisations should not assume that resilience is something they can buy entirely from a provider. Check the contract, the insurance policy and the exit plan now, while there is no crisis.
Sources
- The Register: Ukrainian drone strikes on Yandex datacenters knock cloud and payments offline
- The Record: Ukraine strikes third Yandex data center, disrupting digital services across Russia
- BleepingComputer: Yandex confirms service outage as users lose access to cloud files
- Cybernews: Drone attack takes another Yandex data center offline
- NV: Drone attack shuts down Yandex data center in Vladimir, disrupts cloud services
