Yandex faced a second infrastructure loss on October 9, 2026, when an attack disabled several data-center modules in Russia’s Kaluga region. Its larger Sasovo facility, hit a day earlier, remained completely shut. The company confirmed no employee injuries at either site and gave no date for restoring the equipment.
The new development was not another account of the Sasovo fire. It was a test of recovery after two locations belonging to the same operator were hit within roughly 48 hours. Yandex said it had reached arrangements with other cloud providers to help customers move data and services—a move beyond simply directing traffic to its own remaining zones.
What October 9 added to the first shutdown
The October 8 attack in Sasovo, Ryazan region, caused a fire and closed a site containing tens of thousands of servers. Yandex said major consumer services continued, while external services reported problems. On October 9, Kaluga infrastructure southwest of Moscow was partly unavailable and several modules were fully disabled, according to reporting and Yandex’s statement.
Ukraine’s President Volodymyr Zelensky confirmed the Kaluga operation and described it as a response to Russian strikes on Ukrainian data centers. Fire Point said FP-1 one-way attack drones were used. That attributes the operational claim and weapon identification to their speakers; it does not establish every detail of targeting or damage independently. A one-way drone delivers its payload without returning, a class valued for range, numbers and lower cost than many conventional missiles.
Russia’s Defense Ministry said air defenses intercepted 505 Ukrainian drones between late Thursday and early Friday. That is its figure for the wider overnight campaign, not the number reaching Yandex. Neither Yandex nor Ukrainian officials disclosed the latter.
Kaluga Governor Vladislav Shapsha said nine people were injured across regional attacks and five were receiving hospital care. Officials did not specifically tie those injuries to Yandex. The regional casualty statement therefore does not contradict the company’s narrower report of no employee injuries at its two sites.
The intended target of the earlier Sasovo operation remained less clear. The facility occupies part of the former Sasta machine-tool factory complex, a plant under British sanctions over its reported defense-sector role. Ukraine initially gave no detailed account resolving whether the factory, data center or both were targeted. Circulating images established neither intent nor the condition of individual machines.
The limit is spare capacity, not just another address
An availability zone is an infrastructure location designed to isolate a failure within a wider cloud region. After Sasovo, Yandex reported a power problem in one zone, advised customers to use others and said workloads had moved to other facilities. Limits on creating new resources nevertheless remained.
Those transfers helped core consumer services avoid complete shutdown. They also consumed finite capacity at sites already carrying normal demand. Public reporting identified five major Yandex data centers in Russia: with two struck, three known locations were outside the immediate damage, two in the Moscow region and one in Vladimir. That is a facility count, not a measurement of free capacity or a claim that 40% of computing power was lost.
A working search page does not mean a business can provision cloud resources. Navigation, music, video, delivery, communications and business software share the operator’s infrastructure, but may receive different priorities or face different dependencies. T-Investments equity-research head Maryana Lazaricheva warned that continuing attacks could remove the ability to redistribute workloads.
The outside-provider arrangements matter in that context, but they do not prove an instant or completed migration. Databases, network configurations, identity and storage have to work together. Customers need current copied data, correct application startup and functioning security controls while the original environment may already be impaired.
Basic virtual machines are also easier to move than applications built around proprietary managed databases or AI tools. Another provider’s available servers do not automatically recreate those services. The commercial task is therefore retaining trust while restoring a usable operating environment, not merely announcing that capacity exists somewhere else.
Customer disruption is visible, but its scale has several denominators
Reports after Sasovo named problems with Yandex Disk and Documents, Cian, Litmarket, Russian Railways and Spartak Moscow’s website. A Moscow-region bus operator attributed unavailable online ticket sales to a temporary data-center shutdown. These were reported service effects, not a complete technical postmortem proving one cause for every outage.
Network reporting put Yandex connectivity at about 70% of normal after the first incident. That is not a 70% decline and does not demonstrate a nationwide internet collapse. Detector404 received 58,268 complaints during the day after Sasovo; complaints are not distinct customers, since one person can report repeatedly and unrelated incidents can coincide.
Yandex shares fell 4.5% in Moscow trading after the second attack. Investors could be concerned about interruption, segment revenue, customer exposure and defense costs, but a price movement cannot reveal physical hardware damage or establish repair bills and data loss.
Yandex described millions of daily users and hundreds of thousands of dependent companies. These figures describe potential reach, not a confirmed affected population. It published neither a complete customer-impact list nor confirmation of permanent customer-data loss. Unavailability and lost data remain separate outcomes.
AI training remains an important unknown, not confirmed destruction
Yandex’s 2021 disclosure placed Chervonenkis and Lyapunov, two of its three supercomputers, at Sasovo. The Nvidia A100-based systems support neural-network work and YandexGPT development. That historical location makes their condition important, but Yandex had not confirmed damage or whether they could be restored.
Fire, smoke, water, electrical isolation or cooling failures can stop an entire site even if many processors survive. Conversely, intact chips are not a working cluster without safe power, specialized networking, storage, cooling and configured racks. Repairing those supporting systems can take longer than replacing ordinary cloud servers.
Western export controls add constraints on advanced processors and manufacturing equipment. Replacement involves supply, delivery routes, service and integration rather than a routine order. Sberbank previously estimated Russian developers were six to nine months behind leading U.S. and Chinese developers, citing chip imports as a key constraint. That is a competitor’s assessment, not an independent measurement.
YandexGPT and Sberbank’s GigaChat need compute for training, evaluation and serving requests. Training builds or updates a model; inference runs it for users. An existing chatbot could stay online while future training or less urgent experiments are delayed. Alternatively, surviving clusters might return after surrounding infrastructure repairs. Neither a fire photograph nor absent updates establishes the end of Yandex’s AI program.
Two sites expose a different failure pattern from a national blackout
Digital-rights lawyer Sarkis Darbinyan told Meduza that large operators distribute infrastructure and can move traffic automatically. Russia has close to 200 data centers across telecoms, banks, clouds and independent operators, not just Yandex’s five. Disabling the whole internet would require a much broader campaign; serious local failure can coexist with national connectivity.
Regional government, payment terminals, schools, medical systems and small-business sites may lack equivalent redundancy. Multi-cloud can reduce dependence but requires synchronized data, aligned security policies and staff familiar with different tools. Smaller organizations may find that expense impractical until their main environment fails.
Separate administrative regions do not ensure independent wartime risk. Unlike random faults, an attacker can select several locations, repeat attacks and adapt to recovery. Barriers, surveillance, fire suppression and redundant utilities can help; hardening or moving existing facilities underground takes time. Software routing cannot replace damaged buildings and equipment indefinitely.
Ukraine has faced the same physical dependencies. A September strike disrupted fixed-line access for about 100,000 households around Kyiv, and officials discussed underground equipment and overseas workloads. Zelensky’s stated reciprocal motive does not settle the legal or ethical status of each target: the affected Yandex workload mix is not public, and disrupted civilian customers should not be assumed connected to the war.
Recovery and governance now have to be assessed together
The next meaningful evidence is a detailed restoration notice: which power, cooling, storage, servers or clusters can return, whether new-resource limits end and whether migrated applications operate securely. A quick recovery would support the effectiveness of reserves and partnerships; prolonged restrictions would raise concern without automatically proving that specific chips were destroyed.
Verified hardware assessments would clarify the AI consequences. Model-release delays, service or hiring changes could provide context but would not alone establish causation. Yandex also has commercial and security reasons for limiting infrastructure disclosures, so silence is not conclusive damage evidence.
Further attacks could push customers toward rivals, foreign hosting or offline contingencies. Rivals might gain business while sharing concentrated physical risk. The source reporting also notes that President Vladimir Putin received authority in August to take control of critically important infrastructure considered inadequately protected from drones; it does not establish that this authority was exercised against Yandex.
Stronger defenses, location secrecy and hardened sites carry cost and disruption. Hosting in countries Moscow considers friendly could reduce exposure inside Russia but change latency, law, data governance and sovereignty, while adding dependence on another state’s energy, regulation and diplomacy.
For customers, the relevant distinction is between having another region on a diagram and being able to run elsewhere with sufficiently current data. Tested restoration time, backups and dependency knowledge matter across war, sabotage, fire, flood and grid failure. At the October 9 reporting point, two-site disruption was confirmed; permanent data loss, the fate of the supercomputers and the ultimate recovery duration were not.
Sources
First-strike reporting · Second-strike reporting · Yandex October 9 statement · Network and service disruption reporting · Infrastructure and national-connectivity context · Original reporting aggregation entry