During the war in Iran, we looked at the attacks on data centers and at the fact that they were becoming new targets. A problem for the Western world, which has put these data centers in the heart of cities and in areas where they don't necessarily have the level of protection they should.
If war evolves with drones and the use of AI, it will inevitably pick data centers as new tactical and strategic targets. Most of the Internet's infrastructure was designed in peacetime, with a logic of cooperation. That is, after all, the Internet's reason for being: carrying packets of data from point A to point B on the network.
The Ukrainian attack on Yandex's data centers, together with the confirmation, in the Gulf, that a great deal of data hosted there is permanently lost, forces us to revisit the subject seven months on.
High-intensity war on digital infrastructure raises many problems for leaders.
How do we judge whether this new doctrine of war will take hold? What recourse is there? And how can you respond when your strategic data and compute end up sitting at the heart of a foreign power's military target?
To read part one (in French):
Post-mortem of the digital Gulf war
On March 1, Iranian drones struck two data centers of Amazon Web Services (AWS), Amazon's cloud, in the United Arab Emirates. A third, in Bahrain, was damaged by a strike nearby. A news agency linked to the Iranian regime claimed these centers were targeted for "supporting the enemy's military and intelligence activities."
Why AWS?
Bahrain hosts the headquarters of the US Navy's Fifth Fleet, and the whole region falls under the US military's command for the Middle East, CENTCOM. Iranian state media described AWS's data centers in Bahrain as "the digital eye of CENTCOM."
AWS is also one of the Pentagon's main cloud providers. But no independent source has established which military applications were actually running in those buildings.
A few days later, Iran went further. It published a list of 29 technology targets in Bahrain, the Emirates, Qatar and Israel: sites belonging to AWS, Microsoft, Google, Nvidia, Oracle and Palantir, presented as legitimate military infrastructure. It is no longer only armies that are targeted, but the American tech companies that work for them.
AWS reported structural damage, power outages and fires. It asked its customers to activate their recovery plans, in other words to run their services elsewhere: first by copying their critical data to data centers in other countries, then by moving their services there, in the United States, Europe or Asia. The software company Red Hat advised its customers to restore from their backups, "ideally in Europe."
AWS and Microsoft also urgently looked for space in data centers in India, in Mumbai, Chennai, Hyderabad and Kochi, in particular for banks.
The data still had to get out. The undersea cables linking the Gulf to Europe run through the Red Sea and the Strait of Hormuz, which had both become war zones at the same time.
So the cloud giants leased fiber on an overland route: an optical fiber laid along Iraqi oil pipelines, from southern Iraq to the Turkish border. Its operator is extending it along Turkish gas pipelines, to reach Frankfurt, Amsterdam, London and Marseille directly.
In April, a second availability zone was knocked out in Bahrain. An availability zone is a group of data centers meant to take over when another one goes down. All of AWS's data centers in Bahrain then became unavailable. In July, the Revolutionary Guards claimed to have "destroyed" the site with cruise missiles.
On September 15, AWS took stock. In Bahrain, and in one of the three availability zones in the Emirates, it will not be able to restore data that was hosted only on site. That data is lost.
Those who had a copy elsewhere were able to restart, and AWS says this is the case for most of its customers. The others lost everything.
Yet as early as March, lawyers in the region were warning that taking a copy out of the country in the middle of a crisis could break data localization laws, which require certain data to stay within national borders.
A headache for every advocate of data localization in a country at war.
And beyond data, there is compute, in other words computing power. The chips that run AI cost a fortune, and they are now the most strategic equipment in a data center.
The Gulf has made compute the core of its strategy. Saudi Arabia, Qatar and the Emirates together planned AI data centers totaling 8 to 10 gigawatts, roughly the output of eight to ten nuclear reactors. Nvidia was to supply up to 600,000 graphics processors (GPUs), the chips used to train AI, to Humain, Saudi Arabia's AI champion.
The ambition was to become the place where the world would come to train and run its AI models, thanks to abundant, cheap energy.
Unfortunately, the strikes showed that these campuses are within range of Iranian drones and missiles, and that a company like Nvidia is now designated as a target. We have entered a different world.
The same story, this time in Russia
What happened in the Gulf seems to be playing out again since September between Russia and Ukraine, with one difference: the strikes go both ways.
Since mid-September, Russia has been striking Ukrainian data centers: those of Kyivstar, the country's largest mobile operator, then those of the hosting providers De Novo, MiroHost and Datagroup. On October 1, Parkovyi, one of Kyiv's large data centers, shut down all activity on its site. The Russian Ministry of Defense justified these strikes by saying the centers were processing intelligence data for the Ukrainian army. It is the same argument Iran used in March.
The next day, it posted on Telegram an image of a drone captioned "Digital detox," with the comment: "Mandatory!"
Ukraine's response came on October 8. Over four nights, Ukrainian drones hit three of Yandex's five large data centers (Yandex is often called the Russian Google): Sasovo, in the Ryazan region, then Kaluga, then Vladimir. More than 80 Yandex cloud services went down. Yandex Pay, its payment service, stopped working, and the head of the group's financial arm had to reassure Russians that their money was safe.
Yandex advised some taxi drivers to switch to Google Maps or Waze. The outages were felt as far as Kazakhstan and Armenia, where Yandex services are widely used.
What Yandex lost is not just storage. The Sasovo site houses two of its three supercomputers, Chervonenkis and Lyapunov, which train its AI models, including YandexGPT, the Russian equivalent of ChatGPT.
The third, Galushkin, is on the site in the city of Vladimir. All three run on Nvidia A100 graphics processors, a generation of chips released in 2020.
According to the independent Russian outlet T-Invariant, all three are out of service. Yandex, for its part, has not disclosed the state of the machines.
Because replacing them is a real problem. These chips are subject to US export controls. Russia can only obtain them in small quantities, on the gray or black market, in other words by getting around sanctions, and at a high price. An expert quoted by a Ukrainian outlet believes it "will not be possible to restore supercomputers of this level."
It is worth remembering that Yandex has had a turbulent history. After the invasion of Ukraine, its parent company, a Dutch company listed on Nasdaq, found itself caught between Western sanctions and the Kremlin. Its co-founder, Arkady Volozh, had to step down in 2022 after being placed on the European Union's sanctions list. He later called the invasion "barbaric."
I met Arkady twice at tech conferences, a person both very discreet and brilliant, and who managed to bounce back.
To get out of Russia, the parent company had to sell, and on Moscow's terms. The Kremlin imposes a discount of at least 50% on companies from countries that sanction Russia, including the Netherlands.
In July 2024, Yandex was therefore sold for 475 billion rubles, about 5 billion dollars, or half its market value, to the Russia-side managers of Yandex, to a fund owned by the oil company Lukoil and to three Russian investors. More than 95% of the company, its revenue and its employees went over to the other side, along with the Yandex brand.
The parent company kept only about 1,300 employees, a data center in Finland and four young businesses: self-driving cars, data for AI, online education and AI cloud. Renamed Nebius Group and based in Amsterdam, it has become an AI neocloud that rents out computing power on the latest Nvidia chips.
In September 2025, Microsoft ordered more than 17 billion dollars' worth of capacity from it.
But back to Ukraine:
Zelensky claimed the attack: it is the "response to Russia's operation against our data centers."
A senior Ukrainian official was more direct with Politico: the point was to show the Russians "that two can play this game."
Before the Duma, the lower house of the Russian parliament, Russia's digital minister, Maksut Shadayev, spoke of "unprecedented" attacks. According to a source quoted by the daily Kommersant, it will take up to six months to deliver replacement equipment. That equipment mostly has to be imported, while Russia is under sanctions, and two data centers were still offline a few days after the strikes.
On October 14, it was the turn of Sberbank, the country's largest bank. Drones targeted one of its data centers in the Saratov region, near a large nuclear power plant according to the Russian site CNews. The bank confirmed the attack and said its operations were not affected.
On the night of October 15 to 16, drones again targeted Yandex's Vladimir site. The Russian side says it repelled the attack. Satellite images published by Radio Free Europe show that five of the site's nine buildings had been damaged in the October 11 strike.
Meanwhile, Ukraine seems to be holding up. Parkovyi is destroyed, but its customers' data was already running on backup sites in the European Union.
This is no accident. A week before the 2022 invasion, the Ukrainian parliament had authorized the migration of public data to the cloud, including outside the country.
Russia made the opposite choice: since 2015, the law has required it to store its citizens' data on its own territory.
Russian bots down after the attacks on Russian data centers?
The strikes on Yandex had an unexpected effect: they reignited the debate about Russian propaganda bots. It is hard to separate truth from fiction, but for our paid subscribers, we'll go into detail.
Read the full article
Sign up now to read the full article and get access to all articles for paying subscribers only.
