---
title: "Ukraine Hits a Fourth Russian Data Center in a Week, and the Law Hasn’t Caught Up"
description: "After Iran’s March strikes on AWS and Russia’s on Ukraine, data centers are now a standing target class — with no settled rule for when hitting one is legal."
author: "Luis Goa"
published: 2026-10-15T18:17:04.424Z
modified: 2026-10-16T05:41:38Z
url: https://rews.cc/a/ukraine-hits-a-fourth-russian-data-center-in-a-week-and-the--d95cc7
language: en
tags: ["war", "drones", "ai", "cybersecurity", "shipping", "world", "europe"]
publisher: "Rews (https://rews.cc)"
---

# Ukraine Hits a Fourth Russian Data Center in a Week, and the Law Hasn’t Caught Up

*After Iran’s March strikes on AWS and Russia’s on Ukraine, data centers are now a standing target class — with no settled rule for when hitting one is legal.*

By Luis Goa · October 15, 2026 · https://rews.cc/a/ukraine-hits-a-fourth-russian-data-center-in-a-week-and-the--d95cc7

## In brief

- Ukraine struck a Sberbank data center in Balakovo on Oct 14, 2026, its fourth hit on a Russian data center in a week
- Three prior Ukrainian strikes since Oct 8 knocked out 2 of Yandex’s 6 Russian data centers, disrupting taxi and banking apps
- Iran’s March 2026 strikes on AWS facilities in UAE and Bahrain caused permanent, unrecoverable data loss, AWS said Sept 15
- UAE is redesigning a 5GW Abu Dhabi data-center project into a dispersed, partly underground network after the Iran strikes
- Los Alamos and the University of Michigan dispute a Michigan township’s “high value target” label for a planned $1.25bn computing site

Ukrainian drones hit a Sberbank data center under construction in Balakovo, in Russia’s Saratov region, on October 14, 2026 — the fourth Ukrainian strike on a Russian data center in a week that began October 8, and the first to hit Sberbank rather than Yandex. The site is a $1-billion-plus project — 122.2 billion rubles, [Ukraine’s military-linked outlet UNITED24 Media reported](https://united24media.com/war-in-ukraine/ukraine-hits-russias-1-billion-sberbank-mega-data-center-in-new-drone-strike-23416) — built for 3,000 server racks, up to 120,000 servers and 82 megawatts of load on roughly 60,000 square meters, [per Kyiv Independent](https://kyivindependent.com/ukrainian-drones-reportedly-hit-sberbank-data-center-in-russia/), with construction begun in 2020. Sberbank’s first deputy chairman, Alexander Vedyakhin, confirmed the strike and said systems kept running and no staff were hurt; Russian outage monitors nonetheless logged a spike in complaints about the banking app.

The three prior strikes, starting October 8, hit Yandex data centers in Sasovo, Kaluga and Vladimir — three of the six facilities Russia’s largest internet conglomerate runs in-country. Two went offline entirely. Yandex runs the taxi, bus, payment, dating, email and cloud services much of the country uses daily, so the outage reached well past any battlefield system. Researcher ChrisO\_wiki, who translates Russian social-media posts, [documented the knock-on effects](https://404media.co/data-centers-are-war-targets-now/): “A taxi driver from Yekaterinburg says that after the service disruptions, he can no longer view his order history, and the status of trips is updated with a delay.” Electronic document management for incoming goods also broke, hitting manufacturers and distributors.

Set against this year’s other infrastructure strikes, the pattern is a pattern. Iran hit two Amazon Web Services facilities in the United Arab Emirates and damaged a third, in Bahrain, in March. Russia has hit Ukrainian data centers since September, disrupting television and internet access. And the day the Sberbank news broke, a ship caught fire in Romania’s Black Sea waters, with authorities investigating possible drone involvement — one more suspected hybrid attack that has nothing to do with data centers specifically, [Reuters reported via Al Jazeera](https://aljazeera.com/news/2026/10/15/ship-catches-fire-in-romanias-waters-amid-rising-attacks-in-the-black-sea), but everything to do with the same logic: anything load-bearing for an economy is now a target.

![A city skyline rests atop a server rack against a yellow background, with a large red airplane shadow stretching across the ground.](https://rews.cc/img/4c3b73712f778ec8dc1d8efcdb902dbe4076fd3f.webp)

## What counts as a lawful target

None of this has settled into a clear rule because data centers are almost always dual-use: the same rack can hold a ministry’s email and a grocery-delivery backend. Klaudia Klonowska, a researcher on emerging technologies and international law, told [404 Media](https://404media.co/data-centers-are-war-targets-now/) a facility is a lawful military target only when used for military purposes, and even then attackers rarely know that with confidence. Russia’s defense ministry claimed its September strikes hit sites processing “intelligence data for the Ukrainian Armed Forces” and, per state-backed outlets, Palantir-linked data; Ukraine denied it. Neither side has produced evidence the other’s lawyers would accept — which is itself Klonowska’s point: commercial cloud’s dual-use design makes the targeting claim nearly impossible to verify from outside.

> Why have we gotten to the point where we have permitted militaries of various states to use civilian commercial data centers for their military purposes? By potentially using them and relying on them, they have opened them up to the possibility of becoming military targets.

Klonowska’s harder point is proportionality: the civilians hurt by a data-center strike vastly outnumber whatever military users share the racks. Losing cloud access for weeks hits hospitals, traffic systems, judicial filings and emergency dispatch — none of it a legitimate target on its own. Ukraine’s own framing leans on retaliation rather than military necessity: Volodymyr Zelensky [told Ukrinform](https://www.ukrinform.net/rubric-ato/4172719-zelensky-confirms-strikes-on-oil-refineries-in-omsk-and-ukhta-one-more-data-center.html) the Yandex strikes were “our symmetrical response” to Russian attacks on Ukraine’s own data centers — an argument about reciprocity, not about what Sasovo was actually processing. Retaliation, Klonowska told 404 Media, “is not enough under law” to make a target lawful.

![Large scissors cut branching cords connected to a baby carriage, lamp, grocery bag, and small tank against a blue background.](https://rews.cc/img/92ac4d13d639a56f4691b3c4c940450871625951.webp)

Zelensky has also claimed a side benefit: at the Warsaw Security Forum, he said that once strikes reached Yandex’s data centers, “it suddenly became a little easier to breathe on many social media platforms... there was less hate, less division, and fewer provocations because there were fewer bots,” in [a post on X](https://x.com/ZelenskyyUa/status/2109602415397749044). [RFE/RL reported](https://www.rferl.org/a/zelenskyy-says-yandex-strikes-crippled-pro-kremlin-bots-but-tech-experts-call-evidence-weak/33875054.html) that technologists found the evidence for a measurable drop in bot activity weak — a strike’s political framing and its measured technical effect are two different numbers, and only one has been produced.

## Rebuilding around the target

Amazon’s Gulf experience is the clearest data point on what a strike costs a cloud operator, because AWS put a number on it. [CNBC reported](https://www.cnbc.com/2026/09/15/aws-cant-restore-service-to-bahrain-uae-6-months-after-iran-strikes.html) that six months after the March strikes, AWS told customers it could not restore its entire Bahrain region (me-south-1) or one of three availability zones in the UAE — a permanent loss of customer data across two countries. [Insurance Journal](https://www.insurancejournal.com/news/international/2026/09/16/885283.htm) noted Amazon had suspended billing in both regions and warned Gulf operations would stay “unpredictable.” An availability zone is the unit cloud architecture is built to survive losing; a zone becoming permanently unrecoverable to a drone strike is outside the failure modes multi-AZ redundancy was designed for.

The UAE has responded by redesigning, not just rebuilding. [Reuters reported](https://www.al-monitor.com/originals/2026/09/exclusive-uae-revises-ai-data-center-plan-after-iranian-attacks-sources-say) the country is quietly revising a 5-gigawatt AI data-center project originally planned as a single 10-square-mile Abu Dhabi campus with Oracle, Nvidia and Cisco, looking instead at a network of smaller sites — including underground and mountain locations in Ras Al Khaimah and Fujairah — plus added air defenses. The first phase, the $30-billion, 1-gigawatt Stargate UAE cluster, proceeds regardless, with its first 200 megawatts due online this year; construction underway isn’t being undone, only everything after it.

**How the UAE redesigned a 5GW buildout** After Iran's March strikes on nearby AWS sites

| From | To | How |
| --- | --- | --- |
| 5GW Abu Dhabi megacampus announced | Iran strikes 2 AWS facilities, March 2026 | 6 months later |
| Iran strikes 2 AWS facilities, March 2026 | UAE reviews critical-infrastructure siting | triggers |
| UAE reviews critical-infrastructure siting | Distributed network: underground & mountain… | produces |
| 5GW Abu Dhabi megacampus announced | Stargate UAE phase 1 proceeds: 1GW, $30bn | unaffected, construction continues |

![How the UAE redesigned a 5GW buildout. After Iran's March strikes on nearby AWS sites](https://rews.cc/img/5fa6a458986bd4ab419ced1f9c74a92ad92c8fbb.webp)

Based on [Reuters, via Al-Monitor](https://www.al-monitor.com/originals/2026/09/exclusive-uae-revises-ai-data-center-plan-after-iranian-attacks-sources-say)

Emily Harding, who directs the Intelligence, National Security, and Technology Program at the Center for Strategic and International Studies, told [Time](https://time.com/article/2026/10/15/why-data-centers-have-become-military-targets/) the ambiguity goes beyond engineering: “If you’re Russia and you attack a Microsoft data center, is that an attack on Ukraine? Is that an attack on Microsoft? Is that an attack on a U.S. company and, by extension, the U.S.?” The U.S. has historically treated an attack on an American company’s facility as distinct from an attack on the United States. Harding expects that line to get harder to hold, with competitive consequences: “You could see a time in the future where Amazon starts losing business to Microsoft because Microsoft does a better job of hiding where their data centers are.”

## The targets at home

The same logic is showing up in U.S. zoning fights, minus the drones. Los Alamos National Laboratory and the University of Michigan are planning a $1.25 billion research computing center on Textile Road in Ypsilanti Township, Michigan. The township passed a resolution in March designating the site a “Tier I High Value Target Risk,” a likely target for “foreign adversaries, terrorist organizations and other ‘home grown’ hostile actors.” Los Alamos director Thom Mason wrote to residents in September that the township’s attorney had invented the designation “without basis,” adding it “should not be interpreted as evidence of a known, specific, or imminent threat.” The township attorney, Doug Winters, [told 404 Media](https://www.404media.co/we-did-not-invite-you-citizens-rage-at-town-hall-over-proposed-nuclear-ai-data-center/) he found it “a silly thing to say that, somehow, I made up the term,” asking how a facility tied to “Los Alamos — the worldwide name associated with the atomic bomb” with “$1.2 billion worth of computers” would not be a high-value target.

Ypsilanti’s fight is one of many: [hundreds rallied across Washington state](https://rews.cc/a/hundreds-rally-across-washington-state-for-a-moratorium-on-d-30405b) this month for a moratorium on new data-center construction, and the build-out behind these disputes keeps accelerating regardless — [CoreWeave’s chief executive said](https://rews.cc/a/us-companies-build-gigawatt-scale-data-centers-as-ai-drives--2df53f) AI data-center orders were unaffected by the backlash, part of hundreds of billions of dollars a year in U.S. construction spending the Time piece cites as the scale of current AI investment. None of that schedule assumes drones.

What hasn’t happened yet, in any of this year’s confirmed strikes on Russian or Gulf facilities, is a case tested in an international court that settles whether a dual-use commercial data center was a lawful target. Until one is, every government deciding whether to harden, disperse or bury its next data center is making that call on its own reading of a legal gray zone, not on precedent. The next number worth watching isn’t how many more facilities get hit — it’s how many of those strikes anyone bothers to litigate.

## See also

- [Ypsilanti Township's data center documentation page](https://files.ypsitownship.org/government/boards___commissions/board_of_trustees/data_center_information.php) — files.ypsitownship.org · Township's full record of resolutions and correspondence on the Los Alamos/U-M site
- [Why Ukrainian drones keep hitting Russia's biggest data centers](https://meduza.io/en/feature/2026/10/14/ukrainian-drones-are-hitting-russia-s-biggest-data-centers-why-are-they-so-vulnerable-and-can-anything-protect-them) — meduza.io · Meduza's technical backgrounder on why Yandex and Sberbank sites are so exposed
- [Vive la révolution: France's AI data-center build-out](https://www.datacenterdynamics.com/en/analysis/france-ai-data-center-build-out-emmanuel-macron/) — datacenterdynamics.com · How France's state-backed data-center strategy, including military-only sites, took shape

## Sources

- [Data Centers Are War Targets Now](https://404media.co/data-centers-are-war-targets-now/) — 404media.co
- [Ship catches fire in Romania's waters amid rising attacks in the Black Sea](https://aljazeera.com/news/2026/10/15/ship-catches-fire-in-romanias-waters-amid-rising-attacks-in-the-black-sea) — aljazeera.com
- [Why Data Centers Have Become Military Targets](https://time.com/article/2026/10/15/why-data-centers-have-become-military-targets/) — time.com