Websites down and bots disabled: The unexpected consequences of bombing data centers

Ukraine has struck a major blow to Russia’s digital infrastructure. Since last Thursday, Ukrainian drones have carried out a series of attacks that destroyed three large data centers belonging to Yandex — known as “the Kremlin’s Google”— on the outskirts of Moscow. The Yandex Taxi ride-hailing app and the group’s payments service, Yandex Pay, have been temporarily taken offline. Ukrainian President Volodymyr Zelenskiy even said the bombings disabled Russian bots.

This is not the first time a regular army has targeted data centers. According to repeated complaints by Kyiv, Moscow has been doing so since March. And before Russia, Iran did it as well. On February 28, after coming under attack from the U.S. and Israel in the bombings that marked the start of the war, Tehran used drones to destroy three commercial Amazon Web Services (AWS) data centers in the United Arab Emirates and Bahrain. The attack disrupted regional cloud services and affected payment systems across the Persian Gulf. It also triggered a cascading effect that was felt across several AWS availability zones, including in various countries in the Americas and along the U.S. East Coast.

The fact that Russia and Ukraine are destroying each other’s data infrastructure, and that Iran chose to strike these facilities as soon as the war began (there have also been reports of bombings in the United Arab Emirates and Saudi Arabia), shows that data centers are increasingly in the crosshairs.

“Data centers are secondary targets, right after the obvious military sites,” Matt McCrann, a former executive at counter-drone firm DroneShield with experience in the United States and the Middle East, told Forbes. It also illustrates another point in Iran’s case: in the modern era, not even a distance of 7,000 miles guarantees immunity from retaliation.

“The attacks showed that physical distance from a conflict zone is no guarantee of insulation from the impacts of kinetic warfare,” says Tomáš Foltýn, an analyst at the cybersecurity company ESET.

The Iranian strike on the three AWS data centers did more than disrupt services in the Middle East and elsewhere, including the United States, where platforms such as Snowflake, Anthropic’s Claude, and some financial applications experienced outages or degraded performance. The drones also permanently destroyed some of the data stored in those facilities, something that does not appear to have occurred in the case of the Russian data centers.

The attack served as a reminder that so-called cloud computing is ultimately just a metaphor. Far from being ethereal, it relies on physical infrastructure. And when that infrastructure fails, everything can be lost.

A new military target

Data centers are the guts of the cloud: highly sophisticated facilities resembling industrial warehouses, packed with racks of servers, essentially computers as tall as wardrobes. These processors run software remotely, including streaming services, and store data such as files saved online.

This infrastructure is essential to the functioning of online services, from email and word-processing applications to banking platforms. If data centers did not store files and run software remotely, all of that computing power and storage would have to reside on users’ devices themselves. Smartphones would be incapable of doing nearly as much as they do today, and we would likely have to carry portable hard drives wherever we went.

In recent years, data centers have taken on a third role in addition to running software and storing data: training and operating artificial intelligence models, which requires equipping facilities with far more powerful microprocessors that also consume much more energy. That helps explain why academic Eliezer Yudkowsky, concerned that AI systems could one day rebel against humanity, has suggested humanity “be willing to destroy a rogue data center by airstrike” in countries that refuse to limit the computing power available to such systems.

Because they are highly technology-intensive facilities that also require an uninterrupted power supply, data centers are among the most expensive pieces of infrastructure in existence. And that makes them an attractive target.

“Attacking them makes a lot of sense from an Iranian military perspective. They are multibillion-dollar investments that emerged after Trump’s visit early in his term and are tied to other personal business interests of Trump and his family in the region,” says Colonel Ángel Gómez de Ágreda, author of Un mundo falaz. El nuevo orden global en la era de los algoritmos y la manipulación (A False World: The New Global Order in the Age of Algorithms and Manipulation).

Gómez de Ágreda agrees that data centers are already among military targets. “One could also argue that data centers are legitimate [noncivil] targets, since they provide support to military operations,” he says.

Permanent data loss

Any company can rent server space from a cloud provider to store its data. AWS is the global market leader, with a 28% share, followed by Microsoft Azure (21%) and Google Cloud (14%), according to data from Synergy Research Group. Companies generally choose data centers located as close as possible to the markets they serve in order to reduce latency, the time it takes for data to travel from a device to a server and back.

One of the keys to Netflix’s expansion, for example, was signing long-term agreements with AWS, allowing it to rely on the company’s global infrastructure so that its streaming service performed reliably in virtually every country.

Both AWS and its competitors typically build data centers in groups of three, known as an availability zone: three nearly identical facilities located a few miles apart so that if one fails, operations can continue through the other two. Data is also replicated across those sets of data centers in case something happens.

But there is a major difference between a power outage or a technical failure at one facility and the simultaneous destruction of all three by missiles. That is what Iran has done over the past six months in several waves of attacks, and what Ukraine has now done in Russia.

Is there any way to protect against the potential loss of data? AWS sources say the company’s recommendation is that critical workloads — those whose loss could disrupt operations, such as airline or banking systems — should always be replicated. Copies can be stored in other data centers within the same country or in different countries. Naturally, doing so is more expensive than maintaining no backups. “The final decision rests with the client,” those sources say.

Since the Iranian bombardments began, AWS has urged customers to migrate their data to other regions. Company representatives say that most have done so and have been able to restore their operations elsewhere using backups. But those that stored their data exclusively in the affected facilities have lost it. After working throughout the summer to recover the information, the technology company announced on September 15 that it was impossible to recover some of the data.

The identities of the affected companies have not been disclosed. What is known is that the businesses that lost data were based in the Middle East. And because payment systems were disrupted, it is believed that banks and payment-processing firms were among those affected. Iran also claimed to have hit Israeli companies, although that was never confirmed. AWS has kept the names of the affected customers confidential.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition