Ukraine hits Russian data centres in blow to Moscow's AI capabilities

Ukrainian drones struck five data centres belonging to Russia's largest technology companies in October, causing widespread failures in cloud services, payment systems and navigation apps nationwide.

The Ukrainian armed forces hit three Yandex facilities: in Sasovo in the Ryazan region on 7 October, in Kaluga on 9 October, and in Vladimir on 11 October.

On 14 October a Sber data centre in Balakovo in the Saratov region was struck, and on 18 October a VKontakte data centre in the Leningrad region near St Petersburg came under attack.

Yandex, Sber and VKontakte together run much of Russia's consumer internet infrastructure, from taxi apps and card payment processing to cloud storage and messaging.

None of the companies has disclosed the scale of the damage. Russians have reported persistent difficulties paying for goods, ordering taxis, using navigation services and accessing cloud storage.

Experts say restoring the infrastructure could take months or years, and the strikes have set back Russia's artificial intelligence development, Mikhail Klimarev, head of the Internet Protection Society, told AP.

Russia continues to target Ukraine's IT sector

The attacks come as Russia has itself been systematically targeting Ukrainian data centres this autumn.

On 19 October a Russian strike completely destroyed one of the largest facilities of the Ukrainian operator Datagroup in Kyiv, which was declared beyond repair.

The following day a Russian attack damaged Kyiv's GigaCenter. Russia hit several other Ukrainian data centres in September and October.

An earlier Russian strike on a Kyiv data centre in July disrupted internet access, mobile communications and television across the city.

Moscow has targeted Ukraine's IT systems since day one of Russia's full-scale invasion: cruise missiles struck a government server facility on 24 February 2022, and a Russian missile hit the National Data Backup Centre in central Kyiv on 1 March.

Ukraine has since moved most of its data to servers in European countries, limiting the impact of subsequent attacks.

Russian data centres are more vulnerable than Ukrainian ones, analysts say. Under legislation designed to create a so-called "sovereign internet," Russia requires companies to store all data on servers inside the country. That concentration makes the facilities easier to target.

"Russia's problem is that it has to provide air defence over a vast territory, and it does not have enough resources for that," said Nick Reiners, senior geo-technology analyst at Eurasia Group.

"Since all the infrastructure and all the data are located inside Russia, it is relatively easier to disable them." Why air defence systems were not protecting Russian data centres, or failed to do so, has not been explained.

Sensitive to fire

Analysts describe the facilities as soft targets: vast halls filled with servers, power equipment and cooling systems where even a small explosive charge can cause serious damage.

Satellite imagery of the struck Yandex facilities shows fires that may have destroyed microchips and other fragile components.

"After such a strike it is hard to expect anything to have survived: data-centre equipment is fragile, demanding and expensive. Soot from fires is extremely harmful to electronics," Klimarev told AP.

The damage to Yandex is particularly significant for Russia's AI ambitions. The company's three supercomputers, used to develop AI models, rank among the world's top 500. The most powerful, housed in the Sasovo facility, once ranked 19th globally but has since fallen below the top 100.

"Ukrainian drone strikes will probably delay the development of Russian artificial intelligence even further," Connor Martin of the Council on Foreign Relations said. Before the strikes, Russia was already several years behind the US and China.

Restoring the hardware will be complicated by Western sanctions and the global chip shortage. Yandex's supercomputers run on Nvidia A100 processors, which Russia cannot legally import.

Klimarev said the strikes may carry an unintended consequence for Russian internet policy.

"Paradoxically, the attacks on data centres have saved the Russian internet from isolation, because companies will now be forced to move their computing resources, most likely to Europe," he said.

"It is quite likely that many Russian companies are now studying the European market in search of opportunities to rent computing capacity," Klimarev said. He added that Russian authorities might ease their attempts to tighten internet controls to limit the economic damage.

Infrastructure for malign purposes

Moscow has for years actively used its IT sector for spying on its users, as well as conduct malign hybrid operations elsewhere.

Under Russia’s SORM legislation, all domestic internet companies including Yandex, VKontakte and Sber are legally required to install FSB backdoors giving the security services access to user data and communications.

These data centres are integrated into Russia’s surveillance apparatus, not purely commercial infrastructure.

VKontakte specifically has been extensively used for state-sponsored propaganda and recruitment. Ukraine banned it in 2017 partly on those grounds.

The Kremlin has demonstrably used AI tools in its disinformation operations, such as rewriting real news articles with pro-Kremlin slants and fabricated claims, publishing them across dozens of sites designed to mimic legitimate international outlets, including Euronews.

It has also used AI-generated video and audio to fabricate statements attributed to Western officials. AI-cloned voices impersonating European politicians have also circulated, though some were detected before they spread widely.

More recently, it has flooded the internet with repetitive pro-Kremlin content to skew what AI chatbots retrieve and eventually how they are trained. NewsGuard stress tests found chatbots repeated false claims in roughly a third of responses when prompted adversarially.

Researchers at the Carnegie Endowment have however stated that training-data poisoning is slow, heavily filtered and increasingly countered by behavioural rules built into newer models.

EU sanctions prohibit the supply of IT services, software and cloud capacity to Russian companies.

Firms seeking to circumvent the restrictions have used intermediaries, anonymous hosting providers or foreign corporate structures. Brussels has been tightening enforcement of those rules.