Ukraine has dealt a major blow to Russia's digital infrastructure. Since last Thursday, Ukrainian drones have launched a series of attacks that have destroyed three large data centers of Yandex, known as “the Google of the Kremlin”, on the outskirts of Moscow. The passenger transport application Yandex Taxi and the group's payment service, Yandex Pay, have temporarily stopped working. Ukrainian President Volodymyr Zelensky even claimed that the bombings disabled Russian bots.
It is not the first time that a regular army attacks data centers. Moscow has been doing so since March, as kyiv has denounced on several occasions. And, before Russia, Iran has done it. On February 28, after being the target of bombing by the United States and Israel that started the war, Tehran destroyed three Amazon Web Services (AWS) commercial data centers in the United Arab Emirates and Bahrain with drones, which caused problems in the operation of cloud services in the region and affected payment systems in the Persian Gulf. The attack had a cascading effect that was felt in several AWS availability zones, including different countries in America and the east coast of the United States.
The fact that Russia and Ukraine are mutually destroying these infrastructures, and that Iran decided to attack these facilities as soon as the war began (there is also talk of bombings in the United Arab Emirates and Saudi Arabia), shows that data centers are in the crosshairs.
“Data centers are secondary targets, right after the obvious military sites,” Matt McCrann, a former executive at the drone defense company DroneShield, with experience in the United States and the Middle East, told Forbes. It also illustrates another issue, in the case of Iran: in the modern era, even a distance of 11,000 kilometers is not a guarantee of impunity. “The attacks showed that physical distance from a conflict scenario is no longer a guarantee of not receiving the impacts of war,” says Tomáš Foltýn, ESET analyst.
The Iranian bombing of the three AWS data centers not only caused service interruptions in the Middle East and other parts of the world, such as the United States, where services such as Snowflake, Claude (from Anthropic) or some financial applications worked with difficulty. The drones also forever destroyed some of the data stored in those facilities, something that is not clear has happened in the case of the Russian data centers. The attack served as a reminder that so-called cloud computing is just a metaphor: far from being ethereal, it consists of physical infrastructures. If these fail, everything can be lost.
A new military objective
Data centers are the guts of the cloud: facilities similar to state-of-the-art industrial warehouses full of server racks (a type of tall computers like cabinets). Remote programs, such as streaming services, are run on these processors and data is stored, such as files saved online. That is essential for the operation of online services, from email to a text editor or a banking application: if data centers did not save files and execute programs remotely, these would have to be physically hosted on the devices. It would be impossible for cell phones to do so many things; We should carry portable hard drives with us.
In addition to running programs and hosting data, data centers have recently added a third function: training and executing artificial intelligence (AI) models, which requires equipping the data center with much more powerful (and more energy-consuming) microprocessors. Hence, academic Eliezer Yudkowsky, concerned that AI systems could rebel against humanity, has suggested the option “destroy the data centers with an air attack” of countries that do not limit the computing power of these programs.
Being high-tech intensive facilities, which also require an uninterrupted supply of energy, data centers are some of the most expensive infrastructures there are. And that makes them an attractive target. "Attacking them makes a lot of sense from the Iranian military point of view. They are billion-dollar investments that arise from Trump's visit at the beginning of his mandate and that are associated with other personal businesses of Trump and his family in the region," says Colonel Ángel Gómez de Ágreda, author of A False World. The new global order in the era of algorithms and manipulation (Planet).
Gómez de Ágreda agrees that data centers are already among military objectives. “It can also be argued that data centers are legitimate (non-civilian) targets, since they provide support to military operations,” he adds.
Permanent data deletion
Any company can contract space on its servers with a cloud service operator to store data. AWS is the world market leader, with a 28% share, followed by Azure, Microsoft (21%), and Google Cloud (14%), according to data from Synergy Research Group. Typically, companies opt for data centers as close as possible to the market in which they operate to reduce latency (the time it takes for a set of data to travel from a device to a server and back). One of the keys to the success of Netflix's expansion, for example, was establishing long-term agreements with AWS itself, which allowed it to use its global infrastructure, so that streaming worked reasonably well in practically any country.
Both AWS and its competitors usually build data centers three by three, in what they call availability zone: three practically identical facilities a few kilometers away, so that if one of them fails, activity continues thanks to the other two. Data is also replicated across those sets of data centers in case something happens.
But it is one thing for the power supply to fail or the operation of a facility to be interrupted due to a breakdown, and quite another for all three to be destroyed at the same time with missiles. That is what Iran has done in the last six months with several waves of attacks, and what Ukraine has just now done in Russia.
Is there a way to protect against possible data loss? AWS sources assure that their recommendation is that critical data loads (those that could interrupt the company's operations, such as airlines or banking) always be replicated. It can be done in other data centers within the same country or in other countries. Of course, the cost of doing so is higher than not having copies. “The final decision is the client's,” say those sources.
Since the bombings in Iran began, AWS has urged its customers to migrate their data to other regions. Most have done so, the company says, and have been able to restore their operations in other regions from backup copies. But those who had their data there exclusively have lost it. After working on it all summer, the technology company reported on September 15 that it was impossible to recover part of the data.
It has not been revealed which companies are among those affected. It is known that those that have lost data are companies in the Middle East. And, as payments were interrupted, it is believed that those affected are banks and payment method entities. Iran said it also hit Israeli companies, although this was not confirmed. AWS has kept the names of affected customers secret.
