AI Data Centres Become Targets: Russia and the Gulf Respond
Data centres are now physical targets, and two regions show what that costs. Yandex, a leading private Russian tech company, withdrew its 2026 financial forecast on 29 October after drone strikes on its data centres. In the Gulf, Amazon Web Services says it cannot restore its Bahrain region, yet Oracle and others are adding capacity there. Both answers point the same way: spread the risk.
Key takeaways
- Russia: Yandex said on 29 October that several of its data centres were hit by drones in October, withdrew its 2026 revenue and adjusted EBITDA forecasts, and will not raise capital spending this year [1].
- Russia: the Ministry of Digital Development approved drone-protection recommendations for data centres, according to Kommersant, citing a government document (reported by Kommersant and relayed by The Moscow Times, not independently confirmed) [7][3].
- Gulf: in September AWS said it could not restore its Bahrain region or one of three UAE zones, according to Reuters [9]; on 29 October Oracle said it is adding data centres in the UAE and Saudi Arabia [10].
- Positions differ: Ukraine says its strikes answer Russian attacks on its own data centres [3]; Iran has threatened Gulf facilities, according to Al Jazeera [8]. We report these statements and cannot verify them independently.
What happened in Russia
Yandex's own results release says several of its data centres were attacked by drones in October and part of its infrastructure was damaged [1]. The company has restored key features of all services but is still working to bring back full functionality [1]. It withdrew its 2026 revenue and adjusted EBITDA forecasts, saying the attacks make results hard to assess, and will consider resuming forecasts from next quarter [1]. It also says it will not increase capital spending this year, having built reserve capacity in advance [1].
The Moscow Times reports the strikes ran from 8 to 11 October and disrupted ride-hailing, delivery, maps, email and banking services; it also reports Yandex had forecast about 20% revenue growth [5]. Moscow's city news service names three sites hit: Sasovo (8 October), Kaluga (9 October) and Vladimir (11 October) [6]. Third-quarter revenue of 411 billion rubles, up 12%, predates the strikes [1].
On 26 October Yandex said its three supercomputers are being moved to new sites and will keep training foundation models [2]. The Moscow Times reports they were unharmed [3]. It also reports that Ukraine says it is responding to Russian attacks on its data centres, and that Sberbank said a data centre it is building in Saratov region was targeted overnight into 14 October, while its banking systems kept running [4].
Moscow's policy response is concrete. President Putin told a 14 October security meeting that cyberthreats had reached a new level amid what he called direct and hybrid acts of aggression [11]. Kommersant, citing a government document, says the ministry then approved drone-protection recommendations for data centres; The Moscow Times relays the measures: underground siting for the most critical sites, blast-resistant structures, electronic warfare, backups and coordination with the military and National Guard [7][3]. Kommersant adds that critical sites fall into tiers K1 to K3 by how long a failure disrupts state or economic functions. We could not confirm the document independently (reported by Kommersant, not independently confirmed) [7].
What happened in the Gulf
AWS told customers in September that damage in Bahrain spanned several availability zones and "exceeded what our regional and multi-AZ services are designed to withstand," according to a status update seen by Reuters [9]. It could not restore data held only in one UAE zone, and promised a Bahrain update in early 2027 [9]. Al Jazeera reported on 13 October that Iran's security chief had warned that regional data centres and cables could be attacked if war resumes, and that an expert says threats would change the economics and geography of AI investment rather than end it [8].
Investment continues. Microsoft announced on 23 September more than $10 billion of spending through 2030 in Kuwait, Qatar, Saudi Arabia and the UAE, plus over $400 million for subsea and land connectivity, and a digital-resilience programme [12]. Oracle's executive said it is adding data centres in the UAE and Saudi Arabia and is reluctant to publish their locations [10]. Semafor, citing a Bloomberg economist it links but we could not open, says hardened security adds 5% to 7% to costs [13].
Why the architecture matters
Cloud providers split a region into availability zones: separate clusters of data centres designed so one failure does not stop the service. AWS's own wording shows the limit: that design handles accidents, not correlated attacks on a whole region [9].
Two answers are emerging. One is hardening: go underground, add blast protection and electronic warfare, as the Russian recommendations propose [7][3]. The other is distribution: Yandex says it is moving to a more distributed model [1], Oracle describes "digital embassies" that let a sovereign cloud be moved abroad while keeping its legal status [10], and Al Jazeera's expert says real resilience may need sites outside the Gulf [8].
The tension is sovereignty. Governments want data to stay local, yet local sites share one threat. The National reports banks would need regulatory approval to use the embassy model [10].
Cost is not yet settled. Kommersant says market players expect Russian provider prices to rise about 10% before inflation (reported by Kommersant, not independently confirmed) [7]; Semafor's 5% to 7% figure is a Gulf construction-cost estimate [13]. They measure different things and should not be compared directly.
What to watch next
- Yandex: whether it restores forecasts from the next quarter [1].
- AWS: an update on the UAE zone "in the coming months" and on Bahrain in early 2027 [9].
- Russia: how the drone-protection recommendations are enforced and what they cost operators [7].
- Gulf: whether other providers publish site locations or follow Oracle's approach [10].
Our take
Our analysis: investors have priced data centres as buildings, not as targets. The next test is disclosure: whether providers publish how many sites a region can lose, as regulators already ask banks about concentration risk.
FAQ
Are Yandex's AI services working? Yandex says all services are restored with key features and engineers are working on full functionality [1].
Were Yandex's supercomputers damaged? The Moscow Times reports they were unharmed; Yandex says it is moving them [2][3].
Is AWS Bahrain back? No. AWS said it could not restore it and would update in early 2027 [9].
Sources
- Yandex announces Q3 2026 financial results (press release, Russian, PDF), Yandex, 29 October 2026. Primary (company statement).
- Yandex statement on moving its supercomputers (Russian), Yandex on Telegram, 26 October 2026. Primary.
- Yandex Supercomputers Unscathed After Ukrainian Strikes, Company Says, The Moscow Times, 26 October 2026. Independent, exile-based outlet.
- Ukrainian Drones Hit Sberbank Data Center After Yandex Attacks, The Moscow Times, 14 October 2026.
- Yandex Suspends 2026 Guidance After Data Centers Come Under Fire, The Moscow Times, 29 October 2026.
- Минцифры РФ создало штаб по защите сетей связи (Russian), Moskva 24, 21 October 2026.
- Данные прикроют с воздуха (Russian), Kommersant, October 2026 (reported by The Moscow Times on 26 October).
- Iran threatens Gulf data centres: How exposed is the region's internet?, Al Jazeera, 13 October 2026.
- Amazon AWS unable to restore access to Bahrain, one UAE cloud data zone after war, Reuters via Khaleej Times, 16 September 2026.
- Oracle opening more data centres in UAE and Saudi Arabia as AI demand soars, The National, 29 October 2026.
- Meeting on improving information security, Kremlin, 14 October 2026. Primary (official position).
- Microsoft strengthens its commitment to the Middle East, Microsoft, 23 September 2026. Primary (company announcement).
- Oracle among AI firms forging ahead with Gulf expansion, Semafor, 30 October 2026.
AI Worldwire is independent and has no commercial relationship with the companies covered, unless stated. Research and drafting are assisted by AI; every article is reviewed and approved by a human editor before publication. Subscribe to the AI Worldwire newsletter. Last updated: 1 November 2026.