At first, the attacks on Yandex's Russian data centers looked like another expansion of the battlefield. Then attention turned to the valuable computing hardware that might have been lost, and what that could mean for artificial intelligence development. By October 11, the story had acquired an entirely different dimension: some people in Kazakhstan could no longer book a ride or order a meal because a data center in Russia had been hit.
Thousands of kilometers and an international border separate the damaged facility in Vladimir from someone waiting for a taxi in Almaty. The border offered no protection against a failing app.
That is where the story becomes larger than the cost of the servers or the effectiveness of the drones. Kazakhstan was confronted with a tangible consequence of relying on an international technology platform whose computing infrastructure extends into Russia. The dependency became visible precisely when the system stopped working.
Three strikes in four days
During the night of October 7–8, 2026, a Yandex data center in Sasovo, in Russia's Ryazan region, was shut down after a drone attack. On October 9, the company reported damage to infrastructure at its data center in Kaluga. In the early hours of October 11, drones struck its facility in Vladimir, which was also taken completely offline. Yandex confirmed all three incidents and said no employees had been injured.
FACTUM.PRESS has already reported on the initial strike in Sasovo and the subsequent attack in Kaluga. We also examined what damage to Yandex's supercomputers could cost and what it might mean for the company's AI ambitions.
The extent of the physical damage remains uncertain. Two of the three supercomputers Yandex previously identified by name were housed in Sasovo. But shutting down a data center does not establish that its supercomputers have been destroyed. Yandex has not confirmed their loss or provided a timetable for restoring the affected facilities.
What is clear is that the disruption extended well beyond Yandex's own websites and applications. Companies that depend on its cloud services, and businesses that rely on digital platforms built on external infrastructure, encountered problems as well. Reuters reported disruptions affecting Russian companies and online services after the first two strikes. The third attack demonstrated how far the consequences could travel.
How a Russian outage reached Kazakhstan
On the morning of October 11, users in Kazakhstan reported that they could not book cars through Yandex Go, order food or access other company services. Drivers and couriers, whose livelihoods depend on the platform, were affected too. Reports of problems also emerged from other countries, including Kyrgyzstan, Belarus and Armenia.
Yandex Qazaqstan acknowledged the disruptions, attributing them to damage to the company's distributed infrastructure. Some functions began returning on the evening of October 11. Digital Business reported that ride-hailing was available again, although food delivery and some equipment-rental functions were still operating with restrictions. On October 12, Kazakhstan's deputy prime minister and minister of artificial intelligence and digital development, Zhaslan Madiyev, said the company was still stabilizing its services. He expressed hope that full functionality would return within two or three days, but the ministry's press office did not confirm that period as an official recovery estimate.
There is an apparent paradox. Kazakhstan requires its citizens' personal data to be stored within the country. The Ministry of Artificial Intelligence and Digital Development said that the servers holding Kazakh Yandex users' personal information were indeed located in Kazakhstan and were functioning normally.
But the ministry added an important qualification: some of the components needed to run the ride-hailing and delivery services were located outside Kazakhstan. In other words, personal data could remain intact and accessible on domestic servers while the service itself became unavailable.
That distinction matters. The outages are not evidence that Kazakh users' personal data was leaked or lost; no such loss has been substantiated. They do, however, demonstrate something else: storing information locally does not guarantee that a service will continue working when essential computing components abroad become unavailable.
Data at home, computing abroad
Booking a taxi looks simple from the passenger's side: open an app, check the fare, tap a button and wait for a car. Behind that interaction sits a more complicated system. It must match passengers with drivers, calculate prices and arrival times, dispatch requests, update routes and process payments. Keeping a passenger's personal details on a server in Kazakhstan is not enough to perform all those tasks.
Major digital platforms commonly distribute computing workloads across multiple data centers. That lets them serve several markets without building a fully independent technological stack in each country. It can be cheaper and, when properly designed, more resilient. But if an essential component lacks an independent, functioning backup, an incident at one site can disrupt services across all the markets that rely on it.
Nurbek Sadykov, the founder of qCloudy, told Digital Business that an international service can store personal information in one jurisdiction while performing computations in another. The Yandex disruptions made the practical consequences of that distinction difficult to ignore.
Kazakhstan's ministry made a similar point in more measured language: the domestic location of personal data and the operational resilience of a platform are two separate questions.
That may be the most consequential official observation to emerge from the entire episode. It does not mean Astana has decided to ban Russian digital services or sever ties with Yandex. Authorities have announced no such policy. It does mean the problem can no longer be addressed simply by requiring databases to remain on Kazakh soil.
When Yandex recommends Google Maps
On October 12, another report gave the crisis an almost symbolic twist. Two drivers, one in Moscow and the other in Yekaterinburg, told the Russian outlet Verstka that a notification had appeared in Yandex Pro, the app used by taxi drivers. If the built-in navigation stopped working, the message advised them to install Google Maps or Waze, which is also owned by Google. Drivers were also encouraged to download an offline map of their city in advance.
This was not a general announcement telling all Yandex customers to abandon the company's own maps. It was described by reporters on the basis of accounts from two drivers, and concerned an emergency workaround for taxi navigation. Those limits matter. Even so, the episode is revealing.
A Russian technology company that has invested in its own maps, navigation services and AI systems found itself directing drivers toward American navigation applications during a serious outage. Not because of an ideological conversion, but because a driver still has to reach a passenger.
There is a practical lesson here for the debate over digital sovereignty. Having a functioning alternative can matter more in an emergency than the nationality of the company that developed it. Google Maps, of course, does not make Kazakhstan technologically self-sufficient: it substitutes one foreign provider for another. What an alternative can do is prevent users from being entirely dependent on a single system when that system fails.
The cost of concentrating digital infrastructure
For Russia, the strikes exposed a different tension. For years, the government has pushed to localize data and build a more tightly controlled domestic digital infrastructure. The stated advantages are understandable: greater control over information, less reliance on foreign companies and the ability to keep services operating despite external restrictions.
But concentrating important computing resources within a single country creates risks of its own. If facilities can be attacked and damaged equipment is difficult to replace because of cost, delivery delays or technology restrictions, domestic ownership alone cannot guarantee resilience. Redundancy across Russian data centers is valuable, but only for as long as enough of those facilities remain available.
This does not mean Russian law categorically prohibits every form of overseas backup capacity. Requirements to localize personal data are not identical to requirements to perform all computing domestically. Yet a policy that encourages the geographic concentration of infrastructure can narrow the available options for spreading risk. The fewer independent alternatives there are, the more costly simultaneous failures at several major sites become.
On October 12, Russian Digital Development Minister Maksut Shadayev described the attacks as unprecedented and said his ministry was discussing data-center protection with the Defense Ministry. Yandex, meanwhile, began arranging to move some customer workloads to other cloud providers, including VK Cloud, Selectel and K2Cloud. The task was no longer simply to repair buildings and servers. It was to preserve an ecosystem used by millions of people and thousands of businesses.
In a war in which both sides have targeted the other country's digital infrastructure, resilience has become a national-security concern. Russia has previously struck Ukrainian data centers and telecommunications facilities; Ukrainian officials have characterized their own attacks as retaliation. That context helps explain the sequence of events, but it does not change the fact that the disruptions are felt by civilian users and businesses across national borders.
What this means for Kazakhstan
The easiest conclusion would be that Kazakhstan should simply stop using Russian software. That would also be an incomplete answer. A major platform based in the United States, China or Russia may all depend on computing infrastructure outside Kazakhstan and on decisions made under another country's jurisdiction.
The more useful questions are operational. Should a platform that plays an important role in daily urban life be able to maintain its essential functions during a prolonged failure of foreign infrastructure? Which functions could run domestically? Does the operator have a tested recovery plan, genuinely independent backup capacity and clear obligations to drivers, couriers, businesses and customers?
These are questions for regulators as well as engineers. Yet not every popular commercial application should automatically be declared critical national infrastructure. Requirements for greater autonomy and redundancy cost money, which ultimately falls on businesses and users. Those costs should be weighed against the actual consequences of an outage, not merely the country in which the provider was founded.
Kazakhstan also has a reason to conduct this debate on its own terms. It can decide for itself what level of reliance on foreign technology platforms is acceptable for its economy. But answering that question requires more than identifying the physical location of a personal-data database. It requires knowing where essential functions are performed, who controls them and what happens when access to those systems disappears not for an hour, but for several days.
The border the app could not see
After the first attacks on Yandex, much of the discussion concerned the cost of servers and the fate of supercomputers. After the third, it concerned whether someone in another country could hail a taxi. That shift tells us how much larger the story has become.
Kazakhstan has not announced a change in the rules governing Yandex, and the company has been gradually restoring its services. But the country's digital ministry has now stated the underlying problem in public: keeping data within national borders is insufficient if an essential application relies on computing power beyond them.
Russia's data centers may be repaired. Yandex may strengthen its backup systems. Passengers may soon be booking rides exactly as before. Even then, a question will remain: at what point does the convenience of an integrated platform become dependence on it?
The October strikes on Yandex produced a consequence that cannot be measured in damaged hardware. They made a digital boundary visible—one that had previously existed largely in legislation and corporate reports. On a phone screen in Almaty, that boundary turned out to be nowhere near Kazakhstan's national border.