Russia’s Attacks on Ukraine’s Data Centres Signal a New Threat to European Infrastructure

Russia’s defence ministry has explicitly acknowledged targeting Datagroup, Cosmonova, Kyivstar and Parkovyi, alleging that the facilities supported telecommunications, cloud processing or Starlink integration for Ukraine’s armed forces.

The significance extends well beyond the immediate outages. The strikes point to a change in the economics and architecture of wartime resilience: once data itself is distributed across networks, the buildings processing that data become strategic infrastructure.

The server room has become a military target

Russia’s campaign against Ukrainian infrastructure has previously concentrated on electricity, fuel, transport and other physical systems whose destruction could directly affect the functioning of the economy and state.

The latest attacks apply the same logic to a different layer.

A data centre may look like a civilian office facility, but its physical equipment can support everything from enterprise cloud services and media broadcasting to banking, logistics and communications. Ukraine’s high level of digitalisation makes the distinction between civilian and strategic infrastructure increasingly difficult to maintain in operational terms.

The September attacks showed how quickly a strike on one node can travel through the wider system. Initial damage to Kyiv facilities disrupted services outside the capital, including in Vinnytsia and Khmelnytskyi, because regional connectivity depended on central processing nodes in Kyiv.

That dependency is precisely the weakness exposed by the attacks.

Digital systems can be geographically concentrated even when the services they provide appear ubiquitous. A bank application, logistics platform or government service may be accessible from thousands of locations while relying on a comparatively small number of physical facilities.

Destroying those facilities does not require penetrating sophisticated cyber defences. The server simply has to be destroyed.

Redundancy is no longer a technical preference

The clearest distinction emerging from the attacks is between companies that treated backup infrastructure as a technical safeguard and those that had already distributed their operations geographically.

MiroHost, for example, reported the destruction of its domestic data centre, while 90–95 per cent of its clients operating on foreign infrastructure remained unaffected. Cityhost confirmed server destruction in Kyiv and began emergency restoration from overseas backups.

Datagroup also reported physical damage to its servers and equipment but said customer data remained secure because operations could be shifted to backup sites.

The difference is fundamental. A conventional disaster-recovery plan can protect data from equipment failure, human error, or a local outage. A kinetic attack on a data centre changes the calculation because the entire physical environment around the primary system can disappear.

For companies operating critical services, the relevant question is therefore no longer simply whether data is backed up. It is whether the service can continue operating when an entire geographic node is unavailable.

That requires a different architecture: workloads distributed between multiple regions, automated failover, geographically separated storage and sufficiently independent network paths. The objective is not merely to recover eventually, but to keep operating while one location is being destroyed or repaired.

The distinction between recovery point and recovery time becomes concrete in wartime. A system that can restore its data but needs days to rebuild infrastructure may still be operationally unusable for a bank, retailer, media organisation or logistics company.

Ukraine’s digital economy is unusually exposed

Ukraine has built a highly digitalised economy under extraordinary conditions. State services, banking, logistics management, retail transactions and national alert systems increasingly depend on continuous connectivity.

That digitalisation has produced enormous efficiencies. It has also created a concentration of critical functions in a relatively small technological ecosystem.

The September strikes therefore create risks beyond temporary loss of internet access. If attacks on data centres become persistent, banks and retailers without effective foreign or multi-region failover could face transaction failures and interruptions to customer services. Businesses may have to shift temporarily towards cash or alternative messaging channels. Media organisations can lose live broadcasting capacity when the infrastructure hosting their streams is damaged.

The costs accumulate quickly. Companies must replace hardware, move workloads, secure alternative capacity and redesign networks while continuing to operate during a war. Media estimates cited in the briefing put the broader economic damage from infrastructure targeting at about $10bn by the end of 2026.

For smaller businesses, the problem is particularly acute. Large organisations can purchase capacity from international cloud providers or maintain redundant systems in several jurisdictions. Small and medium-sized enterprises may still depend on a single domestic hosting provider because it is cheaper and easier to manage.

The resulting divide is not simply between digital companies and those that are not. It is between digital systems designed for a stable physical environment and those designed for a hostile one.

The battlefield now extends across borders

The fire at a Starlink ground station in Wola Krobowska, Poland, on September 23 adds another dimension.

Polish authorities opened a sabotage investigation, while Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski pointed to indicators of a hybrid action. Direct Russian attribution, however, remains unconfirmed.

The incident matters because Ukraine’s digital resilience does not end at its borders. Satellite communications and other supporting infrastructure depend on facilities in neighbouring European countries. Starlink ground stations in EU states help process regional connectivity, while international cloud platforms provide the redundancy that increasingly protects Ukrainian companies from the destruction of domestic facilities.

This creates a new security problem for Europe. Infrastructure outside the immediate theatre of war can become part of the architecture on which Ukrainian communications depend.

A distributed system is harder to destroy through a single strike. But it also creates more physical points whose security matters.

Kyiv is being forced to redesign the meaning of resilience

President Volodymyr Zelenskyy has announced immediate measures to strengthen physical and operational air-defence protection around national data centres and digital communications nodes.

That response addresses the most immediate problem: keeping critical facilities from being destroyed.

It cannot, by itself, resolve the deeper architectural vulnerability.

Hardening a building makes a local node more resilient. Geographic distribution changes the consequences of losing that node. The two approaches increasingly have to operate together.

Ukraine’s domestic data centres remain necessary for reasons including connectivity, capacity and control. Yet the September attacks demonstrate the limits of concentrating critical processing in urban facilities. For the most important services, physical protection must be complemented by infrastructure that assumes a primary location can become unavailable without warning.

That means moving towards multi-region cloud systems, foreign backup capacity, automated disaster recovery and geographically separated network architecture. For critical organisations, redundancy must extend beyond data storage to computing capacity, communications routes and the ability to switch operations without prolonged manual intervention.

The strategic implication is larger than Ukraine’s hosting market.

The war is turning digital infrastructure into a physical security question. Europe’s growing dependence on cloud computing, data centres and interconnected telecommunications networks has generally been discussed in terms of cybersecurity, energy consumption and economic competitiveness. Ukraine’s experience adds another threat model: the server farm as a target of kinetic warfare.

The attacks of September 23–25 therefore expose a paradox at the heart of digital transformation. The more services disappear into the cloud, the more strategically important the physical infrastructure underneath that cloud becomes.