Ukrainian drones have struck two data centres operated by Yandex, the Russian technology company often called Russia's Google. On Thursday, an attack shut down its main data hub in Sasovo, in the Ryazan region, which houses two of the three supercomputers Yandex uses to train its AI model.

On Friday, a second strike partly disabled its data centre in the Kaluga region, south-west of Moscow. Yandex operates five data centres, so two of them have now been hit.

This is not the first time. Data centres have become a target in two wars this year: on 1 March, Iranian drones struck two Amazon Web Services data centres in the United Arab Emirates, and a third in Bahrain was damaged by a nearby strike, in what were the first confirmed military attacks on a large cloud provider. Banking, payments and delivery services across the region went down, and AWS told customers to move their systems to other regions.

That followed US and Israeli strikes on data centres in Tehran, including one that processed salary payments for Iran's military. An outlet linked to Iran's Revolutionary Guard then published a list of 29 technology sites it considered targets, including Microsoft, Google, Nvidia and Oracle facilities.

Now Russia and Ukraine are hitting each other's data centres, and the damage spreads well beyond the owner: when Yandex went down, unrelated sites including Russian Railways and property portal Cian failed too.

The money at stake is enormous. Amazon, Microsoft, Alphabet and Meta alone are expected to spend between $ 700 billion and $ 725 billion this year, roughly R12 trillion, mostly on AI infrastructure and data centres. Yet most of these buildings have strong protection against intruders on the ground and almost none against attack from the air.

TechCentral carried the Reuters report on the Yandex strikes and Ukraine's move to put its own digital infrastructure underground. DatacenterDynamics argues that once a single military workload runs on shared cloud infrastructure, the whole facility can be treated as a military target, which is exactly the justification Iran gave for its strikes.

Euronews quoted analysts noting that surface-to-air systems are reserved for the highest-value sites, such as oil and gas facilities and government buildings, and that data centres are not yet among them.

The economics favour the attacker. A Shahed-type drone costs an estimated $20,000 to $50,000, about R340,000 to R845,000. A Patriot interceptor missile costs around $ 4 million, roughly R68 million. A country cannot fire missiles worth hundreds of times more than the drones they stop for long, and it certainly cannot ring every data centre with them.

Ukraine has brought the cost of downing a drone down to about $10,000 using cheap interceptor drones, which shows where defence is heading, but even that needs to be deployed at scale around every site worth protecting.

So the more realistic protection is in how data centres are built and spread: underground, as Ukraine is doing, or distributed so no single hit takes a service down.

That matters for South Africa in two ways. The GPU build in Centurion and MTN's 150MW plan are being pitched partly to serve other regions, and distance from active conflict is now worth something to the companies choosing where to build. And for any business, the Gulf outages are the clearest lesson yet: if your systems sit in one region, one strike or one power failure can take them down.

You might also like our piece on the RelyComply breach that hit four institutions at once, the new subsea cable from Réunion, and what Denmark does with data centre waste heat.

Get more SA tech and business news and subscribe to The Open Letter.