Russia's strikes on Kyiv show the cloud region was never built for war
Russia has hit Ukrainian data centres and telecom hubs 23 times since July, including Kyivstar's headquarters this weekend, cutting fixed internet to roughly 100,000 households. The Gulf ran the same experiment in March: AWS still has not restored a Bahrain region or a UAE availability zone. The desk reads both as proof that data sovereignty now means the ability to fail over outside your own borders.
Russia has spent September striking Ukraine's internet infrastructure; AWS's continuing outages in the Gulf show the longer-term cost. On Sunday, Russian forces struck the headquarters of Kyivstar, Ukraine's largest mobile operator, and the country's digital ministry recorded roughly 100,000 households in the Kyiv region without fixed internet after a run of data centre strikes the week before. Six months earlier, Iranian drones hit Amazon Web Services facilities in the Gulf, and AWS says it still cannot restore its Bahrain cloud region or one of its UAE availability zones. Both wars exposed the same weakness: cloud regions are designed to withstand fires and floods, not an adversary that knows where the buildings are.
The Kyivstar strike was not an isolated hit. Ukraine's president said a Kyiv data centre was struck twice on Sunday morning, wounding two children and an adult, while Russia's defence ministry claimed separately that it had hit a data centre belonging to Vodafone Ukraine, the country's second-largest cell network. Vodafone Ukraine did not comment. Reuters' account of the strikes has the details. Russia's defence ministry, according to TASS, described the Vodafone facility as one of the largest providers of mobile and internet services to Ukraine's military. Moscow is now naming civilian telecom infrastructure as a military target.
The number of strikes suggests a campaign. According to the operator of Ukraine's 1-IX internet exchange, Russia began "taking it out systematically" that month, and IntelliNews' running tally counts 23 separate strikes or claimed strikes on Ukrainian data infrastructure going back to July. Kyiv's own read on the motive, delivered by its foreign minister, is that Russia is targeting data centres to disrupt the flow of information.
IntelliNews adds a second motive, degrading the compute and connectivity behind Ukraine's development of AI-assisted weapons, ahead of a winter both sides expect to bring a heavier air war. The campaign has reached beyond telecom too: a repeat strike on the Cosmonova data centre knocked two television channels off air, and a strike on the Pegasus Arms drone workshop has left production there suspended indefinitely.
The worsening air war has made software infrastructure a target alongside steel. Zelenskiy says Ukraine is intercepting only about 55% of Russia's newer jet-powered Shahed drones, against a success rate above 90% for older, slower variants. A defence that misses closer to half its targets is a thin safeguard for facilities that route military communications, and Russia's planned budget of roughly $12 billion next year for jet drones and loitering munitions suggests that gap will not close on its own. Moving the data out of range has become the more realistic answer.
The Gulf saw the same design flaw earlier in the war. Reuters' report on the outage quotes Amazon Web Services saying the damage to its infrastructure after the March strikes "spanned multiple availability zones and exceeded what our regional and multi-AZ services are designed to withstand." The Bahrain region and one of three UAE availability zones remain out of reach, with AWS not expecting a full Bahrain restoration until early 2027, and some customers who had not replicated data elsewhere lost it outright. Banking operations in the region were disrupted. The entire premise of a multi-availability-zone cloud region, that spreading load across a few buildings a short drive apart buys resilience, assumes the buildings are not the thing under attack. In a war zone, they are.
Ukraine made this switch once before. In February 2022, as Russian forces approached Kyiv, the government changed the law to let state data sit in foreign clouds and moved its registries onto Amazon, Microsoft and Google infrastructure abroad. That decision, made under greater duress than anything the Gulf has faced, is the template the current data centre campaign is validating in real time: in wartime, control over data depends on being able to fail over outside your own borders. Gulf states and the European Union have spent recent years writing data-localisation rules that assume the opposite.
Kyivstar faces the clearest commercial exposure. It listed on Nasdaq under the ticker KYIV last year and now carries a market value near $3 billion on trailing revenue of roughly $1.3 billion. Its results, due November 6, will be the first Kyivstar or VEON earnings call to land squarely inside this data centre campaign, and the desk expects network-restoration and hardening costs to show up as a lasting step up in capital spending. Insurers writing war-exclusion clauses into data centre and telecom policies, and contractors selling underground or blast-resistant designs, such as the dispersed AI data centre concept the UAE is now reworking, are the other side of that same repricing.
One objection is that data localisation is primarily a sovereignty and privacy issue, best addressed by improving air defence around the buildings. Ukraine's president said this week that decisions had been taken specifically to protect data centres, which suggests Kyiv still treats defending the building as the first line of policy, a reasonable and probably correct near-term instinct. Redundancy still has a clear role alongside air defence. A data centre is a fixed structure at a known coordinate, air defence against jet-powered drones is being beaten roughly half the time, and the same rationed missile stock has to cover the power grid too. Redundancy outside the country will not stop a single strike. It is the one addition to Ukraine's defences that does not require another interceptor.
The desk expects Gulf regulators, having watched their own cloud region fail for the better part of a year, to permit or require out-of-country backup for critical financial and government workloads within the next twelve months, formalising what Ukraine did by emergency legislation in 2022. The nearer test is whether Kyiv moves beyond ad hoc cloud migration and amends its own rules to force critical telecom and government data holders to keep live replicas outside Ukraine's borders, the same logic it applied to state registries three and a half years ago, now extended to the operators still relying on domestic capacity.