Date: 10 October 2026 Publication Type: Research Project: MaMeeFarm™
Abstract
Data centres, cloud platforms, communication networks, and large-scale computing systems are often treated as commercial technology infrastructure.
Their importance, however, increasingly extends beyond the organizations that own or operate them.
Banks depend on digital platforms to process transactions. Governments use online systems to deliver public services. Hospitals rely on networked applications and medical records. Businesses depend on remote databases, communications, and cloud-based operations.
As these dependencies accumulate, the failure of digital infrastructure can affect organizations and services far beyond the original facility.
This creates a distinction between the commercial value of an infrastructure asset and its wider systemic importance.
The European Union’s NIS2 Directive includes specified digital infrastructure service providers within its cybersecurity and resilience framework. The United States also recognizes information technology as a critical infrastructure sector.
These frameworks demonstrate that digital infrastructure already has an established role in critical infrastructure policy.
Recent events have also highlighted its physical vulnerability.
Reuters reported drone attacks affecting two Yandex data centres in Russia on 8 and 9 October 2026. The incidents caused physical damage and operational disruption, while some services continued through other infrastructure.
The incidents do not establish that data centres everywhere face equivalent threats.
They illustrate how disruption to concentrated computing infrastructure can create consequences for dependent digital services.
The central research finding is:
Data infrastructure acquires systemic criticality when essential functions become sufficiently dependent on it that failure can produce consequences beyond the infrastructure operator.
Once this condition exists, digital resilience requires attention to physical infrastructure, network connectivity, geographic concentration, data recovery, operational continuity, and institutional responsibilities.
This research examines how digital infrastructure becomes critical, how dependencies can amplify disruption, and why continuity cannot be established through backup equipment alone.
1. Research Question
Under what conditions does commercially operated data infrastructure acquire the characteristics of critical infrastructure, and how should redundancy, geographic distribution, physical protection, dependency mapping, and continuity planning change once failure can propagate across essential digital services?
2. Critical Infrastructure Is Defined by Its Function and Consequences
Critical infrastructure is not defined solely by its financial value, physical size, or technological sophistication.
Its importance depends on the functions it supports and the consequences of disruption.
A large data centre may host services that can be transferred elsewhere with limited interruption.
A smaller facility may support a specialized service with few practical alternatives.
The smaller facility may therefore be more consequential to a particular essential function.
Infrastructure assessment must consider what depends on the asset, not merely how much equipment it contains.
3. Private Ownership Does Not Make Failure Consequences Private
Many digital infrastructure facilities are privately operated.
Their customers may include banks, hospitals, public agencies, telecommunications providers, and industrial businesses.
A disruption affecting one privately operated facility can therefore influence services used by a much wider population.
This creates an important distinction between ownership and consequence.
Commercial ownership does not necessarily limit the public significance of an infrastructure failure.
4. Digital Infrastructure Already Appears in Critical Infrastructure Policy
The European Union’s NIS2 Directive includes digital infrastructure among the sectors covered by its cybersecurity framework.
Its scope includes specified providers of cloud computing services, data-centre services, internet exchange points, DNS services, and content delivery networks.
However, the Directive distinguishes between essential and important entities according to legal criteria.
Its coverage does not mean that every privately operated server room or data-centre building automatically receives the same regulatory classification.
In the United States, the Cybersecurity and Infrastructure Security Agency recognizes information technology as a critical infrastructure sector.
These examples establish formal recognition of digital infrastructure’s importance while leaving room for differences in legal scope and operational significance.
5. Regulatory Classification and Systemic Importance Are Different
A facility may fall within a defined regulatory category.
Separately, a digital service may have substantial economic or institutional importance because of the organizations that depend on it.
These conditions can overlap, but they should not be treated as identical.
Regulatory classification depends on the applicable legal framework.
Systemic importance depends on the functions supported, the available alternatives, and the consequences of interruption.
The distinction matters when comparing infrastructure across jurisdictions.
6. Commercial Infrastructure Can Accumulate Systemic Importance
A data centre may begin by supporting ordinary commercial applications.
Over time, additional customers and services may migrate into the facility.
These can include payment processing, public administration, medical systems, industrial software, communications, and large-scale data services.
The building itself may remain largely unchanged.
What changes is the extent of dependence on its continued operation.
Infrastructure can therefore become more consequential as its role within the wider economy expands.
7. Dependencies Can Be More Concentrated Than They Appear
Organizations may operate separate applications while relying on common underlying services.
Several businesses may use the same cloud provider, identity system, network operator, or infrastructure region.
From the customer’s perspective, their applications may appear independent.
At the infrastructure level, however, they may share important dependencies.
This can create exposure to a common disruption.
8. Physical and Digital Failures Are Different
Digital services depend on both physical facilities and logical systems.
Physical infrastructure includes buildings, servers, electricity supply, cooling equipment, communications links, and supporting equipment.
Logical systems include software, identity services, applications, databases, routing, and management platforms.
A physical incident can interrupt services even when the software remains intact.
Conversely, software or network failures can interrupt services while the building and equipment remain undamaged.
Resilience must therefore account for both categories of disruption.
9. Physical Infrastructure Remains Fundamental to Digital Services
Cloud computing is often described through virtual resources and remotely accessible services.
Yet those services depend on physical equipment.
Servers require electricity.
Computing equipment requires cooling.
Data must travel through communications networks.
Facilities must remain accessible and operational.
The apparent abstraction of cloud computing does not eliminate these physical dependencies.
10. The October 2026 Yandex Incidents
Reuters reported that drones struck a Yandex data centre in Sasovo, Russia, on 8 October 2026.
The incident caused a fire and operational disruption.
The facility housed substantial computing infrastructure, including equipment associated with Yandex’s artificial intelligence development.
Reuters subsequently reported another attack affecting a Yandex facility in the Kaluga region on 9 October.
The incidents demonstrated the physical exposure of major digital infrastructure during an active conflict.
However, the reported effects must be distinguished from broader assumptions about the entire company’s operations.
11. Physical Damage Did Not Mean Complete Service Collapse
Reuters reported that important Yandex consumer services remained available following the first attack.
Following the second incident, some operations were rerouted through other infrastructure.
Nevertheless, certain dependent customers experienced disruption.
This distinction is important.
A damaged facility can lose capacity without causing the complete failure of every service operated by its owner.
At the same time, continuity for major services does not guarantee continuity for all dependent customers.
12. The Yandex Case Has a Specific Evidence Boundary
The attacks occurred within the context of the Russia–Ukraine war.
They demonstrate that data-centre infrastructure can be physically attacked during conflict.
They also illustrate the importance of alternative facilities and operational recovery.
They do not establish that all data centres have become military targets.
Nor do they establish that every AI facility faces the same level of physical threat.
The broader research significance lies in the relationship between concentrated digital infrastructure and the consequences of physical disruption.
13. Cybersecurity Is Only One Part of Digital Resilience
Cybersecurity remains essential to protecting digital infrastructure.
However, cyber threats are not the only source of operational failure.
Facilities can also be affected by fire, flooding, severe weather, electricity interruption, equipment failure, physical intrusion, and conflict.
A system protected against software intrusion may still become unavailable if its physical operating environment fails.
Digital resilience therefore extends beyond cybersecurity controls.
14. Physical Protection and Recovery Serve Different Purposes
Physical protection seeks to reduce exposure to particular hazards.
Recovery arrangements seek to restore services after disruption.
Neither objective can be assumed to eliminate every possible failure.
A well-protected facility may still experience an unexpected event.
A recovery arrangement may also fail if essential dependencies are unavailable.
Resilience depends on the practical ability to maintain or restore the required service.
15. Backup Equipment Does Not Guarantee Facility Continuity
A data centre may contain multiple servers, storage devices, or power supplies.
These resources can protect against individual equipment failures.
However, they may share the same building, cooling system, electricity connection, or physical hazard.
A facility-level incident can affect several redundant components simultaneously.
Additional equipment therefore does not necessarily provide protection against every failure scenario.
16. Geographic Distribution Can Reduce Concentrated Exposure
Operating services across geographically separated facilities can reduce dependence on a single location.
This may help protect against localized incidents such as building fires, floods, or regional infrastructure failures.
However, geographic distribution creates additional requirements.
Applications must be able to operate elsewhere.
Data must remain available.
Networks must support the transition.
Alternative facilities must have sufficient capacity.
Geographic separation is useful only when the wider service can continue functioning.
17. Geographic Distance Does Not Guarantee Independence
Two distant facilities may still depend on common systems.
These can include cloud management platforms, authentication services, network providers, software components, or shared operational controls.
A failure affecting one of these dependencies may disrupt both facilities.
Geographic distribution can reduce certain risks without eliminating common dependencies.
18. Network Connectivity Is Part of Service Availability
A data centre can remain operational while becoming inaccessible to users.
A damaged communications route or network failure may interrupt service delivery even when computing equipment continues running.
Network diversity can reduce dependence on a single connection.
However, separate commercial network services may still share physical infrastructure.
The resilience benefit depends on the independence of the underlying routes.
19. Electricity and Cooling Are Essential Dependencies
Digital infrastructure requires reliable electricity supply.
Backup power arrangements can provide temporary support during grid interruptions.
Their effectiveness depends on operating conditions, available fuel or stored energy, and the duration of the disruption.
Cooling is equally important.
A facility may have electricity available but still need to reduce or stop computing operations if adequate cooling cannot be maintained.
These supporting systems are integral to digital continuity.
20. Data Recovery Is Different From Compute Replacement
Computing equipment can often be replaced or workloads transferred.
Data may be more difficult to reconstruct.
This is particularly important for financial records, medical information, research datasets, historical archives, and other information that cannot easily be recreated.
A functioning alternative server does not guarantee service recovery if the required data is unavailable.
The ability to recover information is therefore a separate continuity concern.
21. Replication Does Not Guarantee Recoverability
Data replication can improve availability by maintaining copies in multiple locations.
However, copies may become outdated, corrupted, inconsistent, or inaccessible.
Continuous replication can also propagate certain errors or unwanted changes.
The existence of a copy does not establish that the complete application can be restored successfully.
Recovery depends on the integrity, accessibility, and usability of the information.
22. Backup Availability Matters During an Incident
Reuters reported that a business dependent on Yandex Cloud lost access to a backup database following the October 2026 disruptions.
This example illustrates a distinction between possessing a backup and being able to use it when needed.
A recovery resource that becomes inaccessible during the relevant incident may not provide the expected continuity.
The case does not establish the precise architecture or all technical causes of that customer’s disruption.
It supports the narrower observation that backup accessibility can become an operational problem.
23. Recovery Capability Must Be Demonstrated
A documented continuity plan does not necessarily establish that recovery will succeed.
Applications may depend on identity systems, databases, network connections, or external services that are unavailable during an incident.
Alternative computing infrastructure may also lack sufficient capacity.
Testing can reveal whether recovery arrangements function as intended under defined conditions.
However, a successful test cannot guarantee performance during every future disruption.
24. The Objective Is Service Continuity
Organizations rely on digital infrastructure to perform functions.
Those functions may require several interconnected systems.
A customer-facing application can depend on computing resources, databases, authentication, communications, and external services.
Protecting one component does not guarantee that the entire service remains available.
Continuity must therefore be considered at the level of the service being delivered.
25. Hidden Dependencies Can Increase Disruption
Digital services frequently rely on external providers.
An organization may understand its primary cloud infrastructure while overlooking a shared identity service, DNS provider, external database, or communications dependency.
Such relationships can create unexpected exposure.
A disruption in an apparently peripheral service may prevent an otherwise operational application from functioning.
Dependency visibility is therefore important to continuity planning.
26. Cloud Computing Can Improve Resilience for Individual Customers
Cloud infrastructure can provide access to multiple facilities, scalable computing resources, replicated storage, and recovery capabilities.
For some organizations, these resources can provide greater resilience than a single privately operated server room.
However, the benefits depend on service configuration, contractual arrangements, and actual recovery capability.
Cloud adoption alone does not guarantee continuity.
27. Cloud Concentration Can Create Wider Systemic Exposure
Cloud infrastructure can improve the resilience of individual organizations while increasing shared dependence on a smaller number of providers.
If many unrelated organizations use the same underlying services, a provider-level disruption may affect them simultaneously.
This creates a potential difference between customer-level resilience and system-wide concentration.
The benefits of consolidation must therefore be considered alongside common dependencies.
28. Multiple Regions and Multiple Providers Address Different Risks
Operating across several regions of one provider can reduce exposure to a single geographic location.
However, those regions may share management systems, identity infrastructure, or other provider-level dependencies.
Using multiple providers may reduce some shared exposure.
It can also introduce additional costs, operational complexity, and compatibility challenges.
Neither arrangement should be assumed to provide complete independence.
29. Additional Redundancy Has Economic Costs
Separate facilities, backup computing capacity, multiple network connections, and replicated data systems require investment.
They can increase operating costs and reduce normal-period utilization.
For services with limited consequences of interruption, extensive redundancy may not be economically justified.
For essential services, the potential cost of disruption may support additional investment.
The appropriate balance depends on the function being protected.
30. Spare Capacity Can Have Strategic Value
An alternative facility must have enough available resources to support transferred workloads.
If all facilities are already operating near their practical limits, rerouting may be constrained.
Maintaining additional capacity can appear inefficient during ordinary operation.
However, that capacity may become important when another facility is unavailable.
Its strategic value depends on whether it can actually preserve service during disruption.
31. Recovery Time Changes the Consequences of Failure
Two systems can experience similar initial disruptions but recover at different speeds.
A short interruption may have manageable consequences.
A prolonged outage can affect transactions, public services, or operational activities.
Recovery time therefore influences the wider significance of an infrastructure failure.
The acceptable duration of interruption depends on the service involved.
32. Data Loss and Service Interruption Are Separate Concerns
A system may return to operation quickly while losing recent information.
Another may preserve its records but require more time to restore access.
These outcomes have different consequences.
Continuity planning must therefore consider both the availability of the service and the integrity of the information it requires.
The appropriate recovery objectives depend on the importance and characteristics of the service.
33. Data Location Can Limit Recovery Options
Moving information between jurisdictions may be subject to privacy, contractual, sector-specific, or national-security requirements.
These restrictions can affect the locations available for backup and recovery.
A technically suitable alternative facility may not be legally appropriate for every workload.
Resilience arrangements must therefore account for applicable data-handling obligations.
34. Digital Infrastructure Depends on Other Infrastructure
Data centres rely on electricity, communications, equipment supply chains, and supporting services.
Some also depend on water supply and fuel delivery.
A disruption in these upstream systems can affect digital operations.
This means digital infrastructure cannot be treated as an isolated sector.
Its continuity depends partly on the resilience of other physical systems.
35. Other Essential Services Depend on Digital Infrastructure
The relationship also operates in the opposite direction.
Financial services, communications, transport, healthcare, and public administration increasingly use digital systems to coordinate operations.
A failure in digital infrastructure can therefore affect activities outside the technology sector.
The extent of the effect depends on the services involved and the availability of alternatives.
36. Interdependence Creates the Possibility of Cascading Disruption
When essential services depend on shared infrastructure, disruption can propagate across organizational boundaries.
An electricity interruption may affect a data centre.
The resulting digital outage may then interfere with other organizations.
Conversely, a failure in digital coordination can affect the operation of physical systems.
These relationships do not mean every outage will become systemic.
They demonstrate why interdependence matters when assessing infrastructure consequences.
37. Initial Physical Damage Does Not Determine Total Economic Impact
A localized incident may damage one facility.
The wider consequences depend on the services hosted, the available alternatives, and the effectiveness of recovery.
Some organizations may continue operating through other facilities.
Others may experience interruption because their services cannot be transferred or restored quickly enough.
The scale of physical damage and the scale of economic disruption are therefore not necessarily identical.
38. Critical Infrastructure Policy Creates Operational Responsibilities
Formal critical-infrastructure frameworks can impose obligations concerning cybersecurity, risk management, incident reporting, and continuity.
Under the EU’s NIS2 Directive, covered entities are subject to requirements determined by the Directive and its national implementation.
These obligations depend on the entity’s classification and the applicable legal provisions.
Critical-infrastructure policy therefore influences how certain operators must manage operational risks.
39. Private Operators May Have Wider Public Responsibilities
A commercial provider can support services that are important to public welfare or economic continuity.
This creates a governance challenge.
Operators must manage business costs and customer obligations while also meeting applicable resilience requirements.
Public authorities must consider how regulation can support continuity without imposing disproportionate burdens.
The appropriate arrangements vary across sectors and jurisdictions.
40. Criticality Can Change Over Time
A facility’s importance can change as workloads migrate and customer dependencies evolve.
An infrastructure asset that originally supported non-essential activity may later host services with greater operational consequences.
Conversely, its systemic importance may decline if customers move elsewhere or develop effective alternatives.
Criticality is therefore not necessarily a permanent characteristic of a physical asset.
41. Infrastructure Size Is an Incomplete Indicator
Server count, facility area, and computing capacity describe the scale of an asset.
They do not fully describe its importance to dependent services.
A facility with limited computing capacity may support a function that is difficult to replace.
A much larger facility may support workloads that can be transferred relatively easily.
Assessing systemic importance requires more than physical capacity statistics.
42. Physical Protection Has Limits
Operators may use site selection, access controls, fire protection, equipment separation, and other measures to reduce exposure to particular hazards.
The appropriate measures depend on the threat environment.
However, no protective arrangement can be assumed to eliminate all failure risk.
Protection should therefore be understood alongside recovery and continuity requirements.
43. Conflict Can Change Infrastructure Protection Priorities
The Yandex incidents demonstrate how conflict can create direct physical risks for digital facilities.
Reuters also reported that some Ukrainian data infrastructure has been relocated or constructed underground in response to attack risks.
Such approaches reflect particular threat conditions.
They should not be interpreted as universal requirements for commercial data centres.
Physical protection decisions depend on geography, threat exposure, engineering feasibility, and cost.
44. More Backup Assets Do Not Automatically Mean Better Continuity
An organization may maintain multiple servers, facilities, or service providers.
If those alternatives share the same vulnerable dependencies, a single incident may affect them together.
The practical value of redundancy depends on whether alternative arrangements remain usable when the primary service is disrupted.
The number of backup assets alone is therefore an incomplete measure of resilience.
45. What Current Evidence Establishes
The reviewed evidence supports several observations.
Digital infrastructure is formally recognized within critical-infrastructure frameworks in the European Union and United States.
The applicable legal categories and obligations differ by jurisdiction.
Physical incidents can damage data-centre infrastructure and interrupt operations.
The October 2026 Yandex incidents demonstrate that some services may continue through alternative infrastructure while particular customers still experience disruption.
Digital services depend on physical facilities, electricity, cooling, networks, software, and data.
Shared infrastructure can create dependencies across multiple organizations.
Recovery arrangements require more than the existence of backup equipment or replicated information.
These observations support treating digital resilience as a wider infrastructure issue rather than solely a cybersecurity issue.
46. What Current Evidence Does Not Establish
The reviewed evidence does not establish that:
- Every data centre has the same critical-infrastructure status.
- All AI facilities are military targets.
- The Yandex incidents represent a universal pattern of warfare.
- Geographic separation guarantees independent operation.
- Cloud adoption automatically eliminates outage risk.
- Multiple providers always provide superior resilience.
- Replicated data guarantees successful recovery.
- Physical protection can eliminate every failure.
- Regulatory designation guarantees service continuity.
- Every additional backup facility is economically justified.
These conclusions would require further evidence.
47. Research Implications
The expansion of cloud computing and artificial intelligence is increasing the importance of digital infrastructure.
But computing capacity alone does not establish systemic criticality.
The more important issue is the extent to which essential functions depend on that capacity.
This changes how infrastructure should be understood.
Performance, efficiency, and cost remain important.
However, continuity becomes a wider concern when failure can affect organizations beyond the infrastructure operator.
Digital infrastructure assessment must therefore consider not only the capacity available during normal operation but also the consequences when that capacity becomes unavailable.
48. Research Limitations
This research uses regulatory frameworks, established infrastructure principles, and publicly reported incidents available through 10 October 2026.
The Yandex incidents provide evidence of physical disruption in a specific conflict environment.
They do not establish the frequency or probability of comparable incidents elsewhere.
Public reporting does not provide a complete technical account of the affected systems or their recovery arrangements.
The analysis does not independently assess the infrastructure architecture of Yandex or its customers.
Nor does it calculate the economic value of specific redundancy investments.
The findings should therefore be interpreted as a study of infrastructure dependency and resilience rather than a technical audit of individual facilities.
49. Research Conclusion
Data infrastructure does not become critical simply because computing capacity expands.
Its systemic importance increases when essential functions become dependent on that capacity and the consequences of failure extend beyond the infrastructure operator.
A commercial data centre may support services used by banks, governments, hospitals, businesses, and communications providers.
As these dependencies accumulate, disruption can affect a wider set of economic and institutional activities.
Formal critical-infrastructure frameworks already recognize important parts of this relationship.
The European Union’s NIS2 Directive covers specified digital infrastructure service providers, while the United States recognizes information technology as a critical infrastructure sector.
These regulatory frameworks are not identical, and they do not classify every facility in the same way.
They nevertheless demonstrate that digital infrastructure is already part of critical infrastructure policy.
The October 2026 Yandex incidents illustrate another dimension of the issue.
Physical damage can interrupt computing infrastructure.
Alternative facilities can preserve some services.
Yet dependent customers may still experience disruption.
The incidents do not establish a universal threat pattern.
Their importance lies in demonstrating that digital systems remain dependent on physical assets and operational recovery.
Resilience therefore requires attention to more than the number of servers or backup copies available.
It also depends on whether essential services can continue when a facility, network, data resource, or supporting system becomes unavailable.
Geographic distribution can reduce certain exposures.
Additional providers may reduce some shared dependencies.
Recovery arrangements may preserve services.
But none of these measures provides an unconditional guarantee.
Each introduces technical, operational, economic, and institutional considerations.
The central research finding is:
Data infrastructure becomes systemically critical when failure can propagate through essential services beyond the operator, while resilience depends on limiting the consequences of that failure.
This distinction changes the meaning of digital infrastructure planning.
The question is no longer only how much computing capacity can be built.
It is also how much essential activity depends on that capacity, how readily the activity can continue elsewhere, and how quickly services can recover when normal operations fail.
For infrastructure supporting essential functions, the defining question becomes:
How much digital capacity can become unavailable before the wider services depending on it can no longer continue?
That is the point at which commercial data infrastructure must also be understood through the responsibilities and consequences of critical infrastructure.
References
European Parliament and Council of the European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
European Parliament and Council of the European Union. (2022). Directive (EU) 2022/2557 on the resilience of critical entities. https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng
Cybersecurity and Infrastructure Security Agency. Information Technology Sector. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/information-technology-sector
Cybersecurity and Infrastructure Security Agency. Infrastructure Dependency Primer. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/resilience-services/infrastructure-dependency-primer
Reuters. (8 October 2026). Drones Hit Yandex Site in First Major Attack on Russian Data Hub. https://www.reuters.com/world/drones-hit-yandex-data-centre-first-major-attack-russian-data-hub-2026-10-08/
Reuters. (8 October 2026). Russia’s Yandex Says It Is Unclear Whether Data Centre Can Be Restored After Drone Strike. https://www.reuters.com/world/europe/russias-yandex-says-unclear-whether-data-centre-can-be-restored-after-drone-2026-10-08/
Reuters. (9 October 2026). Russia’s Yandex Says Second Data Centre Hit by Drone Attack. https://www.reuters.com/world/europe/russias-yandex-says-second-data-centre-hit-by-drone-attack-2026-10-09/