Data Centers Are War Targets Now and Dual-Use Is the Whole Punchline
Ukraine hit Russian data centers again in mid-October 2026, including a Sberbank facility after earlier strikes that knocked Yandex capacity offline. 404 Media’s Matthew Gault wrote the piece you should read for the reporting. This is the commentary track: we spent twenty years chanting “data is the new oil,” then acted surprised when the refineries started getting drones. Civilian commercial compute hosting military workloads is not a clever hybrid cloud strategy. It is how you put hospitals and taxi apps in the blast radius of somebody else’s war.
I am not going to paste 404 Media’s article back at you. Go read it. What follows is the Cybersecsloth stake in the ground: international law is still catching up, vendors love dual-use revenue, and American towns arguing about data center siting just got a grim new slide for the zoning meeting.
What the public record says happened
Per reporting summarized across mid-October coverage (including 404 Media’s Oct 15 story): Ukrainian strikes hit multiple Russian data centers over a short window. Yandex facilities were among earlier targets, with outages that spilled into civilian services (mail, logistics, transport apps). A later strike hit a Sberbank-operated data center. Ukrainian leadership framed strikes on data centers and energy infrastructure as responses to Russian aggression. Russia has also targeted Ukrainian digital infrastructure for months. Iran’s earlier hit on AWS capacity in Dubai is part of the same ugly year.
Exact battle-damage assessments and “was this lawful” answers are not something a merch-selling sloth blog adjudicates. The strategic signal is enough: large compute facilities are now routinely discussed as wartime targets, not just peacetime ESG talking points.
Dual-use is the feature, which is the bug
International-law researchers quoted in the public debate keep returning to the same problem: purely military data processing can be a lawful target in armed conflict. Most commercial centers are dual-use. Attackers often cannot know the mix. Civilians eat the outage either way. Hospitals, courts, logistics, and “I need a taxi” apps do not get a carve-out because a slide deck said the rack also trains a model for a ministry.
The uncomfortable policy question (asked plainly in that reporting): why did we normalize parking military workloads on civilian commercial facilities, then shrug when those facilities inherit military-target gravity? Schools and hospitals were already supposed to be off-limits for storing weapons. Compute is catching up to that moral intuition slowly, while procurement moves at cloud-credits speed.
France’s public interest in dedicated underground military compute is one attempted answer: separate the stacks so the law and the targeting logic have something clean to point at. Separating stacks does not make war gentle. It might make “we hit a bank DC and half the city’s apps died” a harder story to defend as precision.
Hypocrisy watch: oil metaphors and zoning hearings
Tech spent a generation insisting data centers were the new refineries while lobbying to be treated like harmless warehouses. Investors wanted the scarcity narrative. Communities got the power bills, the water fights, and the noise. Now township attorneys in places like Ypsilanti are on the record calling proposed research-linked facilities high-value targets in future conflict, and lab partners answer with security-camera reassurances. Both sides are doing their jobs. Only one side has recent photos of smoldering racks overseas as visual aids.
Also notice the selective outrage pattern online: when “our” side’s digital infrastructure is hit, it is an atrocity against civilians. When “their” side’s commercial DC goes dark, comment sections discover just-war theory in twenty minutes. Consistency is not a viral product. Outages for civilians are consistent. That is the point.
What this means if you run security for a company that is not a nation-state
You are probably not dodging Shaheds next quarter. You are on the same physical and logical infrastructure politics as everyone else.
- Concentration risk: if your SaaS, identity, and backups all live in one metro’s hyperscaler footprint, a regional event (war, grid, cable, politics) is a business continuity event. Multi-region is not a slogan. It is homework.
- Vendor questionnaires: ask where military or government workloads share facilities with your tenancy class if that matters to your threat model. Expect vague answers. Document the vagueness.
- Incident plans: “cloud outage” runbooks should include prolonged regional unavailability, not only the cute single-AZ failure you tested once in 2022.
- Public sector and cleared work: if you touch dual-use or defense-adjacent data, assume physical and cyber targeting theories will keep colliding. Your CMMC slideshow will not stop a drone. Your architecture choices still matter.
What this is not
- It is not a claim that every data center is a lawful military target. Lawfulness is fact-specific and contested.
- It is not cheerleading for striking civilian infrastructure. Civilian harm is the scandal, not a footnote.
- It is not anti-cloud theology. It is anti-magical-thinking about shared fate on shared racks.
Sloth take
We built civilization on someone else’s warehouse full of GPUs, sold “data is oil” as inspiration porn, and then discovered oil refineries get bombed. Dual-use compute made shareholders happy and international lawyers busy. Separate military stacks where you can. Diversify where your company actually lives. Stop pretending a commercial DC is politically neutral because the lobby has good snacks. Read the 404 Media piece for the reporting. Then update the BCP slide that still says “cloud = immortal.”
Continuity and vendor-risk reviews without the thought-leadership fog: Dark Edge Consulting.
Sources
- 404 Media: Data Centers Are War Targets Now (Matthew Gault, Oct 15, 2026) – https://www.404media.co/data-centers-are-war-targets-now/ (read the original; this article is commentary, not a reprint)
