Russian authorities have directed data center operators in vulnerable regions to strengthen their physical defenses following the expansion of Ukrainian drone operations into areas where those facilities are concentrated. The specific requirements, timelines, and enforcement mechanisms have not been publicly disclosed. What has been disclosed is enough to raise serious questions about data center physical security accountability — not just in Russia, but in any country where governments regulate critical infrastructure without independent oversight.

What happened

Ukrainian drone operations have brought parts of Russia within reach of physical attack, including areas where data centers are clustered. In response, the Kremlin issued a directive ordering those facilities to harden their physical defenses.

This was not a voluntary industry upgrade or a market-driven response. It was a state mandate handed down to infrastructure operators. The fact that it was issued at all is an acknowledgment by Russian authorities that existing physical protections are insufficient for the current threat environment.

The details of what operators are being told to do — and by when — have not been made public.

Who is affected

The most direct burden falls on data center operators in the affected regions. Hardening a facility against physical attack — reinforcing structures, adding perimeter security, building redundancy into power and cooling systems — is expensive and disruptive. The cost and scope of what is being required has not been disclosed.

Beyond the operators, the exposure spreads outward:

• Organizations and individuals whose data is stored in those facilities carry a risk they cannot independently assess, because the scope of the vulnerability has not been made public.
• Russian state institutions that depend on those facilities for day-to-day operations face the same undisclosed risk.
• Any party doing business with or through Russian digital infrastructure — including foreign companies with data processed there through third-party arrangements — inherits some portion of that physical fragility, often without knowing it.

Many organizations do not know exactly where their data sits once it moves through hosting or cloud arrangements. That gap in awareness matters more when the infrastructure in question is in a conflict zone.

What the real risk is

A successful physical strike on a data center is not just a hardware problem. It can interrupt services for every organization that depends on that facility, destroy or corrupt stored data permanently, and sever connectivity in ways that take weeks or months to restore. Unlike a cyberattack, there is no patch for a collapsed building.

The deeper problem is structural. The mandate exists, but because enforcement mechanisms, compliance standards, and timelines have not been made public, there is no external way to verify whether anything is actually being done.

When a government issues a security directive in secret and monitors compliance in secret, the directive functions more as political cover than as genuine risk reduction.

If a facility is damaged after the mandate was issued, the state can point to the order as proof it acted. The operator can claim it complied. No independent party has the information needed to challenge either claim. That ambiguity is not an accidental side effect of secrecy — it is one of its primary uses.

This is the core failure of data center physical security accountability in closed systems: the people responsible for verifying safety are the same people issuing the directives.

What to do today

If your organization has any data processed or stored through Russian infrastructure — directly or through a third party — here are concrete steps you can take now.

Map your exposure

Ask your cloud provider, hosting vendor, or IT team a direct question: does any of our data pass through or reside in facilities located in Russia? Many vendors will not volunteer this information. You have to ask explicitly. Get the answer in writing.

Check your continuity plan

If a facility goes offline suddenly — due to a physical event, a power failure, or a connectivity cut — what happens to your data and your services? Ask your vendor what their failover plan is and where backup copies of your data are held. If the backup is in the same region as the primary, that is not a real backup for this type of risk.

Review your contract

Many service agreements are silent on physical disruptions. Look for clauses covering what notification you are owed if a facility suffers damage, and what your remedies are if data is lost or services are unavailable for an extended period. If those clauses do not exist, you may want to raise that with your legal team before something happens rather than after.

Review your data residency assumptions

Data residency means knowing exactly where your data is stored, not just which company holds it. Ask for a data processing addendum or a data residency statement from any vendor handling sensitive information. This is a standard request and a legitimate one.

Follow credible infrastructure reporting

Official disclosures about infrastructure security in conflict zones are rare and tend to arrive late. Journalists and researchers who track physical infrastructure in conflict zones — including open-source intelligence analysts who monitor satellite imagery — often surface relevant information before official channels do. Identifying two or three reliable sources and checking them periodically is more useful than waiting for a press release.

Why this keeps happening

Governments regularly issue security mandates in response to visible threats. The pattern here — threat emerges, directive issued, enforcement undisclosed, outcome unverifiable — is not unique to Russia. It appears wherever governments regulate their own critical infrastructure without independent oversight.

Data center operators, like most regulated infrastructure owners, have strong incentives to signal compliance and weak incentives to report shortfalls, especially when the regulator is also the government issuing the directive.

Physical infrastructure accountability has always lagged behind digital accountability. Damage to a building is harder to attribute and measure than a data breach. National security framing is routinely used to close off scrutiny before it starts.

There is a deeper structural reason this keeps happening: effective oversight requires being able to identify who did what, when, and with what result. In closed systems — and in many online systems as well — there is no reliable mechanism for tying actions to identifiable, responsible parties. Regulators issue directives into a space where they cannot see clearly, operators respond in ways that cannot be independently verified, and accountability runs upward to the state rather than outward to the public or to the people whose data is at risk. A mandate without an audit mechanism is largely a statement of intent. Statements of intent do not harden buildings against physical attack.

Frequently asked questions

Does a government security directive actually make infrastructure safer?

It can, but only if compliance is independently verified and enforcement is real. A directive that is issued in secret and monitored only by the issuing authority gives operators little external pressure to act and gives the public no way to confirm that anything changed. The directive may improve safety in some facilities. It may not in others. Without external audit, there is no way to know.

Who is responsible if a data center is damaged and stored data is lost?

This depends on the contracts in place and the legal jurisdiction involved. In many cases, service agreements limit the provider’s liability for events classified as outside their control — which a physical attack likely would be. Organizations that have not reviewed their contracts for these clauses may find they have little recourse. That is a reason to check now, not after an incident.

Why does physical infrastructure security get less scrutiny than data security?

Data breaches generate records — logs, notifications, regulatory filings — that create a paper trail and trigger disclosure requirements in many jurisdictions. A building damaged by a drone strike generates rubble. Physical damage is harder to attribute, harder to measure in terms of data loss, and easier to shield from scrutiny under national security framing. The accountability tools that exist for digital incidents simply do not have equivalents for physical ones in most regulatory systems.

Originally reported by therecord.media. This article summarises that reporting and adds practical guidance.

Scams, fraud, bots, and manufactured noise keep spreading because the internet was built with no reliable way to know who anyone actually is. Everyone deserves authenticity and accountability online, and that is the mission we are working on. Subscribe to follow our coverage as we track the systems — and the gaps — that shape how trust works in a connected world.