Ukraine, Russia, and Iran Have Struck Data Centers in Multiple Attack Waves

Targeting data infrastructure in active conflict zones has produced consequences beyond immediate military objectives, including economic losses measured in billions of dollars, raising questions...

The militaries of Ukraine, Russia, and Iran have each launched multiple waves of attacks on data center facilities, producing losses totaling billions of dollars and generating effects beyond the immediate military targets, according to reporting by Manuel G. Pascual in El Pais published October 15, 2026.

Data centers serve as the physical backbone of digital infrastructure, housing servers, networking equipment, and storage systems that support everything from financial transactions to military communications. Unlike bridges or power plants, data centers are often concentrated in specific geographic clusters, meaning a single successful strike can affect services far beyond the immediate conflict zone.

The El Pais report identifies all three state actors, Ukraine, Russia, and Iran, as having carried out strikes, though it does not specify the precise facilities targeted or the dates of each individual attack wave. What would clarify the full scope of damage is a formal damage assessment from independent infrastructure monitoring organizations, such as the Internet Corporation for Assigned Names and Numbers or national telecommunications regulators in affected states.

The reported financial losses, described as reaching into the billions of dollars, reflect both the direct cost of destroyed hardware and the downstream costs of service disruption. A single large-scale commercial data center can house hardware valued at hundreds of millions of dollars, according to publicly available facility cost estimates published by industry analysts at the Uptime Institute, which tracks global data center performance and investment.

Beyond financial losses, attacks on data centers can degrade civilian internet access, disrupt banking systems, and impair logistics networks that military and civilian populations both depend upon. In the context of the Russia-Ukraine conflict, which began with Russia's full-scale invasion in February 2022 per the United Nations Office for the Coordination of Humanitarian Affairs, digital infrastructure has been a consistent target for both offensive cyber operations and physical strikes.

Iran's inclusion in the list of states conducting such attacks is notable given its distinct conflict context. Iran has been involved in a series of regional military exchanges, including strikes and counter-strikes involving Israel and, at times, U.S. Assets in the Middle East, a pattern documented in reporting by Reuters and the Associated Press across 2024 and 2025.

International humanitarian law, including the Geneva Conventions and their Additional Protocols, prohibits attacks on civilian objects but permits strikes on military objectives. Whether data centers qualify as military objectives depends on their actual use at the time of attack, a determination that is disputed in most active conflict scenarios. The International Committee of the Red Cross has published guidance noting that dual-use infrastructure, facilities serving both military and civilian purposes, presents one of the most contested legal questions in modern warfare.

No binding international treaty currently regulates attacks on data infrastructure specifically. The Tallinn Manual, a non-binding academic document commissioned by NATO's Cooperative Cyber Defence Centre of Excellence, addresses cyber operations affecting data centers under existing laws of armed conflict, but it carries no legal force.

The pattern of multi-actor data center targeting across distinct conflicts suggests a broader normalization of strikes on digital infrastructure as a component of state military strategy. Prior to 2022, such attacks were documented primarily in cyber form, through malware and network intrusions, rather than through physical bombardment.

The economic and logistical consequences described in the El Pais report are likely to intensify policy discussions within NATO and the European Union about hardening critical digital infrastructure. The European Union passed the Network and Information Security 2 Directive, known as NIS2, which came into force in October 2024 and requires member states to establish security requirements for essential services including digital infrastructure operators, according to the Official Journal of the European Union.

What remains unknown from the available reporting is the specific identity of the targeted facilities, the names of any companies or state entities that operated them, and whether any of the attacks produced civilian casualties in addition to financial losses. Those details, if disclosed by the governments involved or by independent damage assessors, would provide a more complete picture of the strategic and humanitarian impact of this emerging pattern of conflict.