What Lies Behind Russian Strikes on Digital Infrastructure
From TV Towers to Data Centers: How Russian Strikes on Communications Infrastructure Have Evolved
Attacks on the infrastructure that provides Ukrainians with connectivity and information began in the very first days of the full-scale invasion. Initially, the targets were primarily TV towers, base stations, and the networks of telecom operators and internet service providers. Notably, on March 1, 2022, the Russian military launched a missile strike against the Kyiv TV tower. Five people were killed and another five injured, while television broadcasting was temporarily interrupted. Before the strike, Russia publicly announced its intention to hit information-related facilities in Kyiv. Ukrainian investigators subsequently identified the Russian commanders believed to be involved in orchestrating the attack.
Two weeks later, on March 14, 2022, two missiles struck a TV tower and administrative buildings in Antopil, in the Rivne region. The following day, authorities reported at least 20 fatalities. At the same time, shelling and combat operations disrupted internet services in Kyiv, Kharkiv, Kherson, Sievierodonetsk, and other cities. For example, in March 2022, following Russian shelling, the provider Uacity experienced partial service outages in Kyiv, while large-scale internet connection failures were recorded in Kharkiv and Kherson.
In May 2023, the Ministry of Digital Transformation reported that Russia had destroyed or damaged approximately one-quarter of Ukraine’s internet networks and over 3,000 mobile base stations. In de-occupied territories, operators discovered destroyed or stolen equipment, and repair crews were forced to work under fire. For instance, on May 8, 2023, a team from a local provider in Stanislav (Kherson region) came under Russian shelling while restoring connectivity.
In 2024, Russia continued to strike facilities responsible for data transmission. On April 22, a Russian strike destroyed part of the Kharkiv TV tower, disrupting digital television in the city. On May 6, the TV tower in Bilopillia (Sumy region) was damaged; Russian propaganda outlets published footage of the attack and identified a cellular tower among the targets hit. Damage to telecommunications infrastructure continued throughout 2025. On October 30, a Russian strike damaged the TV tower in the center of Chernihiv. In November, the Regional Military Administration reported damage to a mobile tower in the Kherson region, while a Russian attack in the Chernihiv region damaged a tower in Semenivka.
According to estimates by the World Bank, the European Commission, the UN, and the Ukrainian government, by the end of 2025, direct damage to the telecommunications, digital infrastructure, and media sectors had reached approximately $2.5 billion, with additional losses totaling around $2.7 billion. The Donetsk, Zaporizhzhia, Kherson, and Kharkiv regions were hit hardest.
In the second half of September 2026, Russian forces began attacking data centers and telecommunications infrastructure in Kyiv. One major strike occurred on September 23. According to the Ministry of Digital Transformation, infrastructure damage caused internet access issues for approximately 100,000 households in Kyiv and the surrounding region. Operators such as UTELS, Pavutyna, MiroHost, Domonet, KIEVNET, and Faust reported equipment damage or service disruptions; the Parkovyi Convention and Exhibition Center data center was also affected. Some providers switched their networks to backup equipment and gradually restored connectivity.
The Russian Ministry of Defense made no secret of the fact that data centers were among the stated targets of the attack. The agency claimed to have struck two such facilities in Kyiv that were allegedly being used to support the Ukrainian military. In contrast, Ukrainian Foreign Minister Andrii Sybiha emphasized the civilian importance of this infrastructure, noting that it gives people access to communications and real-time information—specifically, alerts about missile and drone threats.
On September 25, a Russian strike damaged the Datagroup data center in Kyiv. The company reported that no employees were injured, client data remained intact, and services continued to operate from backup sites. The Russian Ministry of Defense said it considered the facility a military target, alleging it facilitated the processing and transmission of intelligence for the Armed Forces of Ukraine. At the time, open sources provided no independent confirmation of such use.
The following day, the COSMONOVA data center sustained severe damage. According to the company itself, the Kyiv facility was hit by three consecutive drone attacks, with the strike on September 26 rendering it completely inoperable. The damage disrupted some online services, and the broadcasting of several Ukrainian TV channels was temporarily interrupted. The company announced that its physical data center in Kyiv would no longer operate.
On September 27, Kyivstar’s headquarters in Kyiv was damaged; that same day, the Russian Ministry of Defense also claimed a strike on a Vodafone Ukraine data center, although the company itself did not publicly confirm this at the time. Then, on September 30, Moscow again reported a strike on a “communications center” in Kyiv.
When can a data center be considered a military objective?
Under international humanitarian law, a data center used for civilian purposes enjoys the same protection as any other civilian object. Therefore, it may only be attacked if it meets the criteria for a military objective. Article 52 of Additional Protocol I to the Geneva Conventions establishes two conditions: the object must make an effective contribution to military action, and its destruction, capture, or neutralization must offer a definite military advantage in the circumstances. Both conditions must be met simultaneously.
Drawing this line is more difficult for data centers than for military facilities because a single site may host servers belonging to banks, media outlets, internet service providers, private companies, and government agencies, alongside equipment used by the military. However, the mere presence of a government or military service does not automatically make the entire complex a legitimate target. It is crucial to determine the specific function performed by the equipment in question. A server hosting a government agency’s website or routine administrative data does not become a military objective simply because it is state-owned.
The situation differs if the server is used to transmit intelligence, facilitate military communications or troop command, or support other operations directly linked to combat activities. In such cases, the specific equipment or section of the data center might—under certain conditions—meet the criteria for a military objective. If only a distinct part of the infrastructure performs a military function, this is relevant to target selection; one cannot automatically assume that the military use of a few servers turns the entire data center into a military objective.
The timing of the military use is also significant. Target status is assessed based on the circumstances at the moment of the attack. If equipment previously performed a military function but was no longer being used in that way at the time of the strike, its prior role does not render it a permanent military objective. For this reason, the party planning the attack must possess up-to-date information and verify whether the object retains military significance. Article 57 of Additional Protocol I explicitly outlines this obligation. A party to the conflict must take all feasible precautions to confirm that the object is a military objective and to select means and methods of attack that minimize risk to civilians. If, during planning or execution, it becomes apparent that the target is not military or that the expected harm to civilians would be excessive, the attack must be canceled or suspended.
This is particularly critical for data centers because the consequences can extend far beyond the damaged building itself. A single server facility may support the operations of service providers, websites, cloud services, media outlets, or other systems across various districts or even cities. Therefore, when planning a strike, it is essential to assess not only the number of people inside the data center but also the anticipated impact of deactivating it. The ICRC highlights the cascading effects of digital attacks: damage to a single node can disrupt numerous other civilian systems.
Consequently, even if a data center does perform a military function, the principle of proportionality still applies. International humanitarian law prohibits an attack if the incidental harm to civilians can be expected to be excessive in relation to the concrete and direct military advantage anticipated. Therefore, both the scale of the facility’s civilian use and the possibility of selecting a more precise weapon, a different strike time, or an alternative target—thereby posing less risk to the population—are significant factors. The legal assessment becomes even more severe if the data center served no military function whatsoever. Intentionally directing an attack against a civilian object may constitute a war crime. The Rome Statute of the International Criminal Court explicitly classifies intentional attacks on civilian objects that are not military targets as war crimes.
Another potential war crime arises when the facility was indeed a military target, and the strike was carried out with the knowledge that the expected harm to civilians would be clearly excessive in relation to the anticipated military advantage. In this instance, the issue is not the status of the data center itself, but rather how the attack was planned and what the decision-makers knew.
A separate assessment considers whether appropriate precautions were taken. Factors such as unverified or outdated information about the target, a failure to attempt to clarify its function, or the choice of means of attack carrying an obviously high risk to civilians can all be relevant to the legal assessment. At the same time, not every violation of the rules of warfare automatically constitutes a distinct war crime; criminal liability requires establishing the specific elements of the crime and the corresponding form of culpability. Therefore, two strikes on similar data centers could result in vastly different legal assessments. One case might involve an intentional attack on a civilian object; another, a strike on a legitimate military target that caused disproportionate civilian harm; and a third, a failure to properly verify the target or minimize consequences.
Can Russia cut off Ukraine’s internet access?
It is unlikely that Ukraine could be completely disconnected from the internet merely by striking a few data centers. Ukraine’s internet infrastructure was historically built as a highly distributed system: over three thousand providers operate in the country, many with their own fiber-optic networks, connections to multiple backbone operators, and redundant routing paths. Large companies may also maintain their own international communication links. Such decentralization makes the network more resilient against the physical destruction of individual nodes. Experts interviewed by Suspilne and DW agree that a total nationwide internet blackout is unlikely.
In practical terms, this means that the loss of a single data center does not necessarily halt a provider’s operations. Traffic can be rerouted through other channels, equipment moved to a backup site, and services launched from a different data center. According to Suspilne, most affected providers took roughly 24 hours to restore services following the September attacks.
In the case of Cosmonova, after its Kyiv data center was disabled, the company began restoring services from geographically remote backup sites, and client data was successfully preserved. The situation in frontline cities clearly demonstrates this model’s effectiveness under constant shelling. Telecom industry representative Oleksandr Hlushchenko described Kramatorsk’s experience to Suspilne, where providers frequently had to relocate active equipment and re-lay backbone lines after damage. In other words, the network can remain operational even when individual components are repeatedly destroyed. However, the system’s overall resilience does not mean users will be spared the consequences of attacks. Connectivity in a specific district or city might be lost for hours or days—particularly if a data center, a backbone line, and the power supply are damaged simultaneously. The most vulnerable points are locations where multiple networks converge at a single node or where a provider has few redundant routes. Consequently, a strike on a major data center could affect the customers of several different companies at once, even while the broader Ukrainian network continues to function.
Power supply is another vulnerability. Servers, routers, base stations, and other telecommunications equipment require electricity. Providers install batteries, generators, and uninterruptible power supply (UPS) systems, but these have finite capacity. During prolonged power outages, some equipment may shut down, while mobile networks face additional strain as users switch en masse from home Wi-Fi to mobile data. For fixed-line internet, PON (Passive Optical Network) technology has emerged as a way to enhance resilience. In such a network, no intermediate active nodes require a separate power supply between the provider’s equipment and the subscriber. If both the provider’s main equipment and the user’s router have backup power, the internet can remain operational even during a local blackout.
Thus, a more realistic risk for Ukraine is a series of local or regional service disruptions. Simultaneous attacks on data centers, backbone networks, energy infrastructure, and operator equipment make recovery harder and more costly. Providers are forced to maintain backup sites, establish alternative routes, procure generators, and duplicate equipment. While this enables the network to survive strikes, it entails ongoing expenses and requires personnel to rebuild damaged network segments while hostilities continu
