All Eggs in Frankfurt

I. Three Hits in Four Days

In the night to 8 October 2026 a Ukrainian drone struck a Yandex data centre in Sasovo, in the Ryazan region south-east of Moscow. It caught fire and operations were fully suspended. On 9 October a data centre in the Kaluga region was hit, and several modules failed completely. On 11 October came Vladimir, east of Moscow. Yandex reported that operations were “completely suspended”, that the platform was running in emergency mode with “unstable” remaining capacity, and told its business customers to activate their disaster-recovery plans.

Three hits in four days, and half of the large data centres of Russia’s biggest internet company were wholly or partly out of action. According to Al Jazeera, Sasovo housed two of the three supercomputers Yandex uses to develop its AI model.

II. Who Started It

The attacks did not come out of a clear sky. At the end of September Russia had begun to strike data centres in Ukraine. At least eight major sites in Kyiv were hit, and the internet went down across wide areas. Moscow claimed they processed military intelligence. Volodymyr Zelensky called the response “mirror-like”: “We always respond symmetrically.”

A threshold has been crossed. Until now data centres counted as civilian infrastructure, attacked at most with malware. Now they are targets for explosives, and both sides have shown that they can find and hit the buildings. Whatever is tried out once in this war ends up in every textbook afterwards, as we described in “The Trial of the Little Boys’ New Toys”.

III. A Cloud Is a Building

What failed shows how far the dependency reaches. Yandex Cloud has more than 64,000 business customers. Their data, documents, spreadsheets and programs were suddenly unreachable or only partly reachable. The payment service faltered. Yandex is now waiving its cloud customers’ fees from 8 to 31 October, and its shares lost 5.4 per cent in two trading days. Kremlin spokesman Dmitry Peskov said Yandex was “facing difficulties”, that the government was discussing the matter, and that it was too early to estimate the damage.

The word “cloud” has taught us to think of data as something floating, everywhere and nowhere. But a cloud is a building. It has an address, a roof, a power connection and a cooling plant. Whoever punches through the roof brings the cloud down to earth. For the bookkeeper in Kazan whose company accounts were stored in Sasovo, the cloud on 8 October was a burning building in a small town he had never heard of.

IV. Three Quarters in One Region

And in Germany? According to a market analysis by the real-estate adviser JLL from April 2026, German data centres have about 1,300 megawatts of capacity. Almost 1,000 of them are in Frankfurt and the Rhine-Main area, about three quarters. Berlin has 136, Munich about 100, Cologne and Düsseldorf together about 55 megawatts. In Frankfurt another 285 megawatts are under construction and 550 planned.

Then there is the junction. Frankfurt is home to DE-CIX, one of the largest internet exchange points in the world, where the providers’ networks swap their data. And the big American cloud providers have placed their German regions mostly there. Frankfurt is three things at once: warehouse, crossroads and branch office of foreign corporations.

Yandex had spread its capacity over five or six large sites, and three hits were enough. Germany has essentially spread it over one region. The concentration is even growing, and where it is shrinking, security has nothing to do with it. Berlin and North Rhine-Westphalia are catching up because grid connections in Frankfurt are running short. For large data centres a connection there can take up to 13 years.

V. Schweinfurt 1943

There is a German lesson in how this ends. In the Second World War a large share of Germany’s ball bearings, about half by most accounts, came from a single town: Schweinfurt. Without ball bearings no tank, no aircraft engine, no machine tool would turn. The Allies understood this and bombed the town in August and October 1943. Albert Speer then had production dispersed to many smaller sites. The concentration that had been efficient in peacetime turned out to be a weak point in war.

Others learned the same lesson earlier and more cheaply. In 1291 Venice moved its glass furnaces to the island of Murano, partly because the fires were a constant hazard in the densely built city. The forester learns it after every storm: a spruce monoculture yields the most timber per hectare, until the wind comes. A mixed forest yields less, but it does not fall over all at once.

VI. Secret or Known?

Does protection lie in keeping the locations secret? Since 2025 Germany has had a national data centre register under its Energy Efficiency Act. As Julian Bothe of AlgorithmWatch told Ingo Dachwitz of netzpolitik.org, it is “very patchy”: by July only 482 of an estimated 1,000 data centres required to report had done so. The industry wants the data treated as trade secrets; the authorities point to security risks.

The security argument does not carry far. Operators advertise their own locations, because their customers have to come there and connect their servers. A large data centre is a building with its own substation, cooling towers and emergency generators, visible on any aerial photograph and described in every planning application. An adversary who builds drones with a range of hundreds of kilometres will find it without a register. Secrecy mainly protects against a public that would like to know how much electricity and water is being used. It does not protect against someone who wants to attack.

VII. What the Law Protects

The KRITIS Umbrella Act, approved by the Bundesrat in March 2026, regulates the physical protection of critical facilities for the first time. Operators must register, analyse risks, submit a resilience plan and report incidents within 24 hours. The deadlines are long: registration from July 2026, risk analysis nine months later, resilience plan after ten months. Which facilities exactly are covered is still to be set out in an ordinance.

The law thinks in individual facilities. Each is to get its fence, its plan and its reporting chain. What it does not capture is the sum: that three quarters of the capacity stands in one region, hangs on one junction and is to a large extent run by providers subject to American law. A hundred well-secured facilities in one region are still one basket.

VIII. The Right Question

After the arson attack on Berlin’s power grid in January 2026, Governing Mayor Kai Wegner asked: “Should I put a policeman at every spot?” In “MESH – The Mayor’s Wrong Question” we answered that the question was wrongly put. The right one is: why does a single failure bring so much to a standstill? Our basic rule was that no element may be built so that its failure causes more than a local and temporary disruption.

For data this means: do not harden every data centre against every drone, but spread and mirror the data so that the loss of one site, even of a whole region, switches off nothing essential. Authorities, hospitals, municipal utilities and banks need copies of their data in at least one second, distant location, running, not as a backup in a cupboard. Municipal and regional data centres are then not a luxury but part of defence. And the switch-over has to be practised. Yandex had several sites and still told its customers to activate their disaster-recovery plans. Many evidently had none.

In “The Switch” the switch that can turn Europe off digitally lay in Washington. In “The Switch in the Town Hall” the second lay with our own majorities. Yandex shows a third: there is no need to persuade anyone or change any law. A drone over a roof is enough.

IX. The Objections

Germany is not at war, and Frankfurt is far from any front. True. But Ryazan is far from Ukraine too, and the Berlin blackout in January needed no drone, just a can of petrol. Whoever plans infrastructure only against the war he considers unlikely overlooks the sabotage that is already happening.

Distribution costs money, and concentration has good reasons: short distances, fast connections, shared power supply. That is true as well. But it is the same calculation Schweinfurt made before 1943, and the one that comes due after every storm in the spruce forest. Redundancy looks like waste in peacetime. Whoever waits for the emergency asks the question we asked in “Do We Only Build the Ark When the Flood Is Already Here?” and gets the answer we described in “It Has to Get Bad First”.

Yandex had spread its eggs over five or six baskets, and three drones were enough. Germany keeps three quarters in one basket, and the basket stands in Frankfurt.