Shortly after 1:31 a.m. local time on October 8, Yandex’s status page went red in its ru-central1-b availability zone. The Register’s write-up the following day was blunter than the company’s own: a drone strike and fire at the Yandex data center in Sasovo — a town roughly 300 kilometers southeast of Moscow — had, per the report, “completely halted” operations. Yandex never publicly made that link itself. It confirmed an “incident,” reported power problems in one availability zone, warned the outage could spread across its cloud network, and suggested customers look into its bare metal servers.

That last detail is the one that should travel further than it has. The Hacker News thread that pushed this to the front page framed it as the third such facility hit. Fine. But the most interesting fact about the Sasovo outage isn’t that a drone got through. It’s what the vendor said next.

Yandex’s Disaster Plan Was a Sales Funnel

Read the customer advisory again. Restoration “will not be possible in the near future,” so please consider “alternative service restoration plans” — including the company’s own bare metal offering. That is not a business continuity plan. That is a business continuity plan with a checkout page attached.

A systems architect at a Warsaw software firm told me her team spent that morning in an incident channel watching the status page refresh, mostly because two European customers had asked, reasonably, what their own providers’ equivalent language said. They went looking. Most of them found something vague in exactly the same way.

Her summary of the whole exercise: “Every contract promises resilience. Almost none of them promise you a way out.”

Sovereignty Relocates the Single Point of Failure

The reflex reading of Sasovo is that it vindicates the sovereign-cloud project. Brussels has referenced roughly €200 billion earmarked for European data center expansion through 2036 and about €100 billion targeted at cloud and AI leadership. Gartner, cited by the Cloud Security Alliance’s research arm, projects European sovereign cloud IaaS spending nearly tripling, from $6.9 billion in 2025 to $23.1 billion by 2027.

Here’s the arithmetic nobody wants to run. Europe’s current exposure is three American hyperscalers splitting the continent. A mature sovereign market of four or five national champions, each dominant in its home jurisdiction, is not a more diversified market. It’s a less diversified one — smaller pools, bigger shares, and each provider carrying a larger fraction of a single government’s critical workloads. You have not distributed the risk. You have redrawn its borders.

Sovereign providers also acquire a function commercial ones merely have. When the emergency arrives, a cloud with an implicit state guarantee is queued behind the state. Yandex demonstrated that in about forty-eight hours: civilian customers got a status page and a migration suggestion.

Sasovo Was Not Chosen by Accident

The facility reportedly sits at the Sasta industrial complex — a site under UK sanctions — and OSINT groups Exilenova+ and ASTRA identified it as Yandex DC Sasovo. The cloud was inside a strategic industrial park, next to the sort of thing people aim at.

That is not a Russian quirk. It’s a design incentive, and it’s the one Europe has adopted wholesale. Sovereign buildouts chase the same gravity: available grid capacity, industrial land, subsidy zones, defense-adjacent campuses. Sovereignty is a legal doctrine. Targeting is a geometric one. A drone does not read the passport on the rack; it reads coordinates.

Regulate the Exit, Not the Flag

NIS-2’s Article 21 doesn’t generally mandate localization, as Orrick’s January analysis noted — but its risk-assessment requirements push procurement toward domestic providers anyway. DORA, Regulation (EU) 2022/2554, does something similar for financial firms. Both target concentration risk. Neither touches the thing that actually hurt Yandex’s customers, which was that leaving was hard, slow, and — per the vendor’s own advice — likely to end in a different invoice from the same company.

If European regulators want resilience, the levers are unglamorous and boringly contractual: exit rights with defined timelines, portable data and configuration formats, escrowed operational knowledge, published recovery-time commitments, and a rule that a provider cannot count its own sibling product as a customer’s disaster recovery strategy.

The uncomfortable part for those of us who instinctively read “sovereignty” as industrial policy in a tricolor wrapper is that we’re right about the subsidy and wrong about the conclusion. The fix isn’t a retreat to Virginia. It’s making the flag on the building legally irrelevant to whether a customer can walk out the door.

The relevant question was never whose flag flies over the rack. It’s whether you can leave before the smoke does.

Sources