Hosting With Yandex and High-Risk Regions: EU Exit Plan
This is a neutral risk assessment, dated 2026-10-12, for teams that run hosting with Yandex Cloud or with other providers in regions with a similar risk profile. We name a provider only where a public source does. Each risk is read as what it can do to your availability, your data and your compliance. Every fact carries a date and a link, and anything we could not verify is left out.
What is confirmed and what is reported
- Confirmed by the provider, 2026-10-08. The Register (2026-10-09) quotes Yandex's cloud status page: a fire after a drone attack on its Sasovo data center, availability zone ru-central1-b down, operations halted, no restoration soon.
- Reported, 2026-10-09 to 2026-10-11. Al Jazeera (2026-10-11) reports that the Kaluga site was partly knocked out and that Yandex suspended all operations at the Vladimir site, called the remaining configuration unstable and advised users to activate disaster-recovery plans.
- Not established. Yandex did not say who carried out the attacks. Media attribute the Sasovo and Kaluga strikes to drones from Ukraine. Restoration status after 2026-10-11 is unknown to us.
These are incidents at one operator in about a week. They are not a statement about every provider in any region.
Risk matrix
| Risk | What it means for a customer | Basis |
|---|---|---|
| Physical | A site can stop for an unknown time, and backups in the same site go down with it | Incidents above (provider-confirmed) |
| Service and network instability | Your service can become unreachable from outside while servers are healthy | Reported by Mediazona, 2026-04-07 |
| Sanctions and payments | Vendors, software and support can become unavailable or need authorisation | Commission FAQ, 2026-01-22 |
| Legal and state access | Data held by a provider can fall under lawful-access and decryption duties | Law summary, 2018 |
| Data and compliance | Where data sits decides which regime applies to you | Our assessment |
Sanctions, law and network rules
- Network. Mediazona (2026-04-07) says authorities cite drone threats for regional mobile shutdowns, that a whitelist registry of services started in September 2025, and that Moscow mobile internet was out for nearly three weeks in March 2026. It cites unnamed sources for who orders the cuts, so treat that part as reported.
- Sanctions. The European Commission FAQ on Article 5n (as of 2026-01-22) says EU operators may not provide IT consultancy, including maintenance of existing software, to the government or entities established in the jurisdiction the regulation covers. Cloud services are in general not IT consultancy, but certain software is covered when delivered through the cloud. This is not legal advice.
- State access. A law-firm summary (2018-08-07) of Law 149-FZ Article 10.1 says organisers of information distribution store metadata for one year and message content for six months in the country, give copies to the security service on request and hand over decryption information on request. Check the current text of the law.
Self-assessment
- I know which sites and zones my servers, databases and backups sit in.
- My newest backup lives outside the provider and outside the region.
- I can restore from that backup without the provider's help.
- I know which vendors, licences and payment routes I depend on.
- I know which of my data is personal, regulated or secret.
- A named person owns the decision to move.
Migration checklist
- Inventory servers, databases, DNS, certificates, keys and cron jobs.
- Classify data by sensitivity and by the rules that apply to it.
- Get backups out first, encrypted, to a place you control.
- Lower the DNS TTL a few days before the move.
- Cut over after a test run under the real hostname, then a final sync.
- Keep the old side read-only until the new one has proven itself.
- Prepare rollback: old records, last sync point and a stop time.
The method is in how to migrate to a cloud server. Pick a site with how to choose a cloud server location in Europe and size it with the cloud server sizing guide. DCXV cloud servers run in Prague (Czechia) and Covilhã (Portugal), from EUR 15.00 per month for 2 vCPU, 4 GB RAM and 40 GB NVMe (checked 2026-10, one backup included); see cloud servers. An EU location does not by itself make you compliant, and we make no claim of immunity from any risk. Write to sales@dcxv.com or see the cloud options.
