April 2026 demonstrated how dramatically the role of data centers has changed.
Cyberattacks targeting Amazon, Oracle, and more than 160 Israeli data centers showed that digital infrastructure has become one of the primary targets in modern hybrid warfare.
For Russia—where digital transformation and artificial intelligence require enormous computing capacity—the protection of data centers has become an issue of national security.
The appropriate response includes strengthening the protection of critical information infrastructure (CII), introducing stricter physical security requirements—including expanded authority for private security organizations to protect strategic facilities—integrating operators into the State System for Detecting, Preventing, and Responding to Computer Attacks (GosSOPKA), and addressing growing energy shortages.
Only a comprehensive combination of physical protection, cyber resilience, and reliable power supply can ensure the uninterrupted operation of the country's critical systems.
April 2026 witnessed an unprecedented wave of cyberattacks against digital infrastructure throughout the Middle East.
In response to military escalation, dozens of data centers operated by global technology companies Amazon and Oracle, together with more than 150 Israeli government and military data centers, were targeted and disrupted.
These incidents exposed the global vulnerability of data centers as priority targets during international conflicts.
For the Russian Federation, whose economy and public administration increasingly depend on digital technologies, protecting domestic data centers has evolved from a purely technical issue into a central element of national security.
This growing awareness is reinforced by Russia's domestic digital agenda.
Rapid digital transformation and the accelerated deployment of artificial intelligence are generating unprecedented demand for computing capacity.
Reliable operation of data centers has therefore become essential for government administration, the financial system, industrial production, and critical public services.
Against this background, the State Duma's adoption in March 2026 of legislation strengthening anti-terrorism protection for critical infrastructure—including energy facilities—represents a timely and necessary response to emerging threats.
In today's Russian economy, data centers ensure the uninterrupted functioning of virtually every segment of digital activity, from e-government services to industrial Internet of Things (IIoT) systems.
Within Russia's broader strategy of achieving digital sovereignty, data centers have become strategic assets underpinning the country's technological independence rather than merely facilities housing servers.
A particularly important issue concerns energy supply.
The rapidly growing demand for AI computing resources has already resulted in shortages of available electrical capacity, particularly in the Moscow metropolitan area.
The government is therefore pursuing a dual strategy: encouraging the construction of data centers in regions with surplus electricity while simultaneously establishing preferential energy zones to support AI infrastructure and prevent power shortages from slowing technological development.
The events of April 2026 in the Middle East confirmed long-standing concerns among cybersecurity experts.
Data centers have become legitimate, high-priority targets in modern hybrid warfare.
Even facilities located in neutral countries are increasingly vulnerable to retaliatory cyberattacks.
Iran's attack against an Amazon Web Services data center in Bahrain demonstrated that a single successful breach can disrupt an enormous number of digital services across an entire region.
Even more significant was the attack against Israel, where more than 160 data centers were affected, disrupting defense and government management systems.
During recent years, Russia has substantially strengthened its national information security capabilities.
By the spring of 2026, companies operating within the fuel and energy sector had achieved the country's highest sectoral cybersecurity index, reflecting growing awareness of cyber risks and increasing investment in digital security.
Nevertheless, developments in the Middle East demonstrate that attackers may target not only critical infrastructure itself but also the data centers supporting its operation.
This reality requires a comprehensive approach that combines cybersecurity with robust physical protection.
Russia's legal framework governing the security of Critical Information Infrastructure (CII) and data centers has been evolving rapidly in response to emerging threats.
The year 2025 marked a turning point in the protection of critical infrastructure. Regulatory requirements became substantially more stringent, shifting from formal compliance toward practical resilience and technological sovereignty.
Federal Law No. 58-FZ of 7 April 2025 introduced significant amendments to Federal Law No. 187-FZ "On the Security of the Critical Information Infrastructure of the Russian Federation," considerably strengthening security requirements for operators of critical information infrastructure.
Analysis of the attacks in the Middle East and the subsequent legislative response in Russia demonstrates that the government increasingly views the protection of digital infrastructure as an integrated system in which the reliable operation of the fuel and energy sector is inseparable from the protection of the IT infrastructure supporting it.
To strengthen this protection, operators are now required to participate in regular information security exercises conducted in accordance with procedures approved by the Ministry of Energy of the Russian Federation.
In addition, a draft law on the protection of critical infrastructure—adopted by the State Duma in its first reading in February 2026 and currently undergoing further refinement—contains several provisions directly affecting the security of data centers supporting strategic industries, including the fuel and energy sector.
Among its principal requirements are:
- mandatory immediate notification of government authorities regarding computer attacks;
- active cooperation with competent authorities in mitigating the consequences of cyber incidents;
- mandatory integration into the State System for Detecting, Preventing, and Responding to Computer Attacks (GosSOPKA);
- significantly strengthened physical protection requirements for especially important facilities.
The draft legislation also authorizes licensed private security organizations protecting strategic infrastructure to use firearms while performing their duties.
Conclusion
The events in the Middle East have demonstrated that data centers have become a new battlefield in modern hybrid warfare.
Disrupting their operation can lead to the paralysis of government administration, defense systems, financial services, and critical infrastructure.
At the same time, Russia's ongoing legislative reforms—including the new draft law on critical infrastructure protection and updated CII security requirements—demonstrate a growing awareness of these threats and an effort to establish a comprehensive legal framework protecting the country's digital infrastructure.
Today, both government and industry face the complex challenge of simultaneously addressing several interconnected priorities:
- meeting the rapidly growing demand for computing capacity, particularly for artificial intelligence;
- overcoming regional electricity shortages;
- ensuring robust physical protection of critical facilities;
- countering increasingly sophisticated cyberattacks.
The comprehensive security of Russian data centers must therefore rest upon three fundamental pillars:
- Physical protection, including counter-sabotage measures and enhanced security regimes for strategic facilities.
- Cyber resilience, encompassing continuous monitoring, rapid incident response, compliance with CII requirements, and integration with GosSOPKA.
- Resilient supporting infrastructure, ensuring uninterrupted power supply and operational continuity during emergencies.
Only a coordinated approach combining all three dimensions will enable Russian data centers to withstand modern hybrid threats while ensuring the reliable operation of the country's critical digital infrastructure under any circumstances.
