In October 2026, Yandex Cloud experienced a major cascade failure spanning data centers in Sasovo, Kaluga, and Vladimir, demonstrating the physical limits of Multi-AZ resilience when multiple zones suffer simultaneous outages.
The events began on 8 October at 01:31 MSK in zone ru-central1-b (incident 2092) with power disruptions. By 15:19 MSK, Yandex Cloud confirmed a fire caused by a drone attack that completely halted the Sasovo facility. Clients were advised to migrate workloads, yet new virtual machines, Managed Kubernetes clusters, and databases could not be created in remaining zones due to emerging capacity constraints.
At 15:30 MSK the same day, an unrelated configuration error during planned maintenance in the Curator DDoS protection service degraded access for 34 minutes to major Russian media and fintech platforms including RBK, Kommersant, Vedomosti, Interfax, T-Bank, and Avito.
On 9 October, damage was reported at the Kaluga site. Yandex Cloud arranged emergency resource placement with external providers Selectel, K2Cloud, and VK Cloud. Control Plane components for regional Kubernetes clusters could only be moved out of the affected zone after approximately 36 hours.
By 10 October, quota allocation shifted to fully manual mode, freezing automatic scaling and giving priority to critical workloads. On 11 October at 04:00 MSK, power failures struck zone ru-central1-a (incident 2136) in Vladimir, leading to another full site shutdown and an official warning that remaining capacity no longer guaranteed availability.
At 07:13 MSK on 11 October, compute resources remained available only in zones ru-central1-d and ru-central1-e. Many database clusters switched to read-only or became unavailable, while object storage allowed reads but not writes. Several Kubernetes clusters lost manageability because their control planes resided in failed zones.
Services such as Yandex Go, Yandex Eda, Yandex Pay, and Yandex 360 were impacted, along with the state VetIS system. The SaaS platform Salebot lost access to client projects and weekly backups, forcing a rollback to 4 October data and requiring more than 24 hours to rebuild indexes after restoring only six of 40 servers.
The outage illustrated that Multi-AZ architectures fail when surviving zones lack sufficient physical capacity, a condition known as Capacity Exhaustion. Additional risks included Control Plane dependency, manual quota limits blocking automated recovery, and simultaneous demand from multiple customers overwhelming alternative providers.
To mitigate such risks, the analysis recommends separating ingress buffers from primary backends. A lightweight FastAPI service deployed on an independent VDS can accept webhooks, validate tokens via constant-time comparison, and durably append events to a local JSONL queue using fsync before returning 200 OK responses.


