Russian attacks on Ukraine’s energy, telecommunications and digital infrastructure have made IT continuity a critical component of business resilience. Damage to data centres and communications networks can disrupt access to corporate systems, interrupt payment processing and affect customer service. In this environment, backups are only one element of preparedness; businesses also need effective recovery plans to restore critical operations and maintain continuity.
For businesses operating in Ukraine, digital infrastructure failure is a tangible operational and financial risk. Military attacks on data centres, telecommunications networks and energy infrastructure demonstrate how physical damage to critical infrastructure can disrupt digital services and affect business operations.
A notable example was the Russian strike on 19 October 2026, which completely destroyed Datagroup’s data centre in Kyiv, according to Interfax-Ukraine. However, this was not an isolated incident. According to Ukraine’s Prime Minister, Russian strikes damaged around 10 data centres in Kyiv in September 20263. Separate attacks on internet service providers’ infrastructure disrupted internet access for approximately 100,000 households in Kyiv and the surrounding region4. On 20 October, Kyiv’s GigaCenter data centre was also damaged. Despite the extensive damage, Datagroup was able to maintain its services through backup facilities. These incidents highlight the systemic threats facing Ukraine’s digital infrastructure and the growing importance of resilience in maintaining critical business services.
Repeated attacks on Ukraine’s digital infrastructure underscore a critical distinction: preserving data is not the same as ensuring business continuity. Information may remain intact while applications are inaccessible, connectivity is disrupted or alternative infrastructure lacks sufficient capacity. The resulting interruption can affect payment processing, financial reporting, production schedules and customer service.
For management, the question is not simply whether backups exist. It is whether recovery arrangements can sustain critical operations, contain financial exposure and maintain essential controls when infrastructure fails.
When technology failure becomes business exposure
Ukraine’s recent infrastructure losses demonstrate how physical damage can disrupt digital services far beyond the location of an incident. They also expose the limitations of relying solely on provider assurances or the existence of backup arrangements.
Modern businesses rely on interconnected systems spanning finance, procurement, inventory, logistics and customer management. These systems may share infrastructure or depend on the same external providers, creating vulnerabilities that individual IT assessments may overlook.
Restoring a database does not guarantee that transaction-processing applications will function. An alternative data centre may lack sufficient capacity, while a cloud platform may remain operational but inaccessible because of network disruption.
The consequences can quickly spread across the business:
- Financial performance: delayed invoicing and collections, interrupted payments and additional recovery costs.
- Operations and supply chains: production delays, inventory discrepancies and disrupted supplier coordination.
- Commercial commitments: missed deadlines, service interruptions, contractual exposure and reputational damage.
- Governance and reporting: unavailable records, disrupted internal controls and delayed financial or regulatory reporting.
Assessing these exposures requires more than a technical inventory. Management needs to understand how technology dependencies affect business processes, financial performance and control effectiveness.
What determines recovery capability?
Four factors are central to understanding whether existing arrangements can withstand a significant infrastructure failure. Together, they provide a practical basis for evaluating recovery readiness, identifying control weaknesses and prioritising remediation.
- Critical business dependencies. Mapping essential processes to the systems that support them establishes restoration priorities and identifies single points of failure. It also helps determine where downtime could have the greatest operational or financial consequences.
- Recovery requirements. Recovery time objectives (RTOs) define the target time for restoring a system or process. Recovery point objectives (RPOs) specify the maximum targeted period of data loss, measured in time. Both should reflect business requirements and the consequences of disruption, rather than the limitations of existing technology.
- Infrastructure and third-party dependencies. Multiple backups do not necessarily provide independent protection. Primary and recovery environments may share a provider, network, power supply or geographical location. Reviewing these dependencies helps identify concentration risks and assess whether alternative arrangements would remain available during a wider outage.
- Tested procedures and effective controls. Recovery plans must demonstrate that data, applications and business processes can be restored within agreed parameters. Testing should also verify user access, financial and operational controls, decision-making responsibilities and the effectiveness of corrective measures.
Aligning investment with business risk
The cost of infrastructure failure extends well beyond IT recovery. Lost sales, idle capacity, delayed deliveries, contractual penalties and the reconstruction of records can compound the direct cost of restoring systems. Disruption to billing and collections may also place pressure on working capital.
These consequences are often spread across departments, making the total exposure difficult to quantify. A structured assessment of disruption scenarios helps management compare potential losses with the cost of safeguards such as independent backup environments, alternative hosting, redundant connectivity and improved recovery procedures.
The objective is to direct investment towards the risks with the greatest potential business impact. This means evaluating not only the likelihood of failure, but also its financial consequences, the effectiveness of existing controls and the exposure that remains after mitigation.
Outsourcing does not eliminate this responsibility. Cloud services and external IT providers may improve flexibility, but service interruptions can still affect the customer’s operations. Recovery commitments, subcontractor dependencies, access to business data and the ability to migrate critical workloads all influence how effectively the business can respond.
Technology risk therefore belongs within broader enterprise risk management, financial planning and corporate governance. Investment decisions are most effective when technical requirements are assessed alongside operational priorities and financial exposure.
Turning risk assessment into action
Effective preparation for infrastructure disruptions begins with understanding which technology dependencies pose the greatest risks to business operations. This enables organisations to prioritise protective measures, recovery capabilities and investments in business resilience.
For businesses, the priority is to establish whether their technology environment, recovery procedures and third-party arrangements can support essential operations under realistic disruption scenarios. This requires a joined-up assessment of infrastructure dependencies, control effectiveness and the financial implications of failure.
Moore Kyiv, Ukraine combines IT audit, cybersecurity and risk management expertise to help businesses identify vulnerabilities, evaluate their business implications and establish clear priorities for action. Our IT audit and cybersecurity services examine technology environments, data flows and control mechanisms to identify areas requiring attention. Through our risk management advisory, we help organisations assess operational exposures, strengthen governance and align risk management with business objectives.
By connecting technical findings with financial exposure and operational priorities, Moore helps management evaluate remediation measures, strengthen oversight and allocate resources where they can make the greatest difference.
Data preservation is only one component of preparedness for digital infrastructure failure. Equally important is the ability to restore critical processes promptly, maintain the continuity of control procedures and fulfil contractual obligations to clients. A comprehensive assessment of these factors helps determine an organisation’s true capacity to withstand technology disruptions without unacceptable losses to its operations.
