Scammers Target Yandex Users After Drone Attacks on Data Centers

Yandex has published guidance on restoring online services after outages and, at the same time, warned users about scammers. According to CNews, in October 2026 attackers may be exploiting the aftermath of drone attacks on the company's data centers. The schemes revolve around two pretexts: "account recovery" and "compensation for downtime."

A physical incident at a data center turns into social engineering within hours. While engineers bring services back online, people accumulate questions, and scammers answer them faster than anyone.

What we know

The CNews report is thin on detail. The company does not disclose how many sites were hit, which services went down, or for how long. The channels currently used to send the fake messages are not named either. Three things are confirmed: there were outages, they are linked to drone attacks on data centers, and Yandex considered the risk of fraud serious enough to warn its audience separately.

Key facts from the announcement:

• Period: October 2026.
• Cause of the outages: drone attacks on the company's data centers.
• First lure: help with "restoring" an account.
• Second lure: "compensation" for service downtime.
• Official response: recommendations for restoring services and a warning about the schemes.

Why these schemes work

The mechanics are familiar from any major outage. A person cannot log in to their email, taxi app or cloud storage, looks for the cause, and sees a message from "support." It offers to confirm their identity quickly or to receive a payout. Anxiety and fatigue from the unavailable service switch off their usual caution.

Such emails and messages typically lead to a copy of a login page or ask the user to read out a code from an SMS. The second popular scheme: to "receive compensation," the victim must enter bank card details or pay a small "commission fee." The user loses not access to the service but money and control of the account. This is common scammer practice, not a description of a specific campaign against Yandex: the company's announcement contains no such details.

The outage acts as an amplifier here. It creates a mass occasion for inquiries, and the fake message lands at a moment when the person is genuinely waiting for an answer from the service.

Infrastructure as an attack surface

The story has two layers. The first is physical: data centers have become targets of attacks, and the resilience of cloud infrastructure now depends not only on redundancy of servers and network links but also on the protection of the sites themselves. The second is informational: every outage triggers a wave of phishing, and companies have to plan their communications in advance. A quiet recovery without clear explanations leaves room for forgeries.

That is why it is telling that the recommendations and the warning came out together. It is an attempt to claim the information space before scammers do and to give users a single reference point for what counts as an official channel.

What users should do

The practical rules are simple, and they do not depend on the specific service:

• Do not click links in messages about "recovery." Open the official app or type the website address manually.
• Never give anyone codes from SMS or push notifications, passwords, or answers to security questions. Real support does not ask for them.
• Verify any "compensation" only in your personal account or on the official website. If a payout requires card details or a prepayment, it is a scam.
• Turn on two-factor authentication if it is not already enabled, and check the list of active sessions after the outage.
• If you have already entered your details on a suspicious page, change your password immediately, end any sessions that are not yours, and contact your bank if payment details are involved.

Businesses that depend on Yandex services should sensibly warn their employees and customers. During such periods, messages about "restoring access" in corporate chats and email should be treated as suspicious by default until an administrator confirms them.