Kyiv strike claim puts sovereign cloud's risk premium on the table
Both militaries have now claimed strikes on data center sites inside a single year, and the siting math that governs Ukrainian digital infrastructure has acquired a row nobody built a diligence process for.
Moscow's claim, issued through the state news agency TASS, is that Russian forces struck the De Novo data center in Kyiv as part of a wider package of attacks earlier this week on Ukrainian industry and infrastructure, with the target list running through metallurgical and radio-electronics facilities, defense industry sites and energy infrastructure across Kyiv, Zaporizhzhia and the Odesa region. TASS said the data center supports server equipment used for military purposes and processes, transmits and stores data, including intelligence data, for the Ukrainian army; what the coverage does not say is whether the facility took damage, whether it is still serving customers, or who owns it.
De Novo describes itself as a sovereign cloud and AI provider that operates and supports mission-critical IT systems, and its published materials say the Kyiv facility hosts the country's largest banks and is home to the biggest Infrastructure-as-a-Service cloud in Ukraine. Those claims are why the site matters, and they are also why it is a concentration risk: the tenant list that makes the building strategically valuable is the same list that turns a single address in Kyiv into a national exposure.
The plant is a 2010 building with an expansion commissioned in 2017, Tier III compliant, and the coverage puts it at 360 rack spaces.
| Building | Floor area | Total power | IT power |
|---|---|---|---|
| Primary (Kyiv) | 2,117 sqm / 22,787 sq ft | 3.05MW | 1.05MW |
| Secondary | 1,200 sqm / 12,916 sq ft | not stated | 500kW |
Run the arithmetic on those figures and the profile is legacy. The primary building's 1.05MW of IT power comes in under 5kW a cabinet whether the 360 rack spaces are credited to that building or spread across both, which on any sober read is enterprise colocation density rather than the multi-megawatt IT halls the AI buildout has been financing. AI positioning running ahead of the power envelope is normal for an operator with expansion ambitions, and it is worth reading closely all the same, because AI demand is not served out of a 2010 shell with a 2017 fit-out unless someone funds the rebuild.
Within a single year, both militaries in this war have claimed strikes on data center sites: earlier this year, according to the same coverage, Ukrainian forces struck a Russian data center facility in Russian-occupied Prymorsk, in the Zaporizhzhia Oblast, and this week's claim runs the other direction.
Both sides have now named the target class
It matters who is describing the target. The side claiming the strike is the side asserting the military purpose, and TASS carried both the claim and the characterization, while De Novo, from the commercial side, describes a sovereign cloud whose tenants are the country's banks; the two accounts are not mutually exclusive, and the coverage does not resolve which workloads actually ran in the racks or what the strike did to them.
What is not in question is the asset class: command, payments, records and the coordination layer of a modern state sit in buildings like this one, and both sides have now claimed strikes on them. A mandate that data stay inside the country is a mandate that the data stay inside the range of whatever the neighbour can reach, which is the same instruction written twice.
Consent now decides what gets built in digital infrastructure siting: water, power, interconnection and the permit queue; kinetic risk belongs in that table as a row no diligence process accounts for. It cannot be permitted, appealed or negotiated with a county board, and it never appears in an interconnection queue; it arrives from outside the regime owners and lenders have built their underwriting around.
The exposure is awkward to hedge with the usual instruments, because national banks are the best credit a domestic operator can sign, and a tenant base of them is exactly what a lender would underwrite a building against, so concentration in national champions reads as quality in a lease abstract. Fiber routes and power contracts can be re-papered and replaced; an address cannot.
Whether any of this changes the numbers is a separate question, and the honest answer today is that it mostly does not. A bank's lease pays the same rent whether the roof is intact, and a 2010-vintage Tier III facility leases on certification, power and connectivity rather than on its coordinates, so the war-risk premium is likely sitting in insurance renewals and in whatever discount rate an eventual exit gets marked against: invisible in the rent roll until it isn't, at which point it is visible to everyone at once.
Rebuild capital, whenever it arrives, will be underwritten by owners other than today's, and the diligence question has changed shape: it is no longer whether Ukrainian digital demand returns, because the bank tenants answer that, but whether dispersion is fundable at a scale where a second site is a line item against a 1.05MW anchor rather than a re-platforming of the business.
Hold onto that figure, because it sizes both the loss and the rebuild. The country's largest banks are not moving their core systems across a border, and a sovereign cloud that repatriates its data somewhere safer stops being sovereign, so while the coverage does not say the site has stopped serving anyone, it does say the premium for keeping data at home and the premium for keeping it out of a war zone are charged against the same building, and only one of the two has been booked.
The premises for keeping data at home and the premium for keeping it out of a war zone are charged against the same building, and only one of the two has been booked.
The Wrap