The environmental risks from attacks on data centres

Introduction

Data centres underpin our digital infrastructure, they house the servers and networking equipment that store and process our data, run AI models and transmit information around the world. Three converging and reinforcing trends are making conflict-linked pollution from data centres more likely:

 

1. Data centres are being targeted during conflicts

Microsoft reported that Ukrainian government data centres were among Russia’s first cruise missile targets back in 2022. But it has taken until this year for attacks to have become a recognised new front in warfare, with the trend especially apparent in 2026’s conflict in the Middle East and Russia’s war against Ukraine. A conservative estimate put the total number of attacks at 27 as of 17 October 2026; more have occurred since, and are warned of. However, the coverage of these recent attacks has focused on lost services and infrastructure resilience, not on the threat that pollution from the attacks may pose to people and the environment.

2. Hybrid attacks are rising in Europe 

European governments have attributed recent suspected sabotage on data infrastructure to Russia and its proxies; this includes undersea cables and now also data centre attacks. In Lithuania on 18 October 2026, there were reports of an attempted arson attack at a Vilnius data centre, and claims that it had been commissioned by Russia. Though the attack was more likely targeting Starlink equipment, it suggests that data centres are now legitimate targets for hybrid warfare. The economic and societal disruption that incidents within Russia have caused, and the protection now proposed, is evidence of their strategic value as targets.

 

3. Growing demand for data centres driven by AI, including military AI 

There are already more than 12,000 data centres in 179 countries and demand is only increasing. Regions such as the Gulf are planning transitions to a data economy and the infrastructure to support it. And with the current trend of building massive “hyperscale” facilities, electricity use is expected to more than double by 2030. Data centres are concentrated near major population centers; in the US 97.5% are within metropolitan areas, whilst here in the UK 80% of data centre capacity is within London’s metropolitan region. 

Militaries are also using commercial data centers for the AI capabilities they are developing. The US DoD has established a cloud procurement framework worth up to $9 billion, with suppliers including Amazon, Google and Microsoft, whilst the UK MoD has also committed to hyperscale infrastructure. This means that they could be viewed as military objectives under international humanitarian law (IHL) and therefore as legitimate targets, even in cases where it is difficult to prove that a specific data centre may or may not be contributing to the war effort.  

Where they are or are perceived to be legitimate military objectives, attacks on data centres clearly engage the IHL principles of distinction and precaution, including the need to consider foreseeable civilian and environmental harm, such as exposure to toxic pollutants generated by fires. However, at present there is little documentation on the scale and scope of potential pollutants from such attacks, and therefore little data upon which to determine these risks. This post is an initial consideration of the potential environmental risks, civilian exposures, and the questions different stakeholders should explore.

What hazardous materials are inside data centres?

Data centres are industrial sites with a unique contamination profile. While much of the estimated 7,000 tonnes of equipment inside a typical 100-megawatt data centre consists of relatively inert materials, the greatest pollution risks come from fuels, batteries, plastics and specialist chemicals. When damaged or burnt, these can release toxic substances into the air, soil and water. 

Restrictions on hazardous chemicals do not eliminate these risks. International agreements have phased out some particularly harmful substances, including certain brominated flame retardants and PCBs. However, some older equipment may still contain them, and regulations and enforcement vary between countries. Meanwhile, newer chemicals are not necessarily harmless.

Component	Typical materials	Potential pollution and exposure
Backup generators and fuel stores	Diesel, lubricating oils.	Fuel spills contaminating soil and water; smoke containing particulates and carcinogenic PAHs.
Batteries	Lithium-ion or lead-acid.	Toxic hydrogen fluoride gas, metals including nickel, cobalt and lead, and sulphuric acid; contamination of smoke, debris and firefighting water.
Servers, electronics and cabling	Flame-retardant plastics, PVC and metals.	Dioxins and furans formed during burning; corrosive gases and metals released in smoke, ash and runoff.
Cooling systems	Refrigerants, including HFCs and HFOs.	Chemical releases and toxic breakdown products, including hydrogen fluoride.
Fire suppression	Water, inert gases or fluorinated suppression agents.	Some fluorinated agents can produce hydrogen fluoride when exposed to intense heat.
Transformers and switchgear	Insulating oils, sulphur hexafluoride (SF6); polychlorinated biphenyls (PCBs) in some older equipment.	Oil spills and fires; toxic SF6 breakdown products; persistent PCB contamination where legacy equipment is present. SF6 is an extreme climate forcer with 24,000 times the impact of CO2.
Water treatment	Biocides, corrosion inhibitors, acids and alkalis.	Toxic spills or runoff entering drains and watercourses.

How does pollution reach people and the environment?

The severity of harm from data centre attacks depends not only on their contents, but also the pathways through which people and the environment are exposed to pollutants. 

Fire poses the greatest immediate threat. Burning equipment emits smoke containing a cocktail of toxic particulate matter and gases; including complex pollutants formed from pyrolysis. During fires, materials from different types of equipment can combine to create new hazards. For example, when plastics containing brominated flame retardants burn alongside chlorine-containing materials such as PVC, they can form toxic mixed brominated and chlorinated dioxins and furans (PXDD/Fs). 

Firefighting equipment can also contribute to the pollutant mix, for instance hydrofluorocarbon fire suppression agents decompose at high temperatures to release the highly toxic gas hydrogen fluoride. The particulate matter in smoke can be deposited, creating secondary risks away from the site itself. After the January 2025 Moss Landing battery fire in California, sampling identified battery metals deposited in wetlands 1–3 km downwind.

Longer-term pollution risks are associated with the accumulation of contaminants in soils, sediments and water, and food chains. Sources can include deposited smoke or the run-off from emergency or accidental discharges, damaged tanks or firefighting waters into rivers and groundwater. For example, 5,500 gallons of diesel was discharged into a creek in New Jersey in September, whilst in May, fish mortality was reported after contaminated run-off entered canals from an electronics recycling facility in Salt Lake City. The clearance, management and disposal of large volumes of hazardous waste presents a further exposure pathway, with risks likely greater in conflict settings where oversight is reduced.  

Our evidence base for data centre incidents remains limited. This is not due to the number of events, 59 peacetime incidents have been recorded since 2014. Instead it appears to be due to limited data collection and sharing in relation to those events. When fire destroyed OVHcloud’s SBG2 building in Strasbourg in 2021, environmental assessments of contaminated firefighting water and buildings were undertaken, with further analyses ordered by the authorities. Yet their findings were not included in the report of the investigation.

Planning for low-probability, high-consequence events

It’s important to distinguish the environmental risks posed by attacks to those from accidents. Data centre safety systems are primarily designed for accidents, rather than incidents that can overwhelm several safeguards simultaneously. For example, an attack with explosive weapons could breach fire compartments, rupture and ignite fuel tanks, or disable fire suppression systems. Firefighters could face further explosions, cascading fires and unsafe access conditions. An attack could therefore be expected to cause a much larger, less controllable emergency than conventional fire safety planning anticipates.

So, how should authorities plan for such incidents that can overwhelm normal safety systems? These scenarios are rarely considered in environmental impact assessments, meanwhile data centres can fall between regulatory requirements; for example where chemical inventories are below major-hazard thresholds.¹

We didn’t have to look far for an example of this: Microsoft’s proposed Skelton Grange campus in Leeds, which is 32 km from CEOBS office. Although the UK designated data centres as critical national infrastructure in 2024, the plan’s environmental statement frames deliberate attack as terrorism rather than state-linked sabotage or military strikes, concluding that ‘terrorist incident risk is not heightened or noteworthy due to the Site’s location and intended uses of the Proposed Development’. Major accidents and disasters were consequently excluded from detailed risk assessment, and those documents we reviewed did not explore scenarios where several safety systems are disabled simultaneously.²  

Yet a catastrophic fire resulting from a military attack could disperse toxic smoke and deposit persistent pollutants across heavily populated parts of West Yorkshire; our wider urban area is home to nearly two million people. The site’s industrial surroundings and legacy contamination could complicate the aftermath, while contaminated firefighting water could reach the adjacent River Aire and important downstream habitats. As data centres grow in military value, should planning authorities reconsider how they assess these risks, and what meaningful preparation would look like? Moreover, to what extent could this help inform our understanding of the risks associated with attacks in data centres during conflicts?

Looking ahead

As data centres become increasingly central to our economies and to military operations, attacks will present growing environmental risks that remain poorly characterised. In wartime settings such as Ukraine, understanding and responding to this harm is already an immediate concern, but there are challenges for us all. As AI — and military AI in particular — accelerates infrastructure expansion, are we adequately questioning its necessity, its environmental costs and the risks expansion imposes on the communities living with it?

For militaries and governments: Commercial cloud services offer resilience and cost savings but what steps are needed to minimise risks to the surrounding civilian population?

For policymakers and planners: Are existing safety regulations sufficient to address sabotage, hybrid warfare and catastrophic failures?

For data centre operators and financiers: Have emergency plans been tested against severe incidents that overwhelm multiple safety systems, including modelling the potential release of hazardous pollutants in built up areas?

For civil society and donors: How can we better map and model risks to people and the environment in conflict-affected areas, and support monitoring and response following attacks?

 

Eoghan Darbyshire is CEOBS’s Senior Researcher; if you’ve found this post useful please donate to ensure that we can write more.