Drone Attacks on Four Ozon Logistics Hubs: A Node-Isolation Playbook for Distribution Networks

A distribution hub can stop operating in minutes. The network around it cannot afford to stop thinking.

Reuters reported that four logistics hubs belonging to Ozon, Russia's second-largest online retailer, were targeted by Ukrainian drones on August 24. The reported locations spanned southern Russia, including Dagestan, Krasnodar, Adygea, and Stavropol. Reuters had also reported an attack on an Ozon warehouse in the Orenburg region one day earlier.

The human consequences of such incidents come first. Once emergency services secure people and the site, however, logistics teams face another urgent problem: preventing a damaged or inaccessible node from corrupting promises across the rest of the network.

That requires more than a generic disaster-recovery document. It requires a node-isolation playbook that can stop unsafe activity, preserve shipment history, divert executable work, and measure recovery without pretending that unavailable inventory or capacity still exists.

Separate a facility outage from a network outage

Four affected hubs do not automatically mean every order in a national network has failed. They do mean planners must rapidly identify which orders, stock, carrier appointments, workers, and downstream facilities depend on those nodes.

The first action should be to change each affected facility to an isolated operating state. That status must immediately block new tenders, pickup appointments, wave releases, and inventory promises at the node. It should not delete orders, cancel freight indiscriminately, or rewrite historical milestones.

Create a dependency map for every isolated hub:

• Orders physically inside the building, staged in its yard, or merely planned through it
• Inventory confirmed on hand, allocated to an order, in transit, or unavailable for verification
• Inbound vehicles approaching the site and outbound vehicles already dispatched
• Carrier appointments, dock reservations, labor assignments, and linehaul connections
• Customer commitments and downstream nodes that rely on the hub's sortation or replenishment

This distinction contains the disruption. Orders unaffected by the isolated node continue to move. Orders with a dependency enter an exception queue with an owner and a next decision time.

Deloitte argues that distribution strategy is now central to supply chain resilience, noting that many networks were designed for predictable, pre-pandemic flows. A resilient design is not simply a collection of extra warehouses. It is a set of executable alternatives backed by accurate data and defined authority.

Isolate orders, inventory, labor, and appointments differently

A single "facility closed" flag is too blunt. Each operating object needs its own rule.

Orders: Freeze fulfillment tasks at the affected node while preserving the original order and promise. Classify each order as not released, in process, staged, loaded, or departed. Only orders whose physical status is known should be reallocated automatically. Anything ambiguous needs verification before another location ships a replacement and creates a duplicate.

Inventory: Move quantities at the isolated node from available-to-promise into a quarantined status. Do not treat system balance as usable stock until a physical or trusted automated check confirms it. Alternate hubs should expose their unallocated inventory, substitution rules, and replenishment risk before accepting transferred demand.

Labor: Emergency accountability remains separate from production scheduling. Record who has checked in safely, then cancel assignments that would send employees or contractors toward the site. Recovery labor should be scheduled only after safety leadership releases the relevant zones.

Carrier appointments: Cancel or redirect arrivals with explicit acknowledgments. Give drivers a safe holding point, alternate destination, new reference number, and compensation instructions when applicable. An appointment removed from a calendar without a carrier confirmation is still a truck potentially heading toward danger.

Preserve shipment lineage through every diversion

Rerouting is where hurried response can destroy visibility. Teams often cancel an original load and create a new one, leaving customer service and finance unable to explain what happened.

A TMS should keep the original shipment identifier and create a linked diversion leg or replacement movement. The record should retain the original origin, planned route, tender, appointment, carrier response, and timestamps. It should then add the isolation event, decision owner, alternate node, new carrier or route, incremental cost, and revised delivery commitment.

Candidate alternate hubs should be ranked with operational constraints, not straight-line distance alone. Planners need confirmed inventory, dock capacity, labor availability, equipment compatibility, carrier coverage, route safety, cutoff times, and downstream sortation capacity. Sending every affected order to the nearest building may simply move the bottleneck.

Automation helps only when it respects thresholds. McKinsey found that 64% of surveyed supply chain executives identified warehouse-role automation as their leading digitization and automation priority. During an incident, automated matching can accelerate alternatives, but a human should approve diversions that exceed cost, distance, capacity, safety, or customer-impact limits.

Recover by evidence, not by announcement

Reopening the doors is not the same as restoring the node. Recovery should progress through controlled states: isolated, assessment, limited inbound, limited outbound, constrained operation, and normal operation. Each transition needs an accountable approver and measurable exit criteria.

Track four measures from the first disruption timestamp:

• Backlog age: the oldest unfulfilled order dependent on the node
• Reroute latency: time from isolation to an accepted alternate plan
• Restored throughput: completed units, orders, or loads versus the node's normal baseline
• Promise recovery: share of affected orders with a confirmed, achievable delivery commitment

Add safety clearance, inventory verification, appointment adherence, duplicate-order rate, and incremental freight cost to the recovery dashboard. A hub should not return to "normal" because one shift processed freight. It should return when throughput is stable, the backlog is shrinking, inventory integrity is verified, and carriers can execute the published schedule.

The core lesson is uncomfortable but useful: resilience begins with the ability to say exactly what must stop. Clear isolation rules prevent one facility incident from becoming a network-wide data and service failure. Preserved shipment lineage then gives teams the evidence to divert carefully, communicate honestly, and recover in stages.

Ready to build controlled exception and rerouting workflows into transportation execution? Request a CXTMS demo and see how CXTMS helps teams preserve shipment visibility when the network changes without warning.