Beget confirms customer data loss after cyberattack on cloud

Customer VPS data can be restored from the remaining file backups, but clients cannot reach them yet. Engineers first have to rebuild the infrastructure and check the servers for hidden vulnerabilities and malware. In total, more than a thousand servers must be inspected by hand.

What has been restored

Virtual hosting fared better. By the provider's preliminary estimate, almost 100% of the sites hosted there can be recovered, though bringing servers back without checks is considered unsafe. Unmanaged dedicated servers were back online on 2 November at around 14:00 Moscow time. Most data on machines administered by Beget's specialists was preserved, and they are being checked and relaunched gradually.

By 3 November, more than 80% of the email infrastructure had been restored, including POP3, IMAP and SMTP access. The webmail interface and the DNS servers are working again. A separate service now lets customers edit A, MX and TXT records, but full access to the main control panel has not yet returned.

Beget says it has found no attempts to download or alter user data on the servers holding it. Even so, it advises customers to change passwords, access keys and any other credentials that may have been stored on affected machines. The disruption began on the morning of 2 November and hit numerous Russian websites and online services. The company initially described a complex incident across all architecture layers; it has now confirmed the attack. No timeline for full recovery has been given.