Osegi
Security·2 min read

Beget Confirms Cyberattack That Wiped Cloud Data and Backups

Russian hosting provider Beget says attackers reached its control layer and ran wiping scripts, destroying all cloud data across VPS, S3 and Kubernetes.

Rows of data center server racks with warning lights, illustrating a hosting provider hit by a destructive cyberattack.
Image: Хабр
SUMODialoediviewergiftdetect

Russian hosting provider Beget has confirmed that its IT infrastructure was hit by a cyberattack overnight between 1 and 2 November 2026. According to the company, the attackers gained access to the control layer of the entire architecture and then launched scripts that wiped data.

The cloud platform took the heaviest blow. All data in the cloud infrastructure, covering VPS, S3 and Kubernetes, was lost, along with CDN and IP settings. Binary VPS backups are gone completely, but file-level backups of VPS survive. The company says file backups of the whole hosting and cloud estate are also intact, though it cannot yet give customers access to them. Every server must first be checked by hand for hidden vulnerabilities and malicious scripts.

What has been restored

Dedicated servers that customers administer themselves are back in service, and servers managed by Beget are being checked and returned gradually. Preliminary estimates suggest nearly 100% of sites on shared hosting can be recovered, but launching that service also requires careful checks. The mail service is 80% restored, with full operation expected within 10 hours.

DNS management is partly available. Customers can change A, MX and TXT records for domains in the .ru, .рф and .su zones through a separate page, domains.beget.ru, provided the domains are registered with Beget and use its DNS servers. International domains are still being worked on. Beget also says it has agreed with the Coordination Center for the Russian domain space that expiring domains in those zones will not be undelegated.

What customers should do

The company reports no attempts to download or modify user data on servers that held it, but advises changing all passwords, access keys and other credentials that may have been stored there. A limited control panel for some services is promised within 24 hours.

Beget has not given a recovery timeline, since more than 1,000 servers need manual inspection. It declined to disclose further details of the attack so as not to harm the investigation and the safe relaunch of its systems, and has declared force majeure.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:begetcyberattackhostingvpsdata losskubernetes

More from this day

See all →

More in: Security

See all →