Threat watch / Attack
ActiveCloud (Belarus): ransomware encrypts part of a cloud provider's infrastructure
ActiveCloud, a cloud provider serving businesses in Belarus and Russia, says a ransomware attack starting at 03:30 on November 10, 2026 encrypted part of its cloud infrastructure. Its E-Cloud and E-Cloud Protected hosting, SmartMail and SelfMail email, websites, support and telephony went down for days. The company says it found no leak of customer data. Main services were back by late November 12; some virtual machines may not boot because their disk boot area was damaged.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- ActiveCloud E-Cloud, ActiveCloud SmartMail
- How it happened
- ActiveCloud says its infrastructure "was subjected to a ransomware-type attack" that encrypted part of its cloud infrastructure. It has not identified the attackers or explained how they got in, The Record reports.[1][2] Checked 14 Nov 2026
- What was stolen
- The company says its checks "confirmed that no client data leak occurred".[1][2] Checked 14 Nov 2026
- Who was impacted
- Customers of E-Cloud and E-Cloud Protected hosting (Belarus) and SmartMail email (Belarus and Russia) lost access for several days, along with corporate email and support channels. Customers could not restore from backups themselves at first, and some virtual machines may not boot after recovery. The Record names the news outlet Smartpress among those hit. The number of customers is not public.[1][2] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- ActiveCloud says its infrastructure has been under a massive cyberattack since 03:30. That evening it calls it a ransomware attack that encrypted part of its cloud infrastructure, and says no client data leaked. [1]
- The E-Cloud cluster is restored from backup. The company warns that some virtual machines may not boot because the boot area of their disk was damaged. [1]
- ActiveCloud says E-Cloud, E-Cloud Protected, SmartMail and SelfMail are working again; customer accounts and support tools are still being restored. [1]
- The Record reports the attack, noting that Russian hosting provider ESTT was hit by ransomware on November 8 and Beget days earlier, with no public evidence linking the attacks. [2]