Beget (Russia): hosting provider's cloud data wiped after attackers reach its management layer

How it happened

Beget says the attackers got into the management layer of its infrastructure and ran scripts that wiped data. It has not said how they first got in, who they are, or which weakness was used.[1][2][3] Checked 8 Nov 2026

What was stolen

The attack destroyed data and no theft is reported. Beget says that on servers holding user data there were no attempts to download or change the data, and advises clients to change passwords, access keys and other credentials stored on its servers. No ransom demand has been reported.[1][2][3] Checked 8 Nov 2026

Who was impacted

Data for VPS, S3 and Kubernetes was lost, with CDN and IP settings, and all binary backups of virtual servers. File backups survived, so nearly all shared-hosting sites can likely be recovered, and about half of VPS users are expected to get file backups. More than 1,000 servers need manual checks. Reported affected sites include the Naryan-Mar city administration and Russia's Chestny Znak labeling system. Beget declared force majeure. The number of clients hit is not published; one outlet cites the company's own figure of over 200,000 clients overall.[1][2][3][4][5] Checked 8 Nov 2026

Threat actor

Not attributed

Timeline

1. 2 Nov 2026Beget reports a major incident across all architecture levels, then links it to an external attack and sends clients a force majeure notice. No group has claimed it. [4][1]
2. 3 Nov 2026Beget says attackers reached the management layer and ran destructive scripts. VPS, S3 and Kubernetes data and all binary VPS backups are lost; file backups survived. [2][3]
3. 4 Nov 2026The Record reports that restoring services requires manual inspection of more than 1,000 servers. [1]
4. 6 Nov 2026Beget says file backups are expected for about half of VPS users and that more than 60% of shared hosting is back online. [3]