Russian cloud hosting provider Beget is rebuilding its cloud infrastructure after attackers compromised its management systems and deployed data-wiping malware. The November 2 attack destroyed data across its virtual private servers, cloud storage, and Kubernetes services. It also wiped all binary backups of its VPS infrastructure, leaving thousands of customers facing possible data loss and prolonged service disruptions.

Russian cloud provider Beget is facing a major recovery challenge after a destructive cyberattack wiped data across its cloud infrastructure. The attackers gained access to the company’s infrastructure management systems and executed scripts designed to erase server data.

The attack affected several core services, including virtual private servers (VPS), S3 cloud storage, Kubernetes, and content delivery network (CDN) configurations. It also disrupted IP settings and other infrastructure components.

Beget detected the attack shortly after the malware began executing and disconnected its servers from the network to prevent further damage. However, the damage was already extensive. The company has since started rebuilding affected infrastructure and restoring services from surviving backups.

The incident has affected a major Russian hosting provider that serves more than 200,000 customers, including businesses, online stores, media organizations, and educational services.

Attackers Compromised Beget’s Infrastructure Management Systems

According to Beget’s incident report, the attack began at approximately 2:00 a.m. Moscow time on November 2, 2026. The attackers gained access to management servers that controlled the company’s infrastructure. They then launched data-wiping malware designed to erase information stored across the affected systems.

Beget’s timeline places the malware execution at approximately 2:30 a.m. The company detected unauthorized access around 2:40 a.m. and disconnected all servers from the network at approximately 2:55 a.m.

The attackers had reached a critical part of the company’s architecture. Access to the management layer gave them the ability to affect multiple services rather than compromise a single server or customer account.

This made the incident particularly damaging. Instead of dealing with an isolated server infection, Beget had to assess and rebuild large sections of its infrastructure.

The company has not disclosed how the attackers initially gained access. It has also not identified a threat group responsible for the incident.

Data-Wiping Malware Destroyed Cloud Infrastructure and Backups

The attack caused extensive damage to Beget’s cloud services. According to the company, attackers erased data associated with its virtual private servers, S3 storage, and Kubernetes infrastructure. CDN settings and IP configurations were also affected.

The loss of VPS backups has made recovery particularly difficult. Beget confirmed that all binary backups of its virtual servers were destroyed. Some file-level backups survived, but the company warned that these would only be available for approximately half of its VPS users.

Binary backups preserve a complete image of a virtual machine, including its operating system, applications, configurations, and stored data. They allow administrators to restore a server to an earlier state.

File-level backups preserve individual files and folders. While they can help recover websites, databases, and other stored information, they don’t necessarily provide everything needed to recreate an entire virtual server.

As a result, some customers may have to rebuild their servers, reinstall applications, restore configurations, and recover data from whatever backups remain available. Beget also explained that matching surviving backups to individual customer accounts is technically complex. This adds another layer of work to an already difficult recovery process.

Beget Inspects More Than 1,000 Servers Before Restoring Services

Beget has adopted a cautious approach to recovery. The company is treating its infrastructure as potentially compromised and is checking servers for hidden vulnerabilities and malicious scripts before bringing them back online.

According to its statements, approximately 1,000 servers require manual inspection.

Simply restarting the affected machines could expose the rebuilt infrastructure to another attack if malicious scripts or compromised components remain undetected. The company is therefore cleaning and rebuilding affected systems, reviewing configurations, and addressing potential weaknesses before restoring services.

The recovery process has taken several stages. Beget initially restored dedicated servers that customers managed themselves, along with its DNS and email services. It then began bringing shared hosting and company-managed dedicated servers back online.

By November 5, the company reported that it had restored 60% of its shared hosting infrastructure and 40% of its Beget-managed dedicated servers. On November 7, it launched a partially functional control panel to help customers manage available services.

By November 10, Beget had started restoring shared hosting websites from surviving backups. The company also made VPS file backups available for customers to download through its control panel. 

It reported that more than 18,000 websites had returned to service during the restoration process. However, restoring the remaining infrastructure will take time. The company must recreate server environments, restore databases and files, rebuild configurations, and reconnect customer services.

Beget Reports No Evidence of Customer Data Theft

Despite the extensive damage, Beget has not found evidence that attackers attempted to download or modify customer information stored on the affected servers. The company believes the attack focused on destroying data rather than stealing it.

However, this does not mean customers should assume their credentials remain safe. Beget has advised users to change passwords, access keys, and other credentials that may have been stored on affected servers. This recommendation is important for businesses that use cloud servers to store application credentials, database passwords, API keys, and administrative access details.

Even when an investigation finds no evidence of data theft, rotating credentials reduces the risk of unauthorized access if attackers obtained information that investigators haven’t identified.

Beget has notified law enforcement and government agencies. It is also working with cybersecurity companies to investigate the incident and support infrastructure recovery.

What the Beget Attack Reveals About Cloud Security

The Beget incident highlights a serious risk in cloud infrastructure: compromising the systems that manage servers can cause damage far beyond an individual machine.

Cloud providers use centralized management platforms to administer servers, storage, networks, and customer services. These systems make large-scale infrastructure management possible, but they also create attractive targets for attackers.

If threat actors gain privileged access to these platforms, they may be able to disrupt multiple services simultaneously. The incident also raises questions about backup security. Beget’s loss of VPS binary backups shows why businesses and service providers cannot assume that keeping backups within the same infrastructure offers sufficient protection.

A Long Recovery Ahead for Beget and Its Customers

Beget’s recovery efforts show how difficult it can be to restore a cloud platform after attackers compromise its central management systems. Although the company has brought several services back online, the loss of VPS binary backups creates a serious problem for affected customers. Some may recover their files from surviving copies, while others could face the difficult task of rebuilding their environments.

The incident is also a reminder that cloud hosting doesn’t eliminate the responsibility to maintain independent backups and disaster recovery plans. For businesses that depend on cloud providers, service availability and data recovery should be treated as separate security requirements. A provider may restore its infrastructure, but that doesn’t guarantee every customer can recover their applications and data. The Beget attack demonstrates how a single compromise at the infrastructure management level can disrupt thousands of customers and turn a routine service outage into a major data recovery operation. 

Sources: 

Product and Service Security in Beget | Vulnerability and Threat Detection

‘We are not giving up’: Russian hosting giant Beget has cloud platform wiped in major cyberattack | TechRadar