Beget: attackers with management access wiped VPS, S3 and Kubernetes data and binary backups
Severity: high · Patch status: no-fix-needed · Since 2026-11-02
On the night of 1-2 November 2026, intruders gained access to the management layer of Beget, one of Russia's largest hosting and domain providers, and ran scripts that zeroed data. Beget's status page times the attack start at 02:00 MSK on 2 November, the malware launch at 02:30, detection at 02:40 and the disconnection of all servers from the network at 02:55. Beget says all data on its cloud platform is gone: VPS, S3 object storage and Kubernetes, along with CDN and IP settings. Binary VPS backups were destroyed. File-level backups of hosting and cloud were kept, but they are unreachable until each server is checked by hand, and more than 1,000 servers must be scanned for malicious code before restart. By 4 November Beget reported 35% of shared-hosting servers running again, 15% of its Beget-managed dedicated servers, and all dedicated servers without Beget administration back; it expects nearly all shared-hosting sites to be recoverable but gave no date for full recovery. Impact reached hundreds of thousands of .ru, .рф and .su sites (an October census figure of about 334,500 cited by CNews, not a Beget number), third-party services such as the Naryan-Mar city administration portal and the Chestny Znak information website (its operator said the labeling system itself kept running), and mainly small and medium businesses. Beget reports no evidence so far that anyone downloaded or changed user data on servers that held customer data, calls that preliminary, and tells customers to rotate passwords, keys and other credentials. The initial access vector is undisclosed, no group has claimed the attack, and Beget has invoked force majeure for part of its service obligations. The EU sanctioned Beget and a co-owner earlier in 2026 over services to Russian occupation authorities; this is context, not attribution.
What to do
- Rotate all passwords, API access keys and other credentials that may have been stored on Beget systems
- Restore data from file-level backups and verify integrity before bringing services back online
- Audit infrastructure management system access and rebuild affected VPS/Kubernetes environments from clean images
- Review contractual and force majeure implications with Beget; consider alternate hosting for critical services
- Monitor for follow-on attacks exploiting residual access or stolen credentials
Sources
All live incidents on Threat Watch
