Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and VM services for days
Severity: medium · Patch status: no-fix-needed · Since 2026-11-13
Belarusian cloud services provider ActiveCloud suffered a ransomware attack earlier this week in which hackers breached its systems and encrypted parts of its cloud infrastructure, disrupting corporate websites, email and virtual servers for customers in Belarus and Russia. Affected products include the E-Cloud hosting platform, E-Cloud Protected and SmartMail corporate email; customers including news outlet Smartpress and Domino's Pizza Belarus experienced outages. The company disclosed the attack Tuesday, restored key infrastructure by Wednesday and main services by Friday, though some customers still face issues restoring virtual machines. ActiveCloud found no evidence of customer data theft and has not identified the attackers or the access method. The incident follows ransomware and destructive attacks on Russian hosting providers ESTT and Beget this month, with no confirmed links.
What to do
- Verify integrity and availability of backups, including off-provider copies, before relying on provider restoration
- Assume prolonged service disruption is possible; activate fallback hosting, email and DNS for critical services
- Rotate credentials, API keys and VPN secrets associated with ActiveCloud-hosted systems
- Review provider incident updates and confirm whether your virtual machines require manual restoration
- Monitor for phishing or fraud attempts exploiting the outage and support channels
Sources
All live incidents on Threat Watch
