Beget cyberattack erases cloud data; VPS binary backups gone

Beget, one of Russia's largest hosting providers and .RU domain registrars, was hit by a destructive cyberattack that erased data across its cloud infrastructure. The company says attackers reached the systems used to manage its infrastructure and ran scripts designed to delete data. The incident is reported by Recorded Future News and confirmed by Beget's own statements carried in Russian outlets including RBC and Vedomosti.

What happened

Beget says the attack occurred overnight on November 1–2. Attackers obtained access to its infrastructure-management plane and executed deletion scripts. The company has not disclosed the initial-access method, citing an ongoing investigation.

What was lost

• Data tied to VPS, cloud (S3-style) storage, and Kubernetes services was wiped, along with CDN settings and assigned IP addresses.
• All binary backups of virtual servers are gone. File-level backups survived, and Beget is using them to recover what it can.
• Beget says it found no evidence that attackers tried to download or modify customer data, but is urging customers to change passwords, access keys, and other credentials regardless.

Recovery will be slow: Beget says more than 1,000 servers must be inspected manually before being returned to service. It expects nearly all shared-hosting sites to be recoverable, and most customer-managed dedicated servers survived. Named casualties include the Naryan-Mar city administration website and parts of Russia's Chestny Znak product-labeling system; the Russian Academy of Sciences' Laboratory of Solar Astronomy reported an outage tied to its registrar.

Attribution

No group has claimed responsibility, and neither Beget nor the reporting names a suspect. Beget has told customers the event may qualify as force majeure under Russian law. Treat any attribution circulating before a claim or technical evidence as speculation.

What to do if you host with Beget — or any single provider

1. Rotate everything. Change passwords, API tokens, and access keys for any Beget-hosted service, per the provider's own guidance.
2. Restore from your own backups, not the provider's. The binary VPS backups are gone; assume provider-side recovery is partial and slow, and rebuild from backups you control.
3. Pull offline/immutable copies now for any workload still running at a single provider — a wiper in the management plane destroys online backups along with production.
4. Segment the management plane. The reusable lesson here is that one foothold in infrastructure-management systems let an attacker reach both production and its backups; separate credentials, networks, and backup targets so one does not reach the other.

Context

This follows a string of destructive attacks on Russian IT providers, including an October breach of FirstVDS. It also lands against a specific backdrop: the EU sanctioned Beget and one of its co-owners earlier in 2026 over services provided to occupation authorities in Ukraine, per Recorded Future. The through-line for everyone else is operational, not geopolitical — a destructive wipe that reaches online backups is survivable only for customers who kept copies the provider couldn't touch.