Hackers destroyed Beget's cloud infrastructure: customer data is lost, and it will no longer be possible to recover everything
One of Russia's largest hosting providers, Beget, has suffered a large-scale cyberattack whose consequences turned out to be significantly more serious than initial forecasts. The attackers gained access to the infrastructure management system and launched data destruction scripts. The company has admitted that it will not be able to restore all clients' information. Websites, virtual servers, databases and cloud storage were put at risk.
The Russian internet has faced one of the most serious hosting incidents in recent times. On the night of November 1-2, 2026, Beget's infrastructure came under a massive cyberattack. Initially, users encountered the unavailability of websites, servers, email, and the control panel. However, as the investigation progressed, details began to emerge indicating far more extensive destruction.
How did the hackers gain access to Beget's infrastructure?
According to the company's official statement, the attackers were able to penetrate the management contour of the provider's entire architecture.
After gaining access, the attackers launched special scripts designed to wipe data on the servers.
According to the timeline published by Beget, the attack began at around 02:00 Moscow time on November 2. About half an hour later, the malicious software was launched. Soon the company detected the unauthorized access and began disconnecting servers from the network in an attempt to stop the spread of the attack.
The consequences proved critical: several key components of the cloud infrastructure were hit at once.
What data was destroyed?
The most serious consequences affected three areas:
- VPS — virtual servers on which clients host websites, applications, and corporate systems.
- S3 — cloud storage for files, documents, backups, and other data.
- Kubernetes — infrastructure for managing containerized applications.
In addition, CDN settings and the IP addresses of the cloud infrastructure were lost.
A particularly alarming situation arose with backups. Initially, Beget reported that file backups were intact, but it later turned out that it would not be possible to restore data for all VPS users.
As of November 6, the company estimated the availability of file backups at approximately half of its clients.
Beget admitted: not everything can be restored
On November 6, the provider published a new statement in which it effectively confirmed the scale of the disaster.
The company's cloud infrastructure has to be rebuilt from scratch. It is impossible to restore all data of virtual server users.
At the same time, standard virtual hosting operations are gradually returning. According to the company, more than 60% of its capacity has already been restored.
The situation with VPS is significantly more complicated: even the availability of file backups does not guarantee a quick recovery. Specialists need to identify users, match information, and verify data integrity.
It also emerged that some of Beget's internal data was lost. In particular, for some users, the current links between accounts and purchased services were disrupted.
The company planned to connect the first servers of the new cloud infrastructure within one to two days after publishing the update.
Not only websites but also businesses were affected
The incident affected far more than just individual internet resources.
Beget serves hundreds of thousands of websites and a large number of corporate clients. Disruptions in the provider's infrastructure affected the operation of third-party internet services.
In particular, problems arose for the BelkaCar carsharing service, which had to use alternative infrastructure to restore operations.
For businesses, such incidents can result not only in temporary website unavailability but also in direct financial losses.
Online stores risk losing orders, companies risk losing access to work systems, and project owners risk losing databases and the results of years of work.
What should Beget clients do right now?
In light of what happened, users are advised not to wait for the full restoration of the infrastructure but to independently check the security of their projects.
Key recommendations:
- Change passwords for accounts and administrative panels.
- Update API keys, SSH keys, and other access credentials.
- Check backups stored outside Beget's infrastructure.
- Verify the integrity of databases and website files.
- If necessary, prepare to migrate projects to an alternative platform.
- Check access logs and account activity.
Backups deserve special attention. Storing backups on the same infrastructure where the main project is hosted does not provide full protection against a large-scale attack.
Why should this attack serve as a lesson for the entire Russian IT market?
The Beget story clearly demonstrates how vulnerable even a large technology infrastructure can be if attackers gain access to centralized management.
Modern companies are increasingly moving critical processes to the cloud, relying on the reliability of professional providers. But the very fact of placing data in the cloud does not mean it is protected from destruction.
Particularly dangerous is a scenario in which an attacker gains privileged access not to an individual server but to the management system of the entire infrastructure.
In such a situation, thousands of projects are simultaneously at risk.
The main takeaway from the Beget story: backups must exist separately from the main infrastructure, have independent access mechanisms, and be regularly tested for recoverability.
The cyberattack on Beget has already led to large-scale losses. Now the company faces the task of not merely restoring servers but effectively rebuilding a significant part of its cloud infrastructure and regaining its clients' trust.
