Wiper attack destroys cloud data at Russian hosting provider Beget, including server backups
November 1, 2026 (Night of November 1, 2026)
Beget, one of Russia's largest hosting companies and domain registrars with more than 200,000 customers, was attacked on the night of November 1. The company says the attacker reached the management systems of its whole infrastructure and ran scripts that erased data on its servers. Data in its cloud services, including virtual private servers (VPS), S3 storage and Kubernetes, was lost, along with content delivery and IP settings. All binary backups of the virtual servers were destroyed, and file-level backups survived for only about half of VPS users. Beget disconnected all servers once it detected the attack. More than a week later, about 60% of shared hosting and 40% of the dedicated servers it manages were back, and roughly 1,000 servers still had to be checked by hand before going online. Beget says it found no sign that data was downloaded or changed, that the attack aimed only at destruction, and that it is impossible to recover all data. It has told police and government agencies. No one has been named or has claimed the attack.
Why it matters
When the provider's own management layer is taken over, the backups it keeps can be destroyed together with the servers. Customers who had no copy of their own lost data for good.
What defenders can take from it
- Keep your own copies of website and server data outside the hosting provider, and test restoring them.
- Beget customers: change passwords, access keys and other secrets that were stored on its servers.
- Providers: keep backup systems and their credentials separate from the production management layer, and make backups that cannot be deleted from it.