Cyberattack wipes Beget cloud data; some sites back online
A destructive cyberattack wiped data from VPS, cloud storage and Kubernetes services at Beget, one of Russia's largest hosting providers, and disrupted hundreds of websites. The company lost all binary backups of its virtual servers, but file-level backups remain; more than 1,000 servers require manual inspection and some sites were back online by Wednesday. Beget urged customers to change passwords, access keys and other credentials stored on affected systems.
What happened
A cyberattack wiped data across Beget's cloud infrastructure, one of Russia's largest web hosting providers, and disrupted hundreds of websites. The company said attackers gained access to infrastructure management systems and ran scripts designed to erase data. Some sites are back online, but full restoration will take considerable time.
Why it matters
The outage hit websites of businesses, government agencies and research institutions across Russia; Kommersant reports most victims are small and medium businesses running online stores. VPS, cloud storage and Kubernetes data was wiped, and Beget lost all binary backups of its virtual servers. Beget says it found no evidence of data theft or modification, but notified customers of force majeure and may miss contractual obligations.
What to do
Change passwords, access keys and other credentials stored on affected systems, as Beget urged. Verify that your own backups, held outside Beget, are intact and tested. Follow the company's official restoration updates.
For the technical team
- Affected
- Beget, grande provedor russo de hospedagem web; infraestrutura de nuvem atingida por ciberataque destrutivo · Beget's cloud infrastructure: VPS, cloud storage and Kubernetes data wiped; all binary backups of virtual servers lost. Shared hosting disrupted (nearly all websites likely recoverable, per the company); customer-managed dedicated servers already restored.
- Exploitation
- Executed destructive attack; no specific software vulnerability cited. No hacking group has publicly claimed responsibility, per Beget and The Record. Beget says it found no evidence that attackers attempted to download or modify information on servers holding customer data.
- Fix
- No software fix. Ongoing mitigation: manual inspection of more than 1,000 servers, removal of malicious files, data integrity checks and recovery from file-level backups, which remain intact.
- Vector
- Access to systems used to manage Beget's infrastructure; attackers executed scripts designed to erase data. The company has not disclosed how initial access was obtained, citing security concerns and an ongoing investigation.
- More details
- Attack took place overnight Sunday; by Wednesday some websites were back online while engineers removed malicious files. Affected services include the Naryan-Mar city administration website, Russia's Chestny Znak product labeling system and the Russian Academy of Sciences' Laboratory of Solar Astronomy site. Kommersant: Beget, founded in 2007, ranked second among .RU registrars as of October, managing about 540,700 domains (14.7% of the market). Beget notified customers the attack may constitute force majeure under Russian law. Context: the EU sanctioned Beget and one co-owner this year over digital infrastructure services to Russian occupation authorities in Ukraine and cooperation with Russian defense enterprises.
Timeline
The Record reports a destructive attack that wiped cloud data and disrupted hundreds of sites hosted at Beget.
