Attackers wipe Beget cloud infrastructure in destructive breach of Russian host

On 2 November 2026, Beget — one of the largest hosting providers in the Russian-language internet, or Runet — confirmed that it had been hit by a large-scale cyberattack. According to the company, intruders reached the management layer of its hosting infrastructure overnight and ran destructive scripts that wiped data, knocking customer sites, mail and DNS offline. Beget described it as the first such incident in its roughly 19-year history and said it could not fully disclose details "for security reasons."

In an update on 3 November, Beget said that data in its cloud infrastructure — including VPS, S3 object storage and Kubernetes clusters — had been lost, that binary VPS disk-image backups were completely destroyed, and that CDN and IP configuration had also been wiped. File-level VPS backups survived, but reaching them depended on first rebuilding the underlying infrastructure. The company assessed that almost all sites on shared hosting could be recovered.

Response and scope

Beget said more than 1,000 servers had to be checked by hand for hidden weaknesses and malicious scripts left behind by the attackers. It restored customer-run dedicated servers, brought roughly 80 percent of its mail infrastructure back online, and worked with the Coordination Center for the .ru, .рф and .su domain zones so that affected domains would keep resolving. The company urged customers to change all passwords and access keys. Beget said its preliminary evidence showed no attempts to download or alter data on servers holding user information, while cautioning that this was not an independent guarantee against exposure.

Why it matters

The attack was destructive rather than extortive: no ransom demand, ransomware branding or named threat actor had surfaced, and the apparent goal was to erase data rather than to lock it for payment. Wiping a provider's management layer cascades across every tenant at once, and the loss of binary VPS backups shows how a single point of control can turn a hosting platform's redundancy into a shared failure. Russian outlets reported that major services relying on Beget-hosted infrastructure were disrupted during the outage.