Russian hosting provider Beget has officially confirmed the loss of data within its cloud infrastructure as a result of a massive cyberattack that occurred on the night of November 1-2, 2026. According to the company, attackers gained access to the infrastructure's management loop and launched scripts that led to the destruction of the contents of VPS virtual servers, S3 object storage, and Kubernetes clusters. The provider specified that binary backups of VPS were also lost, while file-based backups remained intact. Large-scale service disruptions became noticeable as early as the morning of November 2, affecting numerous Russian websites and internet services hosted on the platform.
Attack Mechanism and Investigation Progress
Beget representatives reported that the attackers penetrated the infrastructure management loop and used it to run destructive data deletion scripts. The company has not disclosed the specific method of initial intrusion; according to the provider, the investigation into the incident is ongoing. During the initial reports of the failure, Beget described the situation as a "complex incident affecting all levels of architecture" without specifying the causes; it was only later that the company publicly confirmed the cyberattack nature and the fact that some data was destroyed. Separately, the provider noted that CDN settings and IP addresses were also lost during the incident.
Infrastructure Recovery: What Has Been Restored So Far
According to the provider's estimate, recovering virtual server data is possible from surviving file backups, though clients do not yet have access to them. Specialists emphasize that putting servers back into operation without prior verification is unsafe: the infrastructure must be restored, and machines must be checked for hidden vulnerabilities and malware. Engineers will have to manually inspect more than a thousand servers. Dedicated servers without administration by Beget were successfully brought back online as early as November 2 at around 2:00 PM Moscow time; on machines managed by the provider's specialists, most of the information was also preserved, and they are being progressively checked and launched.
Virtual Hosting and Mail Services
The situation with virtual hosting proved less severe: according to the provider's preliminary estimates, nearly 100% of the websites hosted on it can be recovered, as the hosting file backups survived. By November 3, the company restored over 80% of the mail service infrastructure, including the availability of POP3, IMAP, and SMTP protocols, and resumed the operation of the webmail interface and DNS servers. A separate service has been launched for domain management, allowing users to modify A, MX, and TXT records; however, full access to the main control panel at the time of publication has not yet been restored.
Recommendations for Clients and Full Recovery Timeline
Beget claims that no attempts to download or modify user information were detected on servers containing user data. Nevertheless, clients are advised to change passwords, access keys, and other credentials that may have been stored on the affected machines. The company has not provided exact timelines for the full recovery of all services: work on checking and launching more than a thousand servers continues. Some industry sources describe the incident with an emphasis on backbone channel failures and a backup route malfunction due to a configuration error, whereas the provider itself and several publications record a confirmed cyberattack with data destruction; both versions agree that a massive disruption occurred on November 2 affecting websites, mail, and VPS, and that recovery is proceeding in stages.
