---
title: "Beget Confirms Destruction of Client Data in the Cloud Following Cyberattack: VPS, S3, and Kubernetes Affected"
description: "Beget has confirmed the destruction of some client data in the cloud following a cyberattack on the night of November 2: VPS, S3, and Kubernetes were affected, and binary VPS backups were lost. Recovery is proceeding from file copies, and the full timeline remains unknown."
date: 2026-11-04T02:02:08.992Z
lang: en
url: https://xab.info/en/posts/beget-data-loss-after-cyberattack
tags: [beget, cyberattack, cloud-infrastructure, data-loss, hosting, vps, kubernetes]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Beget Confirms Destruction of Client Data in the Cloud Following Cyberattack: VPS, S3, and Kubernetes Affected

![Interface of the Beget cloud platform and control panel with virtual server elements](https://xab.info/media/2026/11/04/beget-poterya-dannyh-posle-kiberataki/beget-poterya-dannyh-posle-kiberataki-1.webp)

## Key Points

- Beget confirmed a cyberattack on the night of November 2, 2026, and the destruction of VPS, S3, and Kubernetes data; binary VPS backups were lost, while file backups survived.
- Recovery is proceeding from file backups: by November 3, over 80% of the mail service was restored, nearly 100% of virtual hosting is recoverable, and over a thousand servers are being checked.
- Exact recovery timelines have not been announced; clients are advised to change passwords and access keys, and no attempts to download user data were detected.

Russian hosting provider Beget has officially confirmed the loss of data within its cloud infrastructure as a result of a massive cyberattack that occurred on the night of November 1-2, 2026. According to the company, attackers gained access to the infrastructure's management loop and launched scripts that led to the destruction of the contents of VPS virtual servers, S3 object storage, and Kubernetes clusters. The provider specified that binary backups of VPS were also lost, while file-based backups remained intact. Large-scale service disruptions became noticeable as early as the morning of November 2, affecting numerous Russian websites and internet services hosted on the platform.

### Attack Mechanism and Investigation Progress

Beget representatives reported that the attackers penetrated the infrastructure management loop and used it to run destructive data deletion scripts. The company has not disclosed the specific method of initial intrusion; according to the provider, the investigation into the incident is ongoing. During the initial reports of the failure, Beget described the situation as a "complex incident affecting all levels of architecture" without specifying the causes; it was only later that the company publicly confirmed the cyberattack nature and the fact that some data was destroyed. Separately, the provider noted that CDN settings and IP addresses were also lost during the incident.

### Infrastructure Recovery: What Has Been Restored So Far

According to the provider's estimate, recovering virtual server data is possible from surviving file backups, though clients do not yet have access to them. Specialists emphasize that putting servers back into operation without prior verification is unsafe: the infrastructure must be restored, and machines must be checked for hidden vulnerabilities and malware. Engineers will have to manually inspect more than a thousand servers. Dedicated servers without administration by Beget were successfully brought back online as early as November 2 at around 2:00 PM Moscow time; on machines managed by the provider's specialists, most of the information was also preserved, and they are being progressively checked and launched.

### Virtual Hosting and Mail Services

The situation with virtual hosting proved less severe: according to the provider's preliminary estimates, nearly 100% of the websites hosted on it can be recovered, as the hosting file backups survived. By November 3, the company restored over 80% of the mail service infrastructure, including the availability of POP3, IMAP, and SMTP protocols, and resumed the operation of the webmail interface and DNS servers. A separate service has been launched for domain management, allowing users to modify A, MX, and TXT records; however, full access to the main control panel at the time of publication has not yet been restored.

### Recommendations for Clients and Full Recovery Timeline

Beget claims that no attempts to download or modify user information were detected on servers containing user data. Nevertheless, clients are advised to change passwords, access keys, and other credentials that may have been stored on the affected machines. The company has not provided exact timelines for the full recovery of all services: work on checking and launching more than a thousand servers continues. Some industry sources describe the incident with an emphasis on backbone channel failures and a backup route malfunction due to a configuration error, whereas the provider itself and several publications record a confirmed cyberattack with data destruction; both versions agree that a massive disruption occurred on November 2 affecting websites, mail, and VPS, and that recovery is proceeding in stages.

## Accounts differ

### Root cause of the November 2 incident

- **Beget (according to 3dnews.ru):** The company confirmed a cyberattack: attackers gained access to the management loop and ran data deletion scripts, destroying VPS, S3, and Kubernetes. ([3dnews.ru](https://3dnews.ru/1150814/hostingprovayder-beget-podtverdil-poteryu-dannih-klientov-posle-ataki))
- **Beget (according to sib.fm):** The provider confirmed that the attack disrupted multiple areas, while the technical mechanism of the incident was not disclosed. ([sib.fm](https://sib.fm/news/2026/11/03/kiberataka-na-beget-provajder-vosstanavlivaet-servisy-i-otsenivaet-vozmozhnuyu-poteryu-dannyh))
- **cisoclub.ru:** The incident was described as a failure of two backbone channels where the backup route failed to work due to a configuration error. ([cisoclub.ru](https://cisoclub.ru/problemy-u-beget-masshtabnyj-sboj-otkaz-dvuh-magistralnyh-kanalov-i-neizvestnye-sroki-vosstanovlenija/))

*Where they agree:* On November 2, 2026, a massive disruption occurred affecting websites, mail, and VPS of Beget clients, and service recovery is proceeding in stages.

## Fact-Check & Sources

- [Хостинг-провайдер Beget подтвердил потерю данных клиентов после атаки window-new](https://3dnews.ru/1150814/hostingprovayder-beget-podtverdil-poteryu-dannih-klientov-posle-ataki) - Primary source: Beget's confirmation of the cyberattack, destruction of VPS/S3/Kubernetes, loss of binary VPS backups, recovery from file copies, >80% of mail by November 3, >1000 servers under review.
- [Кибератака на Beget: провайдер восстанавливает сервисы и оценивает возможную потерю данных](https://sib.fm/news/2026/11/03/kiberataka-na-beget-provajder-vosstanavlivaet-servisy-i-otsenivaet-vozmozhnuyu-poteryu-dannyh) - Confirms cyberattack on the night of November 2, restoration of unmanaged dedicated servers, priority of NS servers, availability of file backups.
- [Проблемы у Beget: масштабный сбой, отказ двух магистральных каналов и неизвестные сроки ...](https://cisoclub.ru/problemy-u-beget-masshtabnyj-sboj-otkaz-dvuh-magistralnyh-kanalov-i-neizvestnye-sroki-vosstanovlenija/) - Alternative cause description: failure of two backbone channels and backup route malfunction due to configuration error; notes restoration of websites, mail, and VPS.
- [Сбой Beget 2 ноября 2026 года: почему не открываются сайты и как защитить бизнес](https://vc.ru/services/3230798-sboy-beget-prichiny-nedostupnosti-saytov-i-zashita-biznesa) - Describes website unavailability, DNS and mail issues, infrastructure restoration; business context.

## FAQ

### When did the cyberattack on Beget occur?

The attack occurred on the night of November 1-2, 2026, and massive service disruptions became noticeable on the morning of November 2.

### What data was lost?

According to Beget, the contents of VPS virtual servers, S3 object storage, and Kubernetes clusters were destroyed, along with binary VPS backups; file backups survived, while CDN settings and IP addresses were lost.

### When will the infrastructure be fully restored?

The company has not provided exact timelines for full recovery: engineers are manually checking over a thousand servers. By November 3, over 80% of the mail service was restored, and nearly 100% of virtual hosting is recoverable from file copies.