- Russian hosting provider Beget was subject to a cyberattack on November 1st, 2026
- While 1000s of websites were hit, cloud storage, VPS hosting, and Kubernetes servers were wiped
- The attack came amidst a spate of drone and online attacks targeting Russian tech companies, presumably by Ukraine-based attackers or anti-Putin elements within Russia
A “massive cyberattack” took Russian web hosting company Beget’s entire operation offline, with abnormal activity recorded immediately ahead of the incident. All levels of its infrastructure were affected, with websites, cloud storage facilities, VPS hosting, and even hosting for Kubernetes containers knocked offline.
The impact of the attack took several days for the company’s experts to assess, with estimates that over 1,000 servers need to be physically checked. This indicates either lasting damage from the attack or infrastructure that was already weakened, perhaps by unpatched exploits.
Beget has been the subject of EU sanctions due to it providing hosting services to authorities in the Russian-occupied Ukraine regions of Crimea, Donetsk, and Luhansk.
Recovering data
Responding to news of the attack, Beget issued a defiant statement, boldly stating “We are not giving up and are continuing to look for ways to recover this data.”
“Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected.”
The organization told Kommersant (translated from Russian) that most data should be recoverable from backups for the majority of its virtual hosting and cloud infrastructure, adding “We continue to work on data recovery, but due to significant volumes, this process will require a long time.”
However, Beget’s response to the attack is hampered by how it organizes and prioritises data, with many customers not using disaster recovery plans.
Anatoly Sazonov, Head of the Department of Compliance with the requirements of the Softline Group of Companies, told Kommersant, “Beget’s mass failure is an example of a systemic risk that arises from a high business dependency on a single provider. If a website, corporate mail, databases and other services are posted on one site, the provider’s problems can paralyze several areas of business work at once.”
EU sanctions
Beget was founded in 2007 and has become the second largest domain registrar in Russia for .ru domains, overseeing 14.7% of the market alongside providing web hosting, cloud computing, and other services.
As is standard, Beget has encouraged customers to change their passwords and remove and update and access keys, credentials, or other sensitive information that may have been uploaded to its cloud servers.
Beget has already had a difficult year, having been targeted by EU sanctions for providing hosting services in Russian-occupied territories in Ukraine. Whether the domain registrar and web hosting company was targeted because of this, or as a more general piece of cybercrime, remains to be seen.
