Big Russian cloud provider hacked and wiped

Russian hosting and cloud provider Beget is rebuilding its infrastructure after an attacker accessed management systems spanning its architecture and ran malware that erased server data. The intrusion occurred overnight on November 1. Beget detected the destructive activity soon after it began and disconnected its servers to limit further spread. The company serves more than 200,000 customers, including online retailers, media organizations, and educational services, making the outage a substantial disruption across its customer base.

The wipe destroyed data in Beget’s VPS, S3, and Kubernetes services, as well as CDN settings and IP configurations. VPS binary backups were lost; file backups survived only in part and are expected to be available to about half of VPS users. Even those backups must be matched to individual customers, a technically difficult process, and Beget warns that some data cannot be recovered. More than a week into restoration, the provider had recovered 60% of shared hosting and 40% of dedicated servers. About 1,000 servers require manual checks for vulnerabilities and concealed scripts, with the company treating its entire environment as potentially compromised. Beget reported no evidence that the attacker attempted to steal or alter data, suggesting the operation focused on destruction. It has contacted law enforcement and government agencies and is working with cybersecurity firms on recovery.