Beget rebuilds cloud after November 1 data-wiper attack

By Tom Whitfield

Beget restored 60% of its shared hosting and 40% of its dedicated servers after a November 1 data-wiper attack forced the Russian cloud provider to rebuild its infrastructure from scratch.

Recovery remained in progress more than a week later. The first task was not merely restarting capacity; it was establishing whether that capacity remained trustworthy.

The breach reached the management layer

On the night of November 1, the attacker gained access to management systems across Beget’s entire architecture and deployed malware that erased server data. In a November 3 announcement, Beget said the attacker had reached the management layer and executed data-zeroing scripts.

Beget detected the attack shortly after the malware activated. It disconnected all servers from the network to stop the malicious activity from spreading across the infrastructure.

Beget said all data in its cloud infrastructure was lost. The affected estate included:

• VPS data
• S3 data
• Kubernetes data
• CDN settings
• IP configurations

Virtual machines were not the only casualty. The compromise reached beyond a single hosted workload.

Recovery depends on manual checks

Roughly 1,000 servers require manual checks for vulnerabilities and hidden scripts before they can return online. Beget is treating every part of the infrastructure as potentially infected, rather than trusting systems that look unaffected.

“We are therefore cleaning out everything we can and reworking every potentially vulnerable point, including those that previously did not appear to pose a risk,” Beget said.

That inspection work sets conditions beyond a simple restart. A green status light is not yet evidence of a clean system. It is a slower path than ordinary maintenance, but the management-layer breach makes haste a poor business choice.

Backups provide only partial relief

Beget completely lost all VPS binary backups. Some file backups survived, but a November 6 assessment put their availability at roughly half of VPS users.

“Unfortunately, it is impossible to recover all data,” Beget said. The company spent a long time looking for solutions, but its current assessment showed that only half of users could receive file backups.

Even when a surviving backup exists, Beget must match it to the correct customer. The company describes that mapping process as technically complex and time-consuming. Restored capacity, therefore, does not guarantee restored data.

What does this change for Beget’s customers?

Beget is a major Russian web-hosting, cloud and domain-registration provider serving more than 200,000 customers. Its customers include online stores, media and educational services.

For them, the practical change is uneven access to working infrastructure, combined with permanent loss for data absent from surviving backups. The 60% shared-hosting and 40% dedicated-server restoration figures measure returned capacity, not every customer file. Service access can return before the customer’s data does.

The investigation points to destruction

Beget notified police and government agencies. It also works with cybersecurity firms to remediate the incident and support recovery as soon as possible.

The company’s investigation found no evidence that the attacker tried to download or modify data on compromised servers. Beget assesses that the attack focused solely on destruction.

That absence of evidence does not restore the deleted data. It does narrow the investigation’s apparent focus.

Beget has brought part of its operation back. Full customer-data recovery remains unfinished.