Short answer
Beget, one of Russia's largest hosting and domain providers, said attackers gained access to the systems that manage its infrastructure overnight on 1 to 2 November 2026 and ran scripts that erased data. Cloud data and binary VPS backups were lost, while file-level backups survived.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Beget |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Web hosting and cloud infrastructure |
| Country | Russia |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-02 |
| People or records affected | Cloud customers (VPS, S3, Kubernetes) and many hosted sites were disrupted. Beget has not published a customer count |
What data was exposed
- No confirmed theft. Beget says it found no evidence that attackers tried to download or change data on servers holding customer data
- Destroyed rather than stolen: VPS, S3 and Kubernetes cloud data, binary VPS backups, CDN and IP settings
- Credentials stored on affected servers are treated as at risk, and customers are told to change them
What happened
Beget, a Russian web hosting and domain company, said on 2 November 2026 that a cyberattack was behind a large overnight outage. The Record reported on 4 November that the attack destroyed data across its cloud infrastructure and disrupted hundreds of websites. Beget ranked second among registrars of .RU domains as of October, with about 540,700 domains cited by Kommersant.
According to Beget, the attackers gained access to the systems used to manage its infrastructure and ran scripts designed to erase data. The company said it cannot disclose how they got in, and no group has claimed the attack.
What was lost
Beget’s detailed statement on 3 November, as reported by Security Lab and Gridinsoft, says data in its VPS, S3 and Kubernetes cloud services was lost. It also lost all binary backups of its virtual servers, plus CDN and IP settings. File-level VPS backups survived, though they depend on restoring and checking the infrastructure.
Shared hosting looks better. Beget’s preliminary view is that nearly all shared hosting sites can be recovered. Dedicated servers that customers manage themselves came back first. More than 1,000 servers must be checked by hand for malicious files, so Beget gave no firm date for full restoration.
Customer data
Beget says it has found no evidence that data on customer servers was downloaded or modified. That is the company’s early finding. Because attackers held administrative access, it advises customers to change passwords, access keys and other credentials that may have been stored on the servers.
Who was affected
The outage reached small and medium businesses that run online stores and company sites on Beget, according to Kommersant as cited by The Record. Local media also reported disruption to a city administration site, a research institute’s space weather site, and services including the Chestny Znak product-labeling system and BelkaCar. Beget told customers the attack could count as force majeure under Russian law.
The Record notes the EU sanctioned Beget earlier this year over services to authorities in occupied Ukrainian territories and defense-related entities. That is context from The Record and says nothing about who attacked the company.
What customers should do
Rotate credentials, keep independent backups, and verify any DNS change before applying it. After a public outage like this, scammers often offer paid “recovery.” Use only Beget’s known support channels.
For general steps, see our data breach checklist and the guide to phishing messages. A comparable hosting incident is DreamHost’s file manager breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'recovery' messages offering to restore a lost site or server in exchange for payment, backups or credentials.
- Phishing pages imitating the Beget control panel or support, asking you to log in or reset keys.
- DNS or domain change requests that look like Beget instructions but point your records somewhere else.
What to do if you are affected
- 01Change passwords, access keys and any other credentials that were stored on Beget servers, and revoke the old values.
- 02Ask Beget support through its known channels what recovery material exists for your account.
- 03Keep local deployment files and independent backups, since binary VPS backups were lost.
- 04Check where a DNS change points before making it, and keep a copy of your previous records.
- 05Treat unsolicited recovery offers and requests for backups or secrets as suspect.
Frequently asked questions
Was customer data stolen from Beget?
Beget says it has found no evidence that attackers tried to download or modify data on servers that hold customer data. Gridinsoft described that as a preliminary finding, not independent assurance. Beget still tells customers to change credentials stored on affected systems.
What was lost?
Beget says cloud data in its VPS, S3 and Kubernetes services was wiped, along with binary VPS backups and CDN and IP settings. VPS file backups survived, and Beget expects almost all shared hosting sites to be recoverable.
How did the attackers get in?
Beget says they reached the management layer of its infrastructure and ran destructive scripts. It has not disclosed the entry point, citing security and the ongoing investigation, and no group has claimed responsibility.
Is this ransomware?
No ransom demand has been reported. Reporting describes a data-wiping attack, and no group has claimed it.
Sources
- Cyberattack wipes cloud data at major Russian hosting provider Beget, The Record, 2026-11-04
- Хакеры стерли данные облачных клиентов одного из крупнейших хостингов Рунета Beget, The Moscow Times (Russian service), 2026-11-03
- Бэкапы утеряны. Смиритесь: Beget подтвердил потерю резервных копий VPS, Security Lab, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.