Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Breaches & attacks
LiveHighPartly patchedBreaches & attacks

Cyberattack wipes cloud data at Russian hosting provider Beget

Beget hosting (VPS, S3 cloud storage, Kubernetes, shared hosting)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Attackers gained access to the management servers of Beget, one of Russia's largest hosting providers and domain registrars, on the night of Nov 1 to 2 2026 and ran malware that deleted data. Beget says all data in its VPS, S3 cloud storage and Kubernetes services was lost, along with binary VPS backups and CDN and IP settings; file-level VPS backups survived. Hundreds of websites were disrupted, and more than 1,000 servers must be inspected by hand before coming back. Beget says it found no sign that customer data was downloaded or modified, but urges customers to change passwords, access keys and other credentials stored on its servers.

Why this severity: Destructive wipe of a major hosting provider's cloud platform; VPS, S3 and Kubernetes data lost and recovery ongoing

Started
Nov 2, 2026

Follow this incident

Discuss on X ↗

Affected

  • Beget VPS, S3 cloud storage and Kubernetes customers (data lost)
  • Beget shared hosting customers (sites being restored in stages)

Fixed in

  • Dedicated servers, NS servers, most mail and webmail restored; shared hosting sites coming back gradually as of Nov 4

Timeline3

  1. The first websites on restored shared hosting servers come back online. Beget says full recovery will take considerable time because more than 1,000 servers must be inspected manually.

  2. Beget says all data in its VPS, S3 and Kubernetes cloud was lost, along with CDN and IP settings, while file-level VPS backups were kept. It sees no attempts to download or modify customer data and tells customers to change passwords, access keys and other credentials.

  3. Around 02:00 Moscow time attackers reach Beget's management servers and at 02:30 launch malware that deletes data. Beget detects the breach at 02:40 and disconnects all servers from the network at 02:55.

Advisories1

News & write-ups3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo