# Cyberattack wipes cloud data at Russian hosting provider Beget · pwn.watch > Attackers gained access to the management servers of Beget, one of Russia's largest hosting providers and domain registrars, on the night of Nov 1 to 2 2026 and ran malware that deleted data. Beget says all data in its VPS, S3 cloud storage and Kubernetes services was lost, along with binary VPS backups and CDN and IP settings; file-level VPS backups survived. Hundreds of websites were disrupted, and more than 1,000 servers must be inspected by hand before coming back. Beget says it found no sign that customer data was downloaded or modified, but urges customers to change passwords, access keys and other credentials stored on its servers. Page: https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026 · generated 2026-11-04T16:04:33.122Z ## Status - Severity: high · status: live · patch: partial - Product: Beget hosting (VPS, S3 cloud storage, Kubernetes, shared hosting) - Started: 2026-11-02 - Affected: Beget VPS, S3 cloud storage and Kubernetes customers (data lost); Beget shared hosting customers (sites being restored in stages) - Fixed in: Dedicated servers, NS servers, most mail and webmail restored; shared hosting sites coming back gradually as of Nov 4 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026.json - This file: https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: The first websites on restored shared hosting servers come back online. Beget says full recovery will take considerable time because more than 1,000 servers must be inspected manually. (https://therecord.media/russia-cyberattack-beget-cloud) - 2026-11-03: Beget says all data in its VPS, S3 and Kubernetes cloud was lost, along with CDN and IP settings, while file-level VPS backups were kept. It sees no attempts to download or modify customer data and tells customers to change passwords, access keys and other credentials. (https://ria.ru/20261103/beget-2128982225.html) - 2026-11-02: Around 02:00 Moscow time attackers reach Beget's management servers and at 02:30 launch malware that deletes data. Beget detects the breach at 02:40 and disconnects all servers from the network at 02:55. (https://beget.com/en/about) ## Fix brief # Security brief: Cyberattack wipes cloud data at Russian hosting provider Beget Source: https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 14:24 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Attackers gained access to the management servers of Beget, one of Russia's largest hosting providers and domain registrars, on the night of Nov 1 to 2 2026 and ran malware that deleted data. Beget says all data in its VPS, S3 cloud storage and Kubernetes services was lost, along with binary VPS backups and CDN and IP settings; file-level VPS backups survived. Hundreds of websites were disrupted, and more than 1,000 servers must be inspected by hand before coming back. Beget says it found no sign that customer data was downloaded or modified, but urges customers to change passwords, access keys and other credentials stored on its servers. Severity detail: Destructive wipe of a major hosting provider's cloud platform; VPS, S3 and Kubernetes data lost and recovery ongoing - Product: Beget hosting (VPS, S3 cloud storage, Kubernetes, shared hosting) ## Affected versions - Beget VPS, S3 cloud storage and Kubernetes customers (data lost) - Beget shared hosting customers (sites being restored in stages) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Dedicated servers, NS servers, most mail and webmail restored; shared hosting sites coming back gradually as of Nov 4 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Beget customers: rotate any passwords, API keys, SSH keys and other credentials that were stored on Beget servers, and restore from your own off-provider backups where you can; VPS, S3 and Kubernetes data on Beget's cloud was lost. ## Latest updates - Nov 4, 2026: The first websites on restored shared hosting servers come back online. Beget says full recovery will take considerable time because more than 1,000 servers must be inspected manually. - Nov 3, 2026: Beget says all data in its VPS, S3 and Kubernetes cloud was lost, along with CDN and IP settings, while file-level VPS backups were kept. It sees no attempts to download or modify customer data and tells customers to change passwords, access keys and other credentials. - Nov 2, 2026: Around 02:00 Moscow time attackers reach Beget's management servers and at 02:30 launch malware that deletes data. Beget detects the breach at 02:40 and disconnects all servers from the network at 02:55. ## Advisories - [Recovery in progress (Beget incident timeline)](https://beget.com/en/about) (Beget) ## Write-ups & news - [Cyberattack wipes cloud data at major Russian hosting provider Beget](https://therecord.media/russia-cyberattack-beget-cloud) - [Провайдер Beget сообщил об утрате данных после кибератаки](https://www.vedomosti.ru/technology/news/2026/11/03/1242471-beget-soobschil-ob) - [Хостинг-провайдер Beget сообщил об утрате данных в облачной инфраструктуре](https://ria.ru/20261103/beget-2128982225.html) --- Machine-readable: https://pwn.watch/i/beget-hosting-cloud-wipe-cyberattack-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.