Beget cyberattack: architecture breach and recovery status

In the night between November 1 and November 2, 2026, a major cyberattack targeted the IT infrastructure of hosting provider Beget. The attackers gained access to the management circuit of the entire architecture and subsequently executed wiping scripts.

Key details of the cyberattack on Beget - The attack occurred in the early hours of November 2, compromising the core architecture management. - Binary backups for VPS were completely lost, though file backups remained intact. - More than 1,000 servers require manual security checks before being brought back online.

Current status of service recovery According to the provider, dedicated servers under user administration have been successfully restored. DNS management for domains in ru, rf, and su zones is partially operational, allowing record updates. The email service is running at approximately 80 percent capacity, with full restoration expected soon.

Agreements with the Internet Coordination Center ensure that domain delegations expiring soon in national zones will not be revoked and will continue to function. Company representatives noted that there were no attempts by attackers to download or alter user data stored on the servers.

Cloud infrastructure and security measures Within the cloud infrastructure, including VPS, S3, and Kubernetes, all data was lost and CDN/IP settings were wiped, though specialists continue searching for recovery options. File backups for hosting and cloud are preserved but access requires thorough manual server verification.

The company's DevOps team and staff are working around the clock in crisis mode. Users are strongly advised to change all passwords, access keys, and other credentials that may have been stored on the servers once access is fully restored.