The Beget cyberattack: how a major Russian host went down and what site owners should learn
On the night of November 2, attackers reached Beget’s management servers and launched data-wiping malware, knocking thousands of sites offline. What happened, and how to protect your own project.
Beget, one of Russia’s largest hosting providers, was hit by a cyberattack on the night of November 2. According to a statement on the company’s website, attackers gained access to its management servers and launched malware designed to delete data from servers. Thousands of sites on shared hosting, along with email and managed servers, were unavailable for days.
Timeline (Moscow time)
- Nov 2, ~02:00 — attack begins (estimated)
- 02:30 — data-wiping malware launched
- 02:40 — breach detected
- 02:55 — all servers disconnected from the network
- 04:50 — first customer notice posted on Telegram
- Nov 2, 17:00 — NS servers restored for all domains
- Nov 3 — more than 80% of mail infrastructure and webmail restored
- Nov 4, 01:00 — first sites back online
In its latest official update on November 5, Beget said shared hosting was 60% restored and Beget-managed dedicated servers 40% restored. The company said it was checking backup storage and preparing to restore affected sites from backups.
Beget describes itself as Russia’s number one hosting provider with more than 1.5 million customers. A multi-day outage at that scale hit not only small blogs but also online stores, government portals and business email. It is another reminder of how risky it is to depend entirely on a single provider.
How the attackers got in, who is behind the attack, and whether any customer data was permanently lost have not yet been disclosed.
5 lessons for site owners
1. **Keep backups somewhere else.** Follow the 3-2-1 rule: 3 copies of your data, on 2 different media, with 1 at another provider or offline. A backup stored inside your host can disappear together with the host.
2. **Separate your domain and DNS from hosting.** With the domain at an independent registrar and DNS at a service such as Cloudflare, you can point your site to a new server within minutes if your host goes down.
3. **Move business email to a separate service.** If email lives on the same server as your site, both go down together. Keep it separate so you never lose contact with customers.
4. **Test your recovery plan in advance.** Know how long it takes to bring your site up on a new server from a backup. An untested backup is no backup at all.
5. **Protect your access.** Turn on two-factor authentication for control panels and servers, rotate passwords regularly and remove old access keys.
The takeaway
The Beget incident shows that any provider, even the biggest, can fall victim to an attack. If your site matters to your business, drop the idea that the host will handle everything, and set aside time today for independent backups and a recovery plan.
Source: Beget
