A Data Wiper Reached the Management Layer of Russian Host Beget, Erased Its Cloud Data and Part of Its Backups, and Forced a Rebuild. The Lesson for Any Provider Is Where the Backups Live
If you run infrastructure for other people, or depend on a provider that does, ask one question today: could someone who controls the management layer also erase the backups? Russian hosting and cloud provider Beget says that is what happened to it. On the night of November 1, an attacker reached the management systems for its whole architecture and ran scripts that zeroed server data. Beget says all data in its cloud infrastructure was lost, VPS binary backups were lost completely, and VPS file backups only partly survived.
What has been reported
The sources are Beget's own Telegram statements of November 3 and November 6 and its status page, as BleepingComputer reports them on November 9. We did not read the statements directly. BleepingComputer names no attacker and reports no group claiming responsibility.
- The attack: the attacker gained access to the management layer and ran data-zeroing scripts. Beget detected it shortly after the malware activated and disconnected all servers from its network.
- What was lost: all data in the cloud infrastructure, including VPS, S3 and Kubernetes data, plus CDN settings and IP configurations. VPS binary backups were lost completely. VPS file backups partly survive: Beget says they "will be available for only half of users," that matching backups to users is "technically complex," and that "Unfortunately, it is impossible to recover all data."
- Scale and recovery: Beget has over 200,000 customers, including online stores, media and educational services. As of the report, about 60 percent of shared hosting and 40 percent of dedicated servers were restored, and about 1,000 servers need manual checks for vulnerabilities and hidden scripts before they return.
- Purpose: Beget's investigation found no evidence that data was downloaded or modified. It describes the attack as focused solely on destruction.
- Response: it treats all infrastructure as potentially infected, is cleaning and reworking "every potentially vulnerable point," and has told police and government agencies.
What it means
A wiper that arrives through the management layer is a different problem from ransomware on a file server. There is no negotiation and no key, and the tools that normally recover from it can be in the same blast radius. The pattern here, as reported, is that one point of control reached the data, the cloud services and the backups. Nothing in the sources says how the attacker got into the management systems, so we do not know whether it was stolen credentials, a software flaw or something else. We also do not know the motive: the sources report none, and we will not guess at one.
What to do
- Keep at least one backup copy that the management layer cannot delete or overwrite: offline, immutable, or in a separate account with separate credentials and no shared administrators.
- Test a full restore, not just the backup job. Beget's difficulty matching backups to users is a restore problem, and it only shows up when you try.
- Put the management plane behind its own strong authentication, separate from customer-facing systems, and restrict it to a dedicated administration network. Alert on bulk-delete and zeroing operations at that layer.
- If you are a customer of any hosting or cloud provider, keep your own copy of anything you cannot afford to lose, outside that provider. A provider's backups are the provider's, and in this case they were part of the loss.
- Assume a destructive actor can move faster than a human can disconnect: Beget disconnected after the malware ran. Pre-built isolation switches help, for example a way to cut management access from the data plane in one action.
- For Beget customers: check your own copies first, then expect manual verification before servers return, and treat restored sites as needing a security review, since Beget itself is checking for hidden scripts.
What is not known
How the attacker got into the management systems. Who it was. Whether the attacker used a named wiper family; the report gives no malware names and no indicators. Whether further data is recoverable. We add no indicators to our feed because none are published.
How we know, and how we checked
We read BleepingComputer's report. Beget's own statements reach us only through it, and we do not read Russian-language Telegram directly, so every figure and quote is BleepingComputer's account of Beget's. We did not examine any sample or test anything. A search of our corpus found no earlier post of ours about Beget.
Sources
BleepingComputer, "Russian cloud firm Beget rebuilds from scratch after data wiper attack," November 9, 2026. As cited there and not opened by us: Beget announcements on Telegram of November 3 and November 6, 2026, and its status page.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.