---
id: "CMP-202611-d3g4vi"
page: "https://infrastack.ai/live/CMP-202611-d3g4vi"
kind: "campaign"
aliases: []
title: "Russian hosting and cloud provider Beget hit by data-wiper attack: VPS, S3 and Kubernetes data wiped, some customer data cannot be recovered"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Beget", "fixed": [], "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T18:30:40+00:00"
updated_at: "2026-11-09T18:31:56+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-09T18:30:40+00:00"}]
exploit_sources: []
---

# Russian hosting and cloud provider Beget hit by data-wiper attack: VPS, S3 and Kubernetes data wiped, some customer data cannot be recovered

Link for people: https://infrastack.ai/live/CMP-202611-d3g4vi (this .md is for agents)

On the night of 1 Nov 2026 an attacker got into the management systems for Beget's whole infrastructure and ran malware that erased server data. Beget (Russian web hosting, cloud and domain registrar, 200,000+ customers) cut all servers off the network. Beget says all data in its cloud infrastructure was lost (VPS, S3, Kubernetes, CDN settings and IP configurations); VPS binary backups are completely lost, and file backups partly survived, for roughly half of VPS users (6 Nov update). More than a week later about 60% of shared hosting and 40% of dedicated servers had been restored; about 1,000 servers need manual checks for hidden scripts. Beget found no sign of data theft or changes; the attack looks aimed only at destruction. Attacker unknown, no claim of responsibility (BleepingComputer, 9 Nov).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:Beget affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the attacker got into Beget's management systems but does not say how, while Beget's VPS, S3, Kubernetes and backup data was wiped, so customers' data went with a breached provider.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach

## How to check

Do you host sites, VPS, S3 storage, Kubernetes, CDN or domains at Beget (beget.com)? Check Beget's status page and whether your services and backups were restored. Data restored to servers may need to be checked for unexpected scripts.

## Fix

Restore from your own off-Beget backups. Re-check CDN and IP/DNS settings, and rotate any credentials and secrets stored on Beget servers as a precaution. Keep backups with an independent provider.

## Timeline

- 2026-11-09T18:30:40+00:00 analyst

## Documents

- [describes] @BleepinComputer: Russian cloud firm Beget rebuilds from scratch after data wiper attack
https://t https://x.com/BleepinComputer/status/2119850216857727000
- [describes] BleepingComputer: Russian cloud firm Beget rebuilds from scratch after data wiper attack https://www.bleepingcomputer.com/news/security/russian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_