Major Russian Hosting Provider Beget Suffers Devastating Cyberattack, Wiping Cloud Data
Russian web hosting provider Beget is grappling with a severe cyberattack that has destroyed data across its cloud infrastructure, impacting hundreds of websites and services.
Beget, one of Russia's largest domain registrars and hosting companies, is working to restore services after a significant cyberattack overnight on Sunday wiped data across its cloud infrastructure. The attack, which saw attackers gain access to systems managing the company's infrastructure and execute data-erasing scripts, has disrupted hundreds of websites and online services.
The damage is particularly extensive within Beget's cloud infrastructure, affecting virtual private servers (VPS), cloud storage, and Kubernetes services. The company reported that all binary backups of virtual servers were lost, though file-level backups remain intact and may aid in recovery. "Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected," Beget stated, emphasizing the manual effort required to check each server before bringing it back online.
While dedicated servers managed directly by customers have been restored, and nearly all websites hosted on shared infrastructure are likely recoverable, the process is slow. Engineers are diligently removing malicious files and verifying data integrity. By Wednesday, some websites had begun to reappear online, but the full restoration remains a significant undertaking.
The attack has had a broad impact, affecting websites and online services used by businesses, government agencies, and research institutions across Russia. Notable disruptions include the official website of the Naryan-Mar city administration and Russia's Chestny Znak product labeling system. The Laboratory of Solar Astronomy at the Russian Academy of Sciences also reported its space weather information website was unavailable due to issues with its domain registrar.
This incident occurs amidst a backdrop of increasing cyber threats targeting Russian digital infrastructure. In October, a vulnerability in software used by another Russian hosting provider, FirstVDS, was exploited to steal sensitive customer data. Concurrently, Ukrainian drones have targeted data centers operated by major Russian tech companies like Yandex and Sberbank, disrupting cloud services and other online platforms.
Founded in 2007, Beget is a substantial player in Russia's internet landscape, ranking second in .RU domain registrations as of October. The company provides a range of services including cloud computing, website hosting, and domain management. Despite the extensive data loss, Beget has stated it found no evidence that attackers attempted to download or modify customer data, though it has advised customers to change passwords and access keys.
Beget has not disclosed the initial access vector, citing security concerns and an ongoing investigation. No threat group has yet claimed responsibility for the attack. The company also notified customers that the incident might be considered a force majeure event under Russian law, potentially impacting contractual obligations.
This cyberattack follows previous international scrutiny of Beget, as the European Union imposed sanctions earlier this year. The sanctions were levied over the company's provision of digital infrastructure services to Russian occupation authorities in Ukraine and its cooperation with Russian defense enterprises.