VULNpocalypse
HighBreach / campaignOngoing

Beget hosting cyberattack wipes cloud data, VPS and Kubernetes backups lost

Attackers reached Beget’s management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.

Published
Fixed in
not confirmed
Exploitation
Yes, Beget says attackers gained access to infrastructure management systems and ran scripts that erased data

What happened

Beget, described as one of Russia’s largest domain registrars and hosting companies, suffered a cyberattack overnight on Sunday that destroyed data across its cloud infrastructure and disrupted hundreds of websites, according to The Record. DataBreaches.Net republished the opening of the same report.

Key facts from Beget’s statement as relayed by The Record:

  • The attackers gained access to systems used to manage the company’s infrastructure and executed scripts designed to erase data.
  • Damage was most severe in the cloud infrastructure, where data tied to virtual private servers (VPS), cloud storage and Kubernetes services was wiped.
  • Beget lost all binary backups of its virtual servers. File-level backups remained intact and could potentially be used to recover some information.
  • More than 1,000 servers must be manually inspected, so full restoration “will take a considerable amount of time.”
  • Nearly all websites on shared hosting can likely be recovered, but each server is checked individually. By Wednesday some sites were back online, and engineers were still removing malicious files and checking data integrity.
  • Dedicated servers managed directly by customers had already been restored.
  • Beget found no evidence that attackers tried to download or modify information on servers holding customer data.
  • Beget has not disclosed how the attackers got in, citing security concerns and an ongoing investigation. No group has publicly claimed responsibility.
  • Beget told customers the attack could constitute force majeure under Russian law, temporarily limiting some contractual obligations.

Impact reported by local media, per The Record: businesses, government agencies and research institutions were affected, including the Naryan-Mar city administration website and Russia’s Chestny Znak product labeling system. Kommersant reported the disruption mainly hit small and medium-sized businesses with online stores and corporate sites. As of October, Beget ranked second among registrars of .RU domains with about 540,700 domains, or 14.7% of the market, per figures Kommersant cited.

Context from the same report: the EU sanctioned Beget and one of its co-owners earlier this year over services to Russian occupation authorities in Ukraine and cooperation with Russian defense enterprises. The article also notes other attacks on Russian digital infrastructure, including the October FirstVDS breach.

No CVE is associated with this incident in the sources.

Am I affected?

You are likely affected if you:

  • Run VPS, cloud storage or Kubernetes workloads at Beget. Data in these services was wiped, and binary VPS backups are gone.
  • Use Beget shared hosting. Most sites are expected to be recoverable, but restoration is server by server.
  • Registered domains or manage DNS through Beget. One research institution reported its site was down because of problems involving its domain registrar, per The Record.
  • Stored passwords, API keys or other credentials on Beget systems. Beget urged customers to change them.

Customers on dedicated servers managed directly by them were reported as already restored. Whether other Beget services or customers outside Russia were affected is not confirmed.

What to do now

  1. Rotate all passwords, access keys, tokens and other credentials that were stored on or used with Beget systems, as Beget recommends.
  2. Inventory what you ran on Beget: VPS, cloud storage, Kubernetes, shared hosting, domains.
  3. Assume VPS binary images are unrecoverable. Rebuild from your own offsite backups, infrastructure-as-code or file-level backups.
  4. Ask Beget support whether file-level backups exist for your account and request them for recovery.
  5. Before bringing restored sites back, scan for malicious files and verify data integrity, since Beget engineers were still removing malicious files during recovery.
  6. Review domain and DNS settings at the registrar and enable any available account protections. Specific registrar-side exposure is not confirmed.
  7. Prepare a continuity plan for customers, and check your contract against Beget’s force majeure notice.
  8. Watch Beget’s official statements for the root cause and indicators. The initial access method is not confirmed.

Sources