Cyberattack wipes cloud data at major Russian hosting provider Beget

A major Russian web hosting provider is struggling to restore its services after a cyberattack destroyed data across its cloud infrastructure and disrupted hundreds of websites.

Beget, one of Russia's largest domain registrars and hosting companies, said Wednesday that it had begun bringing some servers back online following the attack, which took place overnight on Sunday.

"Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected," the company said.

According to Beget's statement, the attackers gained access to systems used to manage the company's infrastructure, allowing them to execute scripts designed to erase data.

The damage was particularly severe in Beget's cloud infrastructure, where data associated with virtual private servers (VPS), cloud storage and Kubernetes services was wiped. The company said it had also lost all binary backups of its virtual servers, although file-level backups remained intact and could potentially be used to recover some information.

"We are not giving up and are continuing to look for ways to recover this data," Beget said.

The attack comes as Russian digital infrastructure companies face a growing number of cyberattacks and drone strikes. In October, hackers exploited a vulnerability in software used by Russian hosting provider FirstVDS to steal sensitive customer data, including passwords, cloud credentials and cryptocurrency wallets. 

Meanwhile, Ukrainian drones struck three data centers operated by Russian technology giant Yandex, forcing two facilities offline and disrupting cloud services and other online platforms across the country. Separate drone strikes also targeted data centers operated by Russia's largest bank, Sberbank, and social media giant VK.

According to Beget, nearly all websites hosted on its shared hosting infrastructure can likely be recovered. However, restoring services would be a slow process because each server must be checked individually before being brought back online.

By Wednesday, some websites were back online, while engineers continued removing malicious files and checking data integrity. Dedicated servers managed directly by customers had already been restored, the company said.

The attack disrupted websites and online services across Russia, including those used by businesses, government agencies and research institutions, according to local media reports. Among the affected services were the official website of the Naryan-Mar city administration and Russia's Chestny Znak product labeling system.

The Laboratory of Solar Astronomy at the Russian Academy of Sciences also reported that its website, which publishes space weather information, was unavailable because of technical problems involving its domain registrar.

Russian newspaper Kommersant reported that the disruption primarily affected small and medium-sized businesses that rely on Beget to host online stores and corporate websites.

Founded in 2007, Beget is a major player in Russia's internet infrastructure. As of October, it ranked second among registrars of Russian .RU domains, managing approximately 540,700 domains, or 14.7% of the market, according to figures cited by Kommersant.

The company also provides cloud computing, website hosting, domain management and other infrastructure services.

Beget said it had found no evidence that attackers attempted to download or modify information stored on servers containing customer data. However, it urged customers to change passwords, access keys and other credentials that may have been stored on affected systems.

The company has not disclosed how the attackers initially gained access to its infrastructure, citing security concerns and an ongoing investigation. No hacking group has publicly claimed responsibility for the incident.

Beget also notified customers that the attack could constitute a force majeure event under Russian law, temporarily preventing it from meeting some contractual obligations.

Earlier this year, the European Union imposed sanctions on Beget and one of its co-owners over the company's provision of digital infrastructure services to Russian occupation authorities in Ukraine and its cooperation with Russian defense enterprises.

The EU accused the company of knowingly providing hosting, domain registration and other digital services to Russian-backed authorities in occupied Crimea, Donetsk and Luhansk, as well as to defense-related entities supporting Moscow's war against Ukraine.