Incident BriefingsBeget destructive hosting attack

Beget destructive hosting attack

Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack.

Last modified

Summary

  • Environment: Hosting management servers and customer services
  • Operational impact: Servers disconnected; restoration remains incomplete
  • Financial impact: No incident cost publicly quantified
  • Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.

What happened

Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack. [1]

Impact

By November 5 at 15:00 MSK, Beget reported 60% of shared hosting and 40% of its managed dedicated servers restored. [1]

Timeline

  1. Attack detected and servers disconnected (MSK)

    Attack detected and servers disconnected (MSK), as described in the incident notice.

    [1]

  2. Mail services partly restored (MSK)

    Mail services partly restored (MSK), as described in the incident notice.

    [1]

  3. Recovery percentages updated (MSK)

    Recovery percentages updated (MSK), as described in the incident notice.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 5, 2026.

Threat Group & Attack Vector

The notice describes destructive malware but does not establish the initial entry method or a named attacker. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Unmanaged dedicated servers and name servers returned on November 2. More than 80% of mail infrastructure and webmail returned November 3; shared-hosting websites began returning November 4. [1]