Russian cloud firm Beget rebuilds from scratch after data wiper attack
Russian cloud provider Beget rebuilds infrastructure after data-wiping malware attack destroys customer data.
Russian cloud services provider Beget suffered a destructive malware attack on November 1st that compromised its management systems and erased server data across its infrastructure. The attacker gained access to the management layer and deployed data-zeroing scripts, destroying all VPS, S3, and Kubernetes data, CDN settings, and IP configurations for over 200,000 customers. As of November 6, Beget had recovered 60% of shared hosting and 40% of dedicated servers, but acknowledged that full recovery is impossible for many users and requires rebuilding approximately 1,000 servers from scratch.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Beget?
Get an email when a new story names Beget, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn attacker who gained access to Beget's cloud management layer deployed data-zeroing scripts that systematically destroyed VPS, S3, Kubernetes, and CDN data across the entire infrastructure, affecting over 200,000 customers. The root failure was a combination of insufficient access controls protecting the management plane and the absence of resilient, isolated backups that could have enabled full recovery. When a single management layer can reach and destroy all customer data simultaneously, the blast radius of any compromise becomes catastrophic. This incident illustrates that cloud providers—and their customers—must treat backup isolation and management-plane access control as existential priorities, not afterthoughts. The inability to fully recover data for many customers underscores that destruction-focused attacks demand a fundamentally different recovery posture than traditional ransomware scenarios.
What helps against this
How we list vendors- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.