Beget Outlines Four-Stage Recovery of Servers After Cyberattack Destroys Cloud Infrastructure
Russian hosting provider Beget has released detailed information on the ongoing recovery of its IT infrastructure after a major cyberattack that struck on the night of November 2, 2026.
Attackers obtained access to the management contour of the entire architecture and launched wiping scripts. As a result, all data in the cloud infrastructure, including VPS, S3, and Kubernetes environments, was destroyed. File-level backups of VPS instances were preserved, but CDN settings and IP allocations were lost.
Part of the virtual hosting servers suffered more severe damage than others. Beget is now restoring these servers from backups through a four-stage process:
- Server preparation — powering on the server, installing the operating system, and configuring the network. At this point the server responds to ping but customer sites remain unavailable.
- Environment deployment — installing Beget’s software stack and configuring required services.
- Data restoration — connecting the server to the backup recovery system and loading data from backups.
- Site activation — restoring virtual hosts, binding domains, and returning sites to operation for thousands of websites per server.
To accelerate recovery, Beget modified the process so that site restoration begins as soon as user data reaches the server, even while other data continues to copy. More than 18,000 sites have already been returned to service, and 66 servers are currently undergoing parallel recovery with multiple data streams running continuously.
The company also noted that the Coordination Center for .RU and .RF domains has temporarily suspended Beget’s accreditation as a domain registrar, preventing new registrations and transfers during the suspension.
Related articles
Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach
Notion has confirmed that a security incident at Fireworks AI exposed conversation transcripts from its Notion AI assistant, affecting less than 1% of customer workspaces. The breach occurred because Fireworks handled classification tasks for the Insights feature and served open-weight models. Notion stated that its own systems were not compromised. The timeline shows initial notification on November 2, 2026, followed by disconnection of systems on November 3 and confirmation of customer data exposure on November 8. Most transcripts lacked author or workspace attribution and did not include tool call results, though user-entered content could still identify individuals or organizations. Fireworks attributed the intrusion to a financially motivated group engaged in LLMjacking, involving theft of credentials to hijack AI models for illicit use.
Beget Loses Accreditation as .RU and .РФ Domain Registrar After Cyberattack
Following a cyberattack on November 2, Russian domain registrar and hosting provider Beget has had its accreditation temporarily suspended by the Coordination Center for .RU and .РФ domains. The company can no longer register new domains in the .RU, .РФ, and .SU zones or accept transfers from other registrars. Beget must continue supporting all domains registered before the suspension, and expiration dates have been postponed by agreement with the Coordination Center and RosNIIROS to prevent any loss of domains. The incident stems from attackers gaining access to the management infrastructure and deploying wiping scripts. Partial functionality has been restored in the control panel, but full domain management features for the affected zones will return only after accreditation is reinstated. No specific recovery timeline has been announced.
Beget Rebuilds Cloud Infrastructure After Destructive Cyberattack Wipes VPS Backups
Beget suffered a severe cyberattack that allowed threat actors to access the management layer of its entire cloud architecture and execute wiping scripts. The incident destroyed cloud infrastructure and left backup copies of VPS files available to only half of the affected users. Internal systems were also hit, breaking links between customer accounts and services, forcing the provider to reconstruct ownership records. Hosting services have recovered more than 60 percent, while full cloud restoration timelines remain unknown. The attack disrupted BelkaCar’s car-sharing application, which relied on Beget for backend connectivity and has since migrated to another provider.
Fukuoka Prefecture Exposes Personal Data of 183 Corporate Officers Due to Website File Misconfiguration
Fukuoka Prefecture has confirmed that personal information belonging to 183 corporate officers from 24 organizations was left publicly accessible on its official website. The exposure occurred within files related to the Fukuoka Prefecture Easy-to-Work Care Workplace Certification System. The files were uploaded by a contracted vendor between August 21 and September 17, 2026, with incorrect permissions that allowed online editing and saving instead of read-only access. The issue remained undetected until an applicant inquired about download procedures. Upon discovery, the prefecture instructed the vendor to remove the files and contacted all 24 affected corporations by telephone to provide explanations and apologies. The incident highlights risks associated with improper configuration of application files containing sensitive personal data on government websites.