Beget Hosting Provider Advances Recovery After Cyberattack Wipes Cloud Infrastructure
Russian hosting provider Beget has provided an update on its ongoing recovery from a destructive cyberattack that occurred on the night of November 2, 2026.
Attackers obtained access to the management contour of the entire infrastructure and launched wiping scripts. As a result, all data in the cloud environment, including VPS, S3, and Kubernetes clusters, was destroyed. File-level backups of VPS instances remained intact, while CDN settings and IP allocations were lost.
The company immediately began rebuilding its cloud infrastructure from scratch. Recovery of virtual hosting servers is being performed in four stages from backup copies. To date, more than 50,000 websites have been restored together with newly issued SSL certificates. Approximately half of the virtual hosting recovery work has been completed, and Beget expects to finish the bulk of restoration within the next three days.
For customers whose sites have already been recovered, Beget has activated technical support directly inside the control panel. Users can now submit requests at cp.beget.com/support. The support section is currently available only to accounts with restored websites. Customers who do not see the section can contact support@beget.com.
The provider noted that it is receiving significantly more requests than usual and asked for patience while staff work around the clock to handle the increased load. All Beget employees, including the DevOps team, are operating in crisis mode until the incident is fully resolved.
Separately, the Coordination Center for .RU and .РФ domains has temporarily suspended Beget’s accreditation as a registrar. During the suspension the company cannot register new domains or accept transfers, although it must continue to maintain all domains registered before the suspension took effect.
Related articles
Four Words Instead of a Password: Why Passphrases Fail Against Real Breaches and Infostealers
Hive Systems' 2026 password cracking table shows an eight-character complex password lasting 132 years under bcrypt, yet human-chosen variants like o#mA24ft fall in three seconds on an RTX 5090. Kaspersky's analysis of 231 million leaked passwords from 2023-2026 reveals 48 percent crack in under a minute and 60 percent within an hour, driven by predictable patterns such as trailing digits, years, and transliterated Russian words. NIST's SP 800-63B-4 update removed mandatory character rules, raised standalone password length to 15 characters, and banned periodic rotation. Diceware passphrases deliver 52 bits with four words and 77.5 bits with six, but only when generated randomly; human-selected phrases from pop culture or song lyrics collapse under dictionary attacks. Infostealers, not offline cracking, dominate theft, with Flashpoint reporting 2.1 billion credentials stolen in cleartext last year. FIDO passkeys reached five billion active keys by May 2026, yet remain vulnerable on compromised devices. The article concludes that passphrases suit only a handful of master secrets while random strings from managers handle the rest.
Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach
Notion has confirmed that a security incident at Fireworks AI exposed conversation transcripts from its Notion AI assistant, affecting less than 1% of customer workspaces. The breach occurred because Fireworks handled classification tasks for the Insights feature and served open-weight models. Notion stated that its own systems were not compromised. The timeline shows initial notification on November 2, 2026, followed by disconnection of systems on November 3 and confirmation of customer data exposure on November 8. Most transcripts lacked author or workspace attribution and did not include tool call results, though user-entered content could still identify individuals or organizations. Fireworks attributed the intrusion to a financially motivated group engaged in LLMjacking, involving theft of credentials to hijack AI models for illicit use.
Beget Outlines Four-Stage Recovery of Servers After Cyberattack Destroys Cloud Infrastructure
Russian hosting provider Beget has provided an update on restoring its infrastructure following a destructive cyberattack that occurred on the night of November 2, 2026. Attackers gained access to the management contour and executed wiping scripts, resulting in total data loss across VPS, S3, and Kubernetes environments while file-level backups of VPS remained intact. The company is now recovering dozens of virtual hosting servers from backups in parallel using multiple data streams. Each affected server undergoes a structured four-stage restoration process that includes OS installation, environment setup, data loading, and gradual reactivation of thousands of customer sites. Beget has already brought more than 18,000 websites back online, with 66 servers currently in the recovery pipeline. The Coordination Center for .RU and .RF domains has temporarily suspended Beget’s registrar accreditation, preventing new registrations during the suspension period.
Beget Loses Accreditation as .RU and .РФ Domain Registrar After Cyberattack
Following a cyberattack on November 2, Russian domain registrar and hosting provider Beget has had its accreditation temporarily suspended by the Coordination Center for .RU and .РФ domains. The company can no longer register new domains in the .RU, .РФ, and .SU zones or accept transfers from other registrars. Beget must continue supporting all domains registered before the suspension, and expiration dates have been postponed by agreement with the Coordination Center and RosNIIROS to prevent any loss of domains. The incident stems from attackers gaining access to the management infrastructure and deploying wiping scripts. Partial functionality has been restored in the control panel, but full domain management features for the affected zones will return only after accreditation is reinstated. No specific recovery timeline has been announced.