Beget Rebuilding Cloud Infrastructure After Data-Wiping Attack
Summary
Beget says an attacker accessed its management layer on Nov. 1 and erased cloud data, forcing a rebuild. The provider reports 60% of shared hosting and 40% of dedicated servers restored, with recovery ongoing.
Key points
- Beget says an attacker accessed the management layer of its infrastructure on Nov. 1 and ran data-zeroing scripts.
- The company detected the attack shortly after the malware activated and disconnected all servers from the network.
- Beget says data in its cloud infrastructure, including VPS, S3, and Kubernetes, was lost, along with CDN settings and IP configurations.
- VPS binary backups were lost; some file backups survived and are expected to be available to roughly half of VPS users.
- Beget reports that 60% of shared hosting and 40% of dedicated servers have been restored, with recovery continuing.
- About 1,000 servers require manual checks for vulnerabilities and hidden scripts before returning online.
- Beget says its investigation found no evidence the attacker tried to download or modify data, and that the attack appeared focused on destruction.
Article Details
- Victim Organization
- Beget
- Incident Type
- Destructive data-wiping malware attack following access to Beget's management systems
- Incident Date
- 2026-11-01
- Disclosure Date
- 2026-11-03
- Affected Data Size
- Beget said all data in its cloud infrastructure, including VPS, S3, and Kubernetes, was lost. VPS binary backups were completely lost and VPS file backups partially survived.
- Operational Impact
- Beget disconnected all servers to contain the activity and is rebuilding its cloud infrastructure. At the time of reporting, 60% of shared hosting and 40% of dedicated servers had been restored. Roughly 1,000 servers required manual checks before being brought back online. Beget reported no evidence that the attacker tried to download or modify data.
- Claim Status
- confirmed