The company said attackers reached the control plane governing its entire infrastructure and ran scripts designed to delete data. According to a timeline Beget published, the attack began at about 2 a.m. Moscow time; the malicious software was launched around 02:30, the breach was detected ten minutes later, and at 02:55 the provider disconnected all servers from the network to stop it spreading.
Lost in the attack were VPS virtual servers, S3 object storage and Kubernetes clusters, along with IP address configurations and content delivery network (CDN) settings. Beget said access to the surviving files will be provided through its control panel, which is itself being rebuilt.
"Unfortunately, it is impossible to restore all the data. We searched for solutions for a long time, but by the current estimate file backups of VPS will be available for only half of users," the company said. It added that some data in an internal system was also lost, which left some users without current account-to-service links.
By November 6, Beget had brought more than 60% of its virtual hosting servers and 99% of its mail servers back online. Dedicated servers administered by users themselves have been fully restored. The remaining virtual hosting servers were hit harder, so data on them will have to be recovered from backups. The company did not give a completion date.
Beget also acknowledged that the threat to its infrastructure persists. "We proceed from the assumption that the threat to the infrastructure still persists. Therefore we are cleaning out everything we can and redoing every point that could be vulnerable, including those that did not previously seem dangerous," the provider said.
Customers reported problems en masse early on November 2, when websites, email, virtual servers and the provider's control panel became unavailable. Beget initially described the event as a "major incident" affecting all levels of its architecture, and later acknowledged that a cyberattack was the cause.
Beget has operated since 2007. According to a hosting census for October 2026, 334,562 active sites in the .ru, .rf and .su domains were hosted on the company's infrastructure. The Moscow Times, citing various estimates, writes that the provider supports between 400,000 and 700,000 sites. Since summer 2026, Beget has been under EU sanctions over providing services in occupied territories of Ukraine and cooperating with the Russian Defense Ministry.