---
type: "post"
id: "beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127"
slug: "beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127"
title: "Beget says a cyberattack destroyed its cloud; VPS file backups remain for half of users"
description: "Beget says a cyberattack overnight on 2 November destroyed its cloud infrastructure, including VPS, and that file backups will be available for only about half of VPS users."
retrieval_nugget: "Beget says a cyberattack overnight on 2 November destroyed its cloud infrastructure, including VPS, and that file backups will be available for only about half of VPS users. For teams relying on one host, the event makes backup recoverability and provider-level failure immediate operational concerns."
published_at: "2026-11-08"
updated_at: "2026-11-08"
record_date: "2026-11-08"
date_kind: "published_at"
topics: ["security","infrastructure"]
entities: ["Beget","Kommersant"]
related_patterns: []
novelty_label: "new_fact"
what_changed: null
prior_refs: []
source_url: "https://www.kommersant.ru/doc/9091486"
source_urls: ["https://www.kommersant.ru/doc/9091486"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127/","markdown":"https://newruntime.com/posts/beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127.md","json":"https://newruntime.com/posts/beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127.json"}
markdown_url: "https://newruntime.com/posts/beget-says-a-cyberattack-destroyed-its-cloud-vps-3f6127.md"
---

# Beget says a cyberattack destroyed its cloud; VPS file backups remain for half of users

## Retrieval answer

Beget says a cyberattack overnight on 2 November destroyed its cloud infrastructure, including VPS, and that file backups will be available for only about half of VPS users. For teams relying on one host, the event makes backup recoverability and provider-level failure immediate operational concerns.

## Summary
Beget says a cyberattack overnight on 2 November destroyed its cloud infrastructure, including VPS, and that file backups will be available for only about half of VPS users. For teams relying on one host, the event makes backup recoverability and provider-level failure immediate operational concerns.

## What happened
Kommersant reports that Russian hosting provider Beget said a cyberattack overnight on 2 November 2026 destroyed its entire cloud infrastructure. The company’s statement, as reported by Kommersant on 6 November, specifically includes virtual private servers, or VPS. The report says Beget’s cloud infrastructure served hundreds of thousands of customer websites and virtual servers.

Beget said it would be impossible to restore all customer data. Its current assessment is that file-level backups for VPS will be available to only about half of users. That is an availability estimate for backups, not a claim that half of all affected VPS workloads have already been restored. The company did not state a number of customers whose data was lost, nor did it give a total count of recoverable or irrecoverable files.

Kommersant quotes Beget saying that even where a backup exists, restoration will not happen immediately. The provider must identify a particular customer and match all of that customer’s data to the relevant backup. Beget characterized that matching work as technically difficult and described it as its principal task at the time of the statement. The report does not provide technical detail on the storage architecture, the mechanism by which the attackers caused the destruction, or the order in which customer systems will be restored.

The attack disrupted almost every service layer named by the provider: virtual hosting, VPS, DNS and name servers, email, the control panel, and the beget.com website. These are distinct customer-facing functions, but their simultaneous failure means customers could lose hosted application access, administrative access, name resolution, and mail services at once. Kommersant does not say whether each affected layer ran on the same infrastructure or whether any layer remained available during the incident.

Beget also declared force majeure under paragraph 3 of Article 401 of the Russian Civil Code. In practical terms, the provider said extraordinary circumstances prevented it from fulfilling contractual obligations. Kommersant’s report does not describe a complete recovery timetable, a migration program for affected customers, compensation terms, or a final technical account of the attack.

## What the archive adds
New Runtime covered Beget’s account of attackers accessing management servers and running malware intended to delete data on 4 November in [an earlier note](https://newruntime.com/posts/beget-says-attackers-accessed-management-servers-ran-malware-c19307/). That note recorded recovery milestones then reported by the company, including restored mail infrastructure, domain management, webmail, and initial virtual-hosting sites. The 6 November report adds a more severe assessment: Beget says its cloud was destroyed and file backups will cover only about half of VPS users. This is a new fact on a known incident, not a restatement.

## Trend signal
This does not yet fit a pattern New Runtime tracks. The event is a provider-wide infrastructure failure and recovery problem, rather than evidence of a durable change in how AI systems are built or operated.

## Why now
The reported attack took place overnight on 2 November, while the 6 November assessment moves the story from disruption toward an explicit statement that not all data can be restored. That shift matters for customers deciding whether to wait for the provider’s recovery work or begin moving workloads. It also changes the question for operators: not merely whether services are reachable, but whether data and the route to restore it still exist.

## Why it matters
The incident distinguishes a backup process from a recovery capability. A copy is useful only when it remains outside the failure domain, can be identified as belonging to the right account and workload, and can be restored in a useful period. Beget’s reported estimate that file backups will be available for about half of VPS users shows why the word “backup” alone is not an operational assurance.

For teams building with AI, the implication extends beyond the application server. An AI product may depend on a hosted API gateway, worker machines, object storage, a control panel, DNS, transactional email, and deployment credentials. A provider-level event can disrupt several of these dependencies simultaneously. Separate product labels do not necessarily mean separate resilience boundaries.

The practical response is not necessarily to leave a hosting provider. It is to define what must survive a provider failure: independently stored data copies, documented ownership of domains and accounts, a portable deployment description, and an alternative place to restore critical workloads. Force majeure language may shape a contractual dispute, but it does not restore an unavailable application or customer data.

## Limits and uncertainty
Kommersant relays Beget’s assessment, and the scale and technical details of the attack have not been independently established in the report. The estimate that backups will be available for half of VPS users is not a final audited count. Kommersant does not quantify permanent customer-data loss, identify the attackers, or establish the exact sequence of compromise and destruction.

The report also does not state when backup matching will finish, which individual services have returned, or how long broader recovery will take. “Destroyed cloud infrastructure” and “unrecoverable customer data” are related but not identical claims: Beget says some file backups exist, while their availability and successful restoration remain separate steps. The company’s force-majeure declaration likewise does not establish the eventual outcome for individual customers.

## Skill to build now
Run one recovery drill for a service that depends on a hosting provider. Locate the latest backup held outside that provider’s environment; verify the account, credentials, domain settings, and deployment configuration required to use it; then restore it into a second environment and measure the elapsed time. Record the dependencies that blocked the drill. A backup that cannot be found, attributed, and restored is not a recovery plan.

## Reader takeaway
Beget says a cyberattack destroyed its cloud infrastructure and that file backups will be available for only about half of VPS users. The lasting operational lesson is simple: verify that critical data, identity, and recovery steps can survive the same provider failure they are intended to protect against.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- topic hub: [Infrastructure](https://newruntime.com/topics/infrastructure.md): Explore the infrastructure topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)