Events at the start of November 2026 in the Russian segment of the Internet marked one of the most destructive infrastructure incidents in the entire history of the local IT market. The cyberattack on Beget, one of Russia’s leading web hosts, led to the complete collapse of its cloud services. The scale of the damage affected every architectural layer of the company, paralyzing hundreds of thousands of web resources and putting data integrity at risk for clients across the country.
Timeline and scale of the incident: Strike against a key player in Runet
The night of November 2, 2026, became a turning point for Beget’s infrastructure. As a result of the planned cyberattack, the company’s cloud system was completely destroyed. The scale of what happened is defined by Beget’s special position in the Russian IT services market.
Согласно статистическим оценкам, на мощностях провайдера в 2026 году размещалось от 400 до 700 тысяч веб-сайтов. Компания удерживала от 13% до 15% всех зарегистрированных доменных имен в национальных зонах .ru, .рф and .suBelow is a comparison of the provider’s key indicators before and after the cyberattack:
Indicator before the attack
| Parameter | State after the attack | Status after the attack |
|---|---|---|
| Complete suspension of service | 13–15% | Full service suspension |
| Number of deployed sites | 400 000 — 700 000 | Hundreds of thousands of services are down for several days |
| Users' data integrity | 100% (normal mode) | Возможность восстановления только для 50% клиентов |
| Physical infrastructure status | Distributed server farm | Manual cleanup of >1000 physical servers |
Architectural damage: Destruction of data, backups, and internal structure
The attack was characterized by an extremely high level of intrusion and a systemic pattern of destruction. The attackers did not merely block access to services, but methodically eliminated key nodes and data copies.
As the provider’s representatives reported in the company’s official Telegram channel, the attackers managed to destroy not only the main production cloud volumes, but also backup copies (backups). This made it impossible to quickly roll systems back to a known working state.
The damage also affected the company’s deep system layers:
- Destruction of the internal database: In Beget’s system registries, the tables linking user accounts to the services provided to them were completely destroyed. This deprived engineers of the ability to automatically match the surviving data fragments with their owners.
- Irrecoverable loss of information: According to preliminary estimates by specialists, files and databases can be restored for no more than half of customers. A significant portion of user information has been lost irretrievably.
- Manual hardware compromise: The company’s engineering and technical staff had to manually inspect and clean more than 1,000 physical servers from injected malicious mechanisms and backdoors.
The sanctions factor and server consolidation
An analysis of Beget’s vulnerability cannot be separated from the foreign policy and sanctions context that formed around the company in the summer of 2026.
Since July 2026, the Beget provider has been included on the European Union sanctions lists. The official reason for the restrictions was the company’s cooperation with the Ministry of Defense of the Russian Federation, as well as the provision of services and activities in the occupied territories of Ukraine.
The introduction of European sanctions triggered a chain of forced infrastructure decisions:
- Closure of the European node: In the summer of 2026, the company was forced to liquidate and shut down its data center located in Latvia.
- Consolidation of capacity: Server equipment and workloads were urgently moved and concentrated within the Russian Federation.
- Risk concentration: The high density of infrastructure across a limited number of sites within the country made it easier for attackers to simultaneously target key nodes and backup circuits.
Business consequences: the "force majeure" mode and legal protection
The complete destruction of the cloud infrastructure left the hosting company facing ultimate financial and legal challenges. A multi-day outage of clients' web resources will inevitably result in multi-million losses for businesses using Beget's services.
To prevent an avalanche of lawsuits over prolonged downtime and the irrecoverable loss of databases, Beget’s management officially notified customers of the onset of force majeure circumstances (“force majeure”).
The situation that unfolded became one of the most serious infrastructure incidents in the history of the Russian internet, demonstrating the critical vulnerability of centralized cloud services in the face of targeted destructive cyberattacks.
0 comments
Enter your email and we will send you a one-time code. No passwords, no accounts.
Code sent to
If the email does not arrive in your inbox within a few minutes, check your Spam, Junk or Promotions folder — some mail services may wrongly place automated messages there.