Beget wiper attack leaves half of VPS customers with unrecoverable data
A data-wiping intruder has left Russian cloud provider Beget rebuilding from scratch, with data loss irreversible for roughly half of VPS customers after the Nov. 1 breach of its cloud management systems, BleepingComputer reports.
Beget serves more than 200,000 customers, including online stores, media and educational services. More than a week later, 60 percent of shared hosting and 40 percent of dedicated servers had been restored. All cloud data—VPS, S3, Kubernetes, CDN settings and IP configurations—was lost.
The attacker accessed Beget’s management layer across its entire architecture and ran data-zeroing scripts. VPS binary backups were lost completely; file backups partially survived and may cover roughly half of VPS users per a Nov. 6 assessment, though matching them is technically complex. Roughly 1,000 servers need manual vulnerability and hidden-script checks before returning online.
Beget found no evidence the attacker downloaded or modified data, describing the intrusion as destruction-only. It has notified police and government agencies and is working with cybersecurity firms while treating all infrastructure as potentially infected.
Sources & technical scope 1 source
BleepingComputer — original source ↗
Exploitation: Confirmed destructive intrusion; Beget reports destruction-only activity with no evidence of data download or modification.
Scope & limitations: Attacker identity, initial access vector, exact customer impact, and any product versions or fixes are not established by the supplied evidence.
External findings belong to the credited researchers.