In the night to 2 November 2026 Beget, one of Russia’s largest hosting providers, said its infrastructure had been hit by a massive cyberattack. Channels report that customer sites, the control panel, VPS, mail and DNS stopped responding; Beget itself spoke of disrupted services and declared force majeure. Beget published its statements on its official Telegram channel; this article quotes those posts and separates them from what other channels added.
The post sets the official statements beside what other channels added, and lists what is still unknown. It also says what a hosting outage means for the customers who sit on top of it.
What Beget Said and What Others Added
Beget’s statements come from its official Telegram channel, posts of 2 November 2026. Everything else comes from the 108 Telegram posts we read in Brandefense Blackhole. It holds 117 matches for “Beget” and 8 for the Russian spelling, all dated 2 November 2026.
| Point | Beget said on its official channel | Added by other channels |
|---|---|---|
| Nature of the event | A massive cyberattack in the night to 2 November disrupted a number of services; the problem affects all levels of the architecture | Several channels call it a hack; one channel says the provider was hit by encryption, which is that channel’s wording only |
| Services affected | A number of services; NS servers and mail are named as being restored | Channels list customer sites, the control panel, VPS, mail and DNS as down, with 502 errors on hosted sites. One channel adds that VPN services built on Beget domains or servers also stopped |
| Recovery | Unmanaged dedicated servers (“without our administration”) are restored. NS servers are the priority, estimated at 4 to 5 hours. Mail is being restored. File backups exist for the overwhelming majority of virtual hosting and cloud resources, and restoring them takes a long time. No timeline for full | Channels repeat these points |
| Legal position | ООО “Бегет” notified customers of circumstances with features of force majeure, citing article 401, part 3, of the Russian Civil Code | Channels relay the notice |
| Scale | No figure given | About 15% of working sites in .ru, .рф and .su; figures differ, with one post saying about 335,000 sites and more than a dozen saying almost 500,000 |
| Who did it | The official posts describe an attack without naming a perpetrator | The 108 posts are news reposts and commentary, and none of them identifies a group |
The size of the provider is the most uneven number in this story. The 15% share appears in 22 of the 108 posts, not in Beget’s own text. The site count behind it moves from 335,000 to almost 500,000, so we treat the share as a channel claim, not measured.
Why the Attacker Is Still Open
The day before, hacktivist groups named themselves in the Rosstat case, with posts, logos and data volumes that Rosstat then disputed. Our Rosstat claim ledger shows how that story was built. Beget differs on the facts we have: the company itself says it was attacked, but no actor has put a name to it in the posts we read.
That gap matters for how to read the event. An encryption or wiping attack on a hosting provider can come from a criminal crew, a hacktivist group or a state-linked team. The outage alone does not tell them apart. Wording such as “enemy hackers” in one channel is opinion, not attribution.
- Date.
- Night to 2 November 2026.
- Provider.
- Beget, Russian hosting provider.
- Statement.
- Beget said on its official channel: massive cyberattack, force majeure cited to customers.
- Share of Russian sites.
- About 15% of working .ru, .рф and .su sites, reported by channels.
- Backups.
- Beget said on its official channel that file backups exist for the overwhelming majority of virtual hosting and cloud resources, recovery slow.
- Attacker.
- Not named in Beget’s posts or the 108 posts we read.
What a Hosting Outage Means for Customers
This section is our advice, not a finding from the sources. A single provider held the site, the mail, the DNS and sometimes the VPN of its customers, so one incident removed all of them at once. Customers with a second place for each of these pieces kept more options than those with everything in one account.
- Keep backups elsewhereStore a full copy of files, databases and mail outside the provider and outside the same login, and test a restore.
- Separate DNS and registrarRegister the domain at one company and host its DNS at another, so you can repoint a site while the host is down.
- Have a standbyKeep a minimal static page or a second host ready, and a short customer notice that does not depend on the failed mail system.
- Check the contractRead what the provider owes you if it invokes force majeure, and who holds the backups.
- Reduce shared credentialsDo not reuse hosting-panel passwords elsewhere; see our entry on data exfiltration for why stolen access matters.
If the attack proves to be destructive, a wiper would make off-site, immutable copies the only reliable way back. We do not know which kind of attack this was, and Beget has not said.
What Is Still Unknown
The entry point, the attacker, the real number of affected sites and the date of full recovery are not stated in the posts we read. We will not name customer sites or individuals, and we recommend that customers wait for Beget’s own notices before acting on channel rumours.