Beget says a November attack launched data-erasing malware

Beget says attackers hit its infrastructure during the night spanning November 1 and November 2, 2026. The company says that at 2:30 a.m. Moscow time on November 2, which was 7:30 p.m. AST on November 1, they started malware meant to erase data on the servers.

Beget places the start of the intrusion half an hour earlier. It says the estimated start was 2:00 a.m. Moscow time on November 2, or 7:00 p.m. AST on November 1, when the attackers reached management servers. Unauthorized access was detected at 2:40 a.m. Moscow time, 7:40 p.m. AST. At 2:55 a.m. Moscow time, 7:55 p.m. AST, the company says every server was taken off the network so the attack would not spread further.

The restore percentages on the page are tied to specific updates. A November 4 note says 35 percent of shared hosting and 15 percent of Beget-managed dedicated servers had been restored. A November 5 note, timestamped 3:00 p.m. Moscow time and 8:00 a.m. AST, says those shares were 60 percent and 40 percent. The page does not repeat those percentages in later entries, so they are not presented as the latest total.

The newest note is dated November 10. Beget says that update, at 9:30 p.m. Moscow time, or 2:30 p.m. AST, brought international domains back and opened renewal in the control panel. It says a mass restore of sites from backups has started, and that 33,000 websites have been restored. The page still heads the notice "Recovery in progress."

Earlier notes describe other services coming back. Beget says dedicated servers it does not administer were fully back on November 2, and that name servers were fully back for every domain that day. It says more than 80 percent of the mail setup was restored on November 3, with POP3, IMAP, and SMTP available. The control panel returned on November 7 with limited functions. On November 9, VPS backups could be downloaded from that panel. The company says it is still working to restore the infrastructure the attack affected.