The attack disrupted hundreds of thousands of websites, with Beget noting that potential access disruption concerns nearly 500,000 Russian websites hosted on its platform. While this figure represents the potential reach of the disruption rather than a confirmed total outage, local media reports indicate that services for businesses, government agencies, and research institutions were affected. Notable impacted resources included the official website of the Naryan-Mar city administration and the state digital product labeling system “Chestny Znak.” Users across Moscow, St. Petersburg, and other regions reported connection errors, such as 502 Bad Gateway messages, and an inability to access control panels or email services.
Beget stated that file-level backups remain intact for the vast majority of resources, offering a potential path for data recovery. However, the company lost all binary backups for its virtual servers. Restoring services is a slow, manual process; the company must individually inspect more than 1,000 servers to remove malicious files and check data integrity before bringing them back online. Dedicated servers managed directly by customers have already been restored, and some shared hosting websites were back online by Wednesday, but a significant portion of services remains offline.
The provider emphasized that it has no specific timeline for full restoration, stating that the process will take a “considerable amount of time.” Beget advised affected users to completely change their passwords and access keys as a precaution. This incident adds to a growing list of cyberattacks and physical strikes on Russian digital infrastructure. In October, hackers exploited a vulnerability in FirstVDS to steal customer credentials, and Ukrainian drones recently struck data centers operated by Yandex, Sberbank, and VK, forcing facilities offline and prompting discussions about moving data centers underground.
As of the latest updates, Beget engineers are continuing to assess the impact of the attack. The company has not disclosed which entity is responsible for the breach, nor has it released further details on the specific vulnerabilities exploited. Full service restoration remains pending the completion of manual inspections and data recovery efforts across the compromised infrastructure.
