Vendor incident, severity critical
Beget cloud provider hit by data wiper attack; VPS, S3 and Kubernetes data erased
Published
On the night of November 1, an attacker gained access to the management layer of Russian hosting and cloud provider Beget and deployed malware that erased server data. All data in its cloud infrastructure, including VPS, S3 and Kubernetes, plus CDN settings and IP configurations, was lost. VPS binary backups were lost entirely and file backups exist for only about half of VPS users. Beget found no evidence that the attacker downloaded or modified data, and recovery is still in progress.
What's affected
- begetevery version
Exposure window: UTC.
What to do
- Check Beget's status page and announcements for recovery progress
- Confirm with Beget whether a file backup exists for your VPS and what data was lost
- Rebuild lost CDN, IP and S3 configurations and restore from your own backups where available
- Do not assume Beget's restored servers are clean; verify them before trusting them
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident beget-wiper-attack-2026-11References
Notice beget-wiper-attack-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.