Beget, a major Russian web host, lost data across its cloud after a wiper attack, and only about half of one customer group will get backups back. Here is the lesson.
A Russian web hosting company called Beget is rebuilding its cloud from scratch after an attacker wiped its servers. The break-in happened on the night of November 1. More than a week later, recovery is still under way, and some customers will not get all of their data back.
The attacker got into the management systems that control Beget's entire setup. From there, the attacker ran malware that erased server data. This kind of program is called a wiper. It exists to destroy data, not to steal it.
Beget spotted the attack shortly after the malware started. It disconnected all servers from the network to keep the damage from spreading.
Beget said all data in its cloud was lost. That includes virtual private servers (VPS), which are rented slices of a computer that many businesses use to run websites and apps. It also includes file storage, a tool for running apps called Kubernetes, and settings for a content delivery network (CDN) and IP addresses.
Beget said plainly that it is impossible to recover all data. Even where a backup exists, matching it to the right customer is what the company calls technically complex.
Beget serves more than 200,000 customers, including online stores, media outlets and educational services. As of the latest update, 60% of shared hosting and 40% of the dedicated servers it manages have been restored.
Roughly 1,000 servers need manual checks for weak points and hidden scripts before they can go back online. Beget is treating every part of its system as possibly infected.
Beget said its investigation found no sign that the attacker tried to download or change data. The attack appears to have aimed only at destruction. The company has told police and government agencies and is working with cybersecurity firms. The material does not say who is behind the attack, how the attacker got in, or when recovery will be finished.
If your website or files live with one provider, keep a copy somewhere else. That means a different company or a drive you control. Then try restoring from that copy now and then, so you know it works.
Keep a backup of your website and files outside your hosting provider, because one attack there can erase both the original and its copies.
Vanderbilt University is responding to a cyberattack. A ransomware gang says it locked the school's databases and stole data, including over 1 million Social Security numbers.
Read more: Hackers claim they locked Vanderbilt University's systems and stole dataMastercard says AI payments, cybersecurity and digital assets are its new growth areas, which could change how you pay and how safe it feels.
Read more: Mastercard sees growth in AI payments and cybersecurityDeputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officers
