Web Hosting Ransomware: What Three Host Attacks Teach Site Owners About Backups

Web hosting ransomware used to be a story about one customer's server. In the first half of November 2026 it became a story about the host itself. Three hosting providers, Beget and ESTT in Russia and ActiveCloud in Belarus, were hit within about ten days. Thousands of websites, mailboxes and virtual servers went dark, and at one of them, backups were lost too.

You do not need to host in that region for this to matter. The same question applies to every site owner: if your host is the one that gets hit, what do you still control?

What happened at each host

Beget: a wiper from the management layer

Beget's own incident timeline says the attack began at about 02:00 Moscow time on 2 November, when attackers reached its management servers. Half an hour later they launched malware designed to delete data. Beget detected it at about 02:40 and disconnected all servers from the network at 02:55.

BleepingComputer, reporting on Beget's statements, says all data in Beget's cloud (VPS, S3 storage and Kubernetes) was lost, along with CDN settings and IP configurations. VPS binary backups were completely lost; VPS file backups partly survived and, by Beget's 6 November assessment, would be available for only about half of VPS users. About 1,000 servers had to be checked by hand for hidden scripts before going back online. Beget said it found no sign the attacker tried to steal data; the attack looked aimed at destruction.

Shared hosting fared better: Beget's timeline says more than 55,000 shared hosting websites had been restored from backups, but recovery took days.

ESTT: ransomware in the virtualization clusters

ESTT reported a serious incident on 8 November. According to its statement, quoted by CNews and Habr, preliminary findings pointed to ransomware that hit its virtualization clusters and cloud management systems. Customers' dedicated physical servers were not affected. ESTT said it finished restoring its cloud infrastructure on 13 November.

ActiveCloud: customer sites and email down for days

ActiveCloud said its infrastructure came under attack early on 10 November, and later confirmed ransomware had encrypted part of its cloud. The Record reports that customer websites, corporate email and virtual servers were disrupted, along with the company's own support channels. Local outlets reported that customers could not restore from backups themselves while recovery was under way, and that some virtual machines later failed to boot. ActiveCloud says it found no evidence customer data was stolen.

No one has publicly linked the three attacks or named who is behind them.

Who is affected

Directly, customers of these three providers. Indirectly, anyone whose website, store or app lives on a single provider and relies only on that provider's backups. The pattern in all three cases is the same: the attackers went after the systems that manage the whole platform, not one customer's site. When that layer falls, every site on it falls with it, and backups that the same layer can reach are at risk too.

What to check this week

1. Where your backups live. Ask your host whether backups are stored on separate infrastructure, and whether the same control panel or management system can delete them. Our website backup testing checklist walks through the questions.
2. An off-host copy you control. Keep at least one recent copy of your files and database outside your hosting provider, in an account with its own login and MFA.
3. A real restore test. A backup you have never restored is a guess. Restore to a staging server once, and time it.
4. DNS and domain access. If you can move your domain's DNS quickly, you can point visitors to a backup copy or a status page while the host recovers.
5. The split of responsibility. Know what your host handles and what you still need to check yourself, and read our ransomware preparedness guide for small business websites.

None of these steps stops an attack on your provider. They decide how long you are offline when one happens. While you are at it, a free website security scan can show what your site exposes from the outside.

The dark web angle

Attacks on providers often start with access that was bought, not built. Initial-access brokers sell logins to admin panels, VPNs and management systems on underground forums, and one set of provider credentials can reach thousands of customer sites. None of the three companies has said how the attackers got in, so we are not claiming that happened here. It is the reason provider-level admin accounts deserve MFA and tight access, and the reason your backup should not depend on them.

FAQ

Does my host's backup protect me from ransomware?

Only partly. If the attackers reach the host's management layer, backups that layer can access can be encrypted or deleted too, as Beget's lost VPS binary backups show. Keep your own copy outside the host.

Was customer data stolen in these attacks?

All three providers said they found no evidence of customer data theft. The damage reported was encryption, deletion and long outages.

How often should I test a website restore?

At least every few months, and after any major change to the site. Restore to a staging server and confirm the site and database actually work.

Originally published on the HackerMe security blog.