Back to Feed
RansomwareNov 13, 2026

Ransomware attack on Belarusian cloud firm disrupts businesses for days

Belarusian cloud provider ActiveCloud hit by ransomware, disrupting services for days.

Belarusian cloud services provider ActiveCloud experienced a ransomware attack that encrypted parts of its cloud infrastructure, disrupting services for several days. While main services have been restored, some individual customer issues persist. The company stated there is no evidence of customer data theft and has not identified the attackers or their entry method. This incident follows similar attacks on hosting providers in neighboring Russia.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run ActiveCloud?

Get an email when a new story names ActiveCloud, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

A ransomware attack on Belarusian cloud provider ActiveCloud encrypted portions of its shared infrastructure, cascading disruption across multiple business customers simultaneously — illustrating the amplified blast radius when a hosting provider is compromised. The company could not identify the attackers or their initial access vector, suggesting insufficient logging and monitoring to support post-incident forensics. Recovery took several days and some customer issues persisted even after main services were restored, pointing to gaps in tested backup and recovery procedures. When a cloud provider is the victim, every tenant becomes an indirect victim, making provider-level resilience a critical concern for any business that outsources infrastructure.

What helps against this

How we list vendors

Entities

ActiveCloud (vendor)ESTT (vendor)Beget (vendor)