Beget Hosting Cyberattack Wipes Cloud Data and Backups
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers gained access to Beget's management systems, giving them the ability to erase data across virtual private servers, cloud storage, Kubernetes services, and binary backups in a single destructive campaign. The root failure was insufficient access control around critical management infrastructure, combined with backup systems that were reachable and destroyable by the same attacker who compromised production. This matters because hosting providers are custodians of thousands of customers' data, meaning a single breach can cascade into mass data loss at scale. The destruction of binary backups left only file-level backups, turning a recoverable incident into a prolonged, server-by-server restoration effort.
Tactical Insight
Immediate actions
- Isolate management and orchestration systems (e.g., Kubernetes control planes, hypervisor consoles) behind strict MFA and privileged access workstations.
- Verify that backup systems are stored in a separate, air-gapped or immutable environment that cannot be accessed or deleted via production credentials.
Long-term improvements
- Implement the 3-2-1-1 backup rule: three copies, two media types, one offsite, and one immutable/offline copy that is cryptographically protected from deletion.
- Apply least-privilege principles and just-in-time (JIT) access for all administrative accounts managing cloud infrastructure.
- Conduct regular red-team exercises specifically targeting management plane access to validate segmentation and detection controls.
Detection measures
- Deploy alerting on mass-deletion or bulk API calls against storage, VPS, and backup systems to catch destructive actions before they complete.
- Maintain out-of-band logging shipped to an immutable SIEM that cannot be wiped by the same credentials used in production management.