SEO news · Website security
One of Russia’s biggest hosting companies went to bed on a Sunday and woke up on Monday with a big chunk of its customers’ data gone. Backups too. Here’s what happened, what it means for your Google rankings, and the checks I’d do this week.
The news in 30 seconds
On the night of 1 to 2 November 2026, an attacker got into the systems that run Beget, a Russian hosting company with more than 200,000 customers, and ran scripts that wiped data. The data on its VPS servers, its cloud storage and a lot of the backups were lost. Beget has been under EU sanctions since July, so it shouldn’t be hosting any Irish business. But the lesson works for every host out there.
What happened, in plain English
Beget is a big hosting company based in St Petersburg. On the night of 1 to 2 November, someone got into its management layer. Think of that as the control room that runs all the servers. From there they ran scripts that wiped the data, server after server.
Beget says it has found no sign that anyone downloaded or changed customer data. It was simply deleted. Here’s what went:
- All the data on its VPS (virtual private servers, the rented servers bigger sites run on)
- All the full-disk VPS backups. The file backups only partly survived, enough for about half of VPS customers
- Its S3 cloud storage (where apps keep their files) and its Kubernetes clusters (the systems that keep apps running)
- CDN and IP settings (CDN is the network that serves a website quickly around the world)
In Beget’s own words: “Unfortunately, it is impossible to recover all data.” Ouch.
There was some good news. The backups for ordinary shared hosting survived. By 9 November about 60% of shared hosting and 40% of dedicated servers were back, and around 1,000 servers were being checked by hand for hidden malicious scripts. Beget hasn’t said how the attacker got in. It has told the police and is working with cybersecurity firms on the clean-up.
Why should an Irish business care?
Fair question. Beget has been on the EU sanctions list since 23 July 2026, so it shouldn’t be hosting any Irish business. This isn’t really about Beget.
It’s about where the backups were. They sat inside the same system as the servers they were meant to protect. So when someone got the keys to the control room, they got the backups as well. It’s like keeping your spare house key, your alarm code and your insurance papers in the same drawer. Then someone takes the drawer.
Plenty of small business websites run on hosting with “daily backups included”. That’s handy. But included where? If the only copy of your site lives with the same company, on the same account, you’re trusting one drawer too.
What it means for your Google rankings
A few hours offline won’t sink you. When Google’s crawler (the bot that reads your site) sees server errors, it slows down and comes back later.
A long outage is a different story. Google says its indexing pipeline “removes from the index URLs that persistently return a server error.” In plain English: stay down long enough and your pages drop out of Google. Then you’re rebuilding the website and the rankings.
And it’s rarely just the website. If your email is with the same host, that can go quiet too. Beget’s email was knocked out after the attack as well.
What I’d do this week
None of this is hard. Most of it is one email and a cup of tea.
- Ask your host one question: “Where are my backups stored, and could the same person who deletes my site delete them too?” If they go quiet, that’s your answer
- Keep one copy somewhere else. A separate account your host can’t touch, like Google Drive, Dropbox or Amazon S3. Most good WordPress backup plugins can send a copy there automatically
- Test a restore. Once, on a test copy, not your live site. A backup you’ve never restored is basically a wish
- Turn on two-step login for your hosting, your domain, your WordPress admin and your email. Yes, it’s annoying. So is rebuilding your site from scratch
- Clean up who has access. That freelancer from 2019? Probably time to say goodbye
- Write down where everything lives: host, domain, email and DNS. One page. Future you will say thanks
Guide SEO checklist for small businesses →The other things worth checking on your site, in plain English
Service SEO audit →We check your indexing, speed and setup and give you a clear fix list
Service Web design →Fast WordPress websites, built properly from day one
Sources
- BleepingComputer: Russian cloud firm Beget rebuilds from scratch after data wiper attack
- The Moscow Times (Russian): Beget lost its whole cloud infrastructure
- 3DNews (Russian): Beget confirms loss of customer data after the attack
- The Insider (Russian): Beget added to the EU sanctions list on 23 July 2026
- Google: How HTTP status codes affect Google’s crawlers
Frequently asked questions
What happened to Beget?
On the night of 1 to 2 November 2026 an attacker got into the systems that manage Beget’s servers and ran scripts that wiped data. VPS data, cloud storage and a lot of the backups were lost, and Beget says not all of it can be recovered.
Does the Beget hack affect Irish websites?
Very unlikely. Beget is a Russian host and has been under EU sanctions since July 2026, so it shouldn’t be hosting Irish businesses. The lesson about where your backups are kept applies to every host, though.
Are my hosting company’s backups enough?
Not on their own. They’re great for quick fixes, but if your host has a serious problem they can go down with your site. Keep at least one copy somewhere your host can’t reach, and test that you can restore it.
Will my Google rankings drop if my website goes down?
A few hours usually isn’t a problem. Google slows down and checks back later. But Google says it removes pages that keep returning server errors, so a long outage can cost you your rankings.
Not sure where your backups live?
Send us your website and we’ll go through it with you: where your backups are, who has access, and what to fix first. No judgement.