Web Hosting Ransomware: What Three Host Attacks Teach Site Owners About Backups
Web hosting ransomware used to be a story about one customer's server. In the first half of November 2026 it became a story about the host itself. Three hosting providers, Beget and ESTT in Russia and ActiveCloud in Belarus, were hit within about ten days. Thousands of websites, mailboxes and virtual servers went dark, and at one of them, backups were lost too. You do not need to host in that…
Web hosting ransomware has evolved from targeting individual customers' servers to impacting the hosting providers themselves. In late November 2026, three Russian and Belarusian hosting companies - Beget, ESTT, and ActiveCloud - were simultaneously targeted. Thousands of websites, email accounts, and virtual servers went offline, with some providers losing critical data backups.
This raises an important question for all site owners: if your host is the one under attack, what do you still control? The attacks on these companies involved infiltrating the management systems, which led to the deletion of data and disruption of services. Despite efforts to restore services, some backups were also lost or inaccessible.
Site owners should focus on where their backups are stored and ensure they have an off-host copy they control. Regularly testing backups and having a restoration plan in place are crucial steps in mitigating the impact of such attacks. It's also essential to understand what your hosting provider handles versus what you need to manage yourself and to consider implementing multi-factor authentication for host admin accounts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.