Overview
ActiveCloud, a Belarusian cloud services provider, says hackers breached its systems and encrypted parts of its cloud infrastructure, leaving customers without key services for several days. The company first disclosed the attack on Tuesday and said on Friday that its main services were restored, though it was still resolving problems for individual customers.
What Was Affected
- E-Cloud, the main cloud hosting platform
- E-Cloud Protected, an additional security service
- SmartMail, corporate email
- Corporate websites, virtual servers and customer support channels
Businesses and organizations across Belarus were hit. News outlet Smartpress, hosted on ActiveCloud, kept publishing during the disruption. The Domino's Pizza Belarus website and app had temporary outages; local media attributed these to "technical problems" rather than explicitly to the attack.
Timeline and Status
- Tuesday: ActiveCloud discloses the attack.
- Wednesday: Key parts of the infrastructure are restored, but full recovery of customer systems is expected to take longer than planned.
- Friday: The company says main services are back. Some customers may still have trouble restoring virtual machines.
ActiveCloud said "the most challenging phase is behind us." Its investigation has found no evidence that customer data was stolen. It has not publicly identified the attackers, the ransomware family, or the initial access method, and no ransom details were reported.
Part of a Regional Pattern
Two other regional cloud and hosting providers were hit in recent days, with no confirmed link to ActiveCloud:
- ESTT (Russia): ransomware on November 8 disrupted its cloud infrastructure, with no evidence of customer data theft.
- Beget (Russia): a destructive attack wiped data from parts of its cloud environment and led to lost virtual server backups.
Takeaways for Customers of Hosting Providers
- Keep offline or off-provider backups of VMs and critical data. Provider-side backups can be encrypted or wiped along with production.
- Know your fallback for email and DNS if a single provider goes down.
- Ask your provider for an incident timeline and a data-theft assessment in writing, and rotate credentials stored on affected platforms if theft cannot be ruled out.