How much will a cyberattack on Beget cost a business? Analysis

The main thing in the material:

- On the night of November 2, the Beget hosting provider was subjected to a large-scale cyber attack. The attackers destroyed the data in the cloud infrastructure and some of the backups.

- As of November 5, Beget has restored 60% of the virtual hosting servers and 40% of the dedicated servers managed by the provider.

- According to BI.ZONE estimates, an hour of downtime for IT systems can cost large companies up to 9.6 million rubles in the field of trade, and up to 21.7 million rubles in the field of IT and telecommunications.

- According to the conditional calculation of Izvestia, a two-day downtime of some online stores hosted on Beget may lead to a cumulative loss of margin income of about 33.5 million rubles.

- Beget has notified customers of circumstances that show signs of force majeure. However, a cyberattack does not automatically release the provider from responsibility.

- Contractual compensation for downtime and data loss is linked to the cost of the provider's services, and not to the lost revenue of customers. The amount of payments may not be comparable to the actual losses of the business.

A large-scale cyberattack on the Beget hosting provider led to the shutdown of digital services and the destruction of data in the cloud infrastructure. Hundreds of thousands of websites were hosted on the company's sites. According to industry estimates, an hour of IT system downtime can cost businesses from hundreds of thousands to tens of millions of rubles. However, compensation from the provider may not be comparable to the lost revenue and recovery costs. How much could Beget's customers lose, what digital addiction costs and who will have to pay for the consequences of the attack — in the Izvestia article.

How one Crash affected hundreds of thousands of sites

On the night of November 2, the attackers gained access to the Beget infrastructure management system and launched scripts that destroy data. The information was lost in the cloud infrastructure (VPS, S3, and Kubernetes) that companies use to host websites, applications, and data storage. The binary backups that allowed the entire virtual servers to be restored were also completely destroyed. At the same time, most of the VPS file backups have been preserved. Beget expects to provide customers with access to them through the dashboard by November 10th.

The difficulty of recovery is not only related to the amount of lost data. Before resuming operation of more than a thousand servers, Beget specialists must manually check each of them for malware and hidden vulnerabilities. The completion dates remain uncertain.

The scale of the possible consequences is determined by the position of Beget in the Russian market. According to a study by the Tenur service, in early October, the company's infrastructure hosted 334.6 thousand active sites — 14.6% of the total number of "live" resources in the .ru, .rf and .su domain zones. According to this indicator, Beget took the first place, ahead of REG.RU and Timeweb. Taking into account domains without configured sites and with expired registration, the number of hosts associated with Beget reached 617.3 thousand.

These figures do not mean that all sites hosted on the Beget infrastructure have stopped working or lost data. However, they show how widely the infrastructure of one supplier is used by Russian Internet projects. For companies whose activities depend on the operation of digital services, the main financial losses in such failures are associated with lost revenue.

Among the victims is the BelkaCar carsharing service. Its users encountered problems when using the application, for example, they could not complete the car rental. On the afternoon of November 2, the service resumed work after switching to another contractor. BelkaCar also promised to recalculate the cost of the rents that users could not complete due to the outage.

How much does it cost to stop a business

According to BI.ZONE estimates, the cost of one hour of downtime for IT systems of companies in the field of information technology and telecommunications can reach 21.7 million rubles, for retail - 9.6 million rubles, for construction and real estate — 2.7 million rubles. The total damage from one successful web attack for a large business can exceed 50 million rubles. At the same time, the restoration of critical processes can take 3-4 days, and a full return to full—time work can take several months.

These indicators relate to industry scenarios and are not an estimate of Beget's customer losses. However, they can be used to calculate the cost of prolonged downtime for a business. So, an eight-hour shutdown of critical systems of a large trading company will cost 76.8 million rubles, and a day will cost 230.4 million rubles. For an IT and telecommunications company, similar amounts reach 173.6 million and 520.8 million rubles, respectively.

For small companies, the amounts may be significantly lower. To assess the possible scale of such losses among Beget's customers, Izvestia calculated a separate scenario for online trading. The number of active sites on the provider's infrastructure is 334,562. If we assume that 1% of these resources are online stores with revenue of 50 thousand rubles per day, then with a two-day shutdown and a complete loss of sales, their total lost revenue will amount to about 334.6 million rubles. If half of the orders can be rescheduled, the figure will decrease to about 167.3 million rubles. With a notional sales margin of 20%, the estimated loss of marginal revenue will be about 33.5 million rubles.

Business losses are not limited to lost income. Companies may face additional costs for restoring IT systems and paying for the work of specialists, as well as the need to compensate customers for disrupted orders and delivery deadlines. The most serious consequences are possible if databases are lost: restoring the order history, account information, and application settings can take significantly longer than restarting the servers.

Who will pay for the consequences

Who will reimburse companies for losses caused by the failure is an open question. After the attack, Beget notified customers about the occurrence of circumstances with signs of force majeure. The Company referred to paragraph 3 of Article 401 of the Civil Code of the Russian Federation, which provides for exemption from liability for breach of obligations due to force majeure. However, the notification itself does not automatically mean that a cyberattack is recognized as force majeure. In the event of a legal dispute, it will be necessary to establish whether the circumstances met the criteria of emergency and unavoidability, as well as whether they prevented the provider from fulfilling its obligations.

As follows from the technical support responses, after restoring the control panel, customers will be able to send compensation requests. However, their size depends primarily on the cost of the services paid, and not on the financial losses of the business. According to the cloud services agreement, if the virtual server (VPS) is interrupted for more than one hour, the client is compensated for the equivalent cost of maintenance per day. It is calculated based on the length of downtime, but cannot exceed the cost of services for 30 days. A separate compensation in the amount of 30 days of service is provided for the irretrievable loss of VPS data. Similar provisions on compensation for downtime and data loss are provided for cloud databases (DBaaS).

At the same time, the agreement limits the provider's overall liability to the cost of services paid for by the client in three months. Compensation is provided in the form of service extensions or bonuses, without direct cash payments.

To estimate the possible amounts, you can use the published VPS rental rates. According to the Rating Host catalog, renting a Beget virtual server in September cost from 480 to 5640 rubles per month, depending on the configuration.

Thus, the amounts stipulated in the contract may be significantly less than the actual losses of the business. This illustrates the fundamental gap between the cost of an infrastructure service and the economic value of the operations that depend on it.

To compensate for actual losses, the client will have to submit a separate claim to the provider, and in case of refusal, apply to the court.

How much does it cost to return to work

Even after restoring access to the servers, the costs of the affected companies may continue to rise. The business needs to check the safety of the data, restore the application settings and make sure that the sites and services are working correctly. The alternative is to move to another provider, but it also requires additional costs.

According to one of the IT companies, transferring a website to another hosting or virtual server costs from 8 thousand rubles, and setting up a virtual server for a project costs from 12 thousand rubles. Thus, if the online store requires both site migration and setting up a new server, the minimum cost of these works according to published prices will be 20 thousand rubles.

However, changing the provider does not always allow you to resume work quickly. If the website, corporate mail, databases, and backups are hosted by the same provider, the failure may affect all of these services simultaneously. Then moving to another site becomes a more complex and costly process.

Storing backups from another provider and a pre-prepared recovery plan can reduce dependence on one provider. However, hosting work systems from several providers at once requires additional costs and is not justified for every business. For small sites with low downtime costs, a separate backup storage may be sufficient, while services whose continuous operation is directly related to revenue may require an entire backup infrastructure.

Additional difficulties in moving may arise for companies that require significant computing resources. According to IKS-Consulting, even before the October attacks on Russian data centers, the unmet demand for their capacity was 150-200 MW. After the damage to the data centers, the demand for backup infrastructure increased. Large cloud providers are already forced to coordinate in advance with corporate clients the volume and timing of resource allocation. At the same time, spare capacity is retained for small projects.