ActiveCloud, a Belarusian cloud and hosting provider, says it has restored its main customer services after a ransomware attack that started in the early hours of 10 November 2026. The attackers encrypted parts of its cloud infrastructure. The outage took down corporate websites, email and virtual servers for businesses in Belarus and Russia, and lasted several days. On 13 November the company said "the most challenging phase is behind us", The Record reports. Work is still under way on account access, support systems and customer interfaces. ActiveCloud says its own check found no sign that customer data was stolen. It has not named the attackers, said how they got in, or said whether it received a ransom demand.
What Happened
Smartpress and CyberNetSec.io both say the attack began at about 3:30 a.m. local time on Tuesday, 10 November. That morning ActiveCloud's website, phone line, online chat and support-ticket system all went down, along with customer-facing services. The company first called it a "massive cyberattack". On 11 November it confirmed that ransomware had been used.
Reports name slightly different sets of affected products:
- Zerkalo (as cited by AlCybr) and The Record list the E-Cloud hosting platform, E-Cloud Protected and the SmartMail corporate email service. Zerkalo also lists SelfMail.
- Prodelo, reporting early in the incident, named E-Cloud, a service called "ECP" and SmartMail.
- Smartpress, on 11 November, said SmartMail was back after overnight work but that E-Cloud, ECP and SelfMail were still down.
"ECP" probably refers to E-Cloud Protected, but ActiveCloud has not confirmed this in any statement quoted in the coverage.
Recovery happened in stages, and reports differ slightly on the dates:
- 11 November: Dev.by and Smartpress reported that SmartMail was available again, with ActiveCloud warning of possible short interruptions. The Record says key parts of the infrastructure were restored by Wednesday (11 November). CyberNetSec.io puts that milestone on 12 November.
- Morning of 12 November: According to the company update cited by Zerkalo, most E-Cloud virtual machines were running again. Some still would not start because their disk boot areas had been damaged.
- 13 November: ActiveCloud said its main services were restored. A notice on its website now says all customer services are back, although work on customer interfaces continues. The company said full recovery took longer than it first expected.
Known downstream victims include the Belarusian news site Smartpress, whose website runs on ActiveCloud and was disrupted, though the outlet kept publishing. Local media cited by The Record also reported temporary outages of Domino's Pizza Belarus's website and mobile app linked to technical problems. ActiveCloud has not said how many customers were affected.
During the outage, customers could not restore their own data from backups, according to Zerkalo and Smartpress.
What Was Taken
As far as anyone has disclosed, nothing. ActiveCloud's position has shifted slightly over the week:
- Early in the incident, Prodelo reported the company was still checking whether customer data had been affected and would report back.
- By 11 November, Smartpress quoted the company as saying its check "confirmed that no leak of customer data occurred".
- By 13 November, The Record described the finding more cautiously: the investigation had found no evidence that customer data was stolen.
"No evidence found" is a weaker claim than "confirmed no leak", and investigations this early are often revised. ActiveCloud has not published a forensic report or named an outside incident response firm. No ransomware group has been publicly linked to the attack, and no leak-site claim has been reported. Smartpress notes that the company has not said whether the attackers made any demands. CyberNetSec.io points out that ransomware crews hitting hosting providers often steal data as well as encrypt it, so they can extort victims twice. That is a general pattern, not evidence that data was taken here. Customers should keep watching for a later claim.
Why It Matters
One provider, many victims. The attackers did not need to breach Smartpress, Domino's Belarus or any other customer. Breaking into one provider was enough to take all of them offline. When a ransomware crew hits a hosting company, the provider's recovery speed becomes every customer's recovery speed.
Backups held by the provider didn't help customers. Customers could not restore from backups during the outage, and some virtual machines had damaged boot areas even after the main systems came back. That is the scenario provider backups are meant to cover, and they did not give customers a quick way out. Organisations that relied only on ActiveCloud's own backup tools had nothing to fall back on for days.
Support went down too. ActiveCloud's phone line, chats and ticket system were also hit, so customers lost the channel they would normally use to find out when their systems would return.
This fits a regional pattern. The Record says this is the latest in a string of cyberattacks on hosting providers in Belarus and Russia in recent weeks. Organisations relying on providers in the region should expect more incidents like this one.
The Attack Technique
The intrusion method has not been disclosed. ActiveCloud has said only that attackers breached its systems and encrypted parts of its cloud infrastructure. It has not said how they first got in, which ransomware strain was used, or how long they were inside before encryption started.
Some things can be inferred from the damage. Encryption hit hosting platforms, email services, the company's website and its support systems at once. That suggests the attackers reached systems used to manage the infrastructure as a whole, not just individual customer machines. The damaged boot areas on some virtual machines point to attacks on the virtualisation layer or on the disks themselves. This would fit ransomware aimed at hypervisors, which has become common, but it has not been confirmed for this incident. The fact that customers could not restore their own backups suggests the backup systems were either affected or deliberately taken offline as a precaution.
What Organizations Should Do
- Keep your own backups somewhere else. Store regular copies of critical virtual machines, databases and mailboxes with a second provider or offline. Assume your hosting company's backup tools will be unavailable at the moment you need them most.
- Plan for your provider going down. Document how to bring key websites, apps and email back up on other infrastructure. Run the plan at least once a year and time it.
- Make email continuity a priority. Keep a backup mail route, such as secondary MX records or a standby provider, plus a way to reach staff and customers that does not depend on your main provider.
- Ask your providers hard questions. Find out how their management and backup systems are separated from production, how they protect hypervisor access, and how they will contact you if their own support channels are down.
- Treat "no data stolen" as provisional. If your data was hosted on ActiveCloud, watch for ransomware leak-site claims and reset any passwords, API keys or tokens stored on affected systems.
- Check restored machines before trusting them. Confirm that rebuilt virtual machines boot cleanly, that their data is intact, and that they contain no unfamiliar accounts, scheduled tasks or remote-access tools before putting them back into production.
Sources: Ransomware & Extortion · Cyber Security · AlCybr | Ransomware attack on Belarusian cloud firm disrupts businesses for... | Была ли утечка данных? ActiveCloud назвал причину масштабного сбоя | Ransomware Incursion Against ActiveCloud Signals Growing Volatility... | ActiveCloud сообщает о сбое и проверяет возможную утечку данных кли... | ActiveCloud reports service restoration after ransomware disruption... | Belarusian Cloud Provider ActiveCloud Hit by Disr... - CyberNetSec.io | Ransomware sparaliżował białoruskiego dostawcę chmury ActiveCloud n...