ESTT Restores Cloud After Ransomware Attack: VPS and Control Panel Back Online

⚡ The 5-Second Summary

• On November 13, ESTT closed out the incident: the SmartCore panel, VPS, and payments are fully operational again with no restrictions.
• The outage began on November 8, 2026 — according to the company's preliminary assessment, the cloud was taken down by ransomware.
• Customers' physical servers survived; the company has not disclosed what security measures it will implement.

🔍 What Happened

On November 8, 2026, hosting provider ESTT announced a serious outage in its IT infrastructure. According to the company's preliminary assessment, the cause was a cyberattack involving ransomware. Virtualization clusters and cloud management systems went down — and customer services went down with them. Customers' dedicated physical servers were unaffected and kept running normally; the company wrote about this in a post on Habr.

What followed was a week of manual rebuilding. Engineers restored virtual servers, fixed network settings, brought the control panel back online, sorted out billing issues, and simultaneously worked through a flood of support tickets. "We'd close one problem and immediately move on to the next," is how the company itself describes the process. The finish line came on Friday, November 13: the SmartCore panel is open without restrictions, financial transactions are going through, VPS configurations can be changed, and new servers can be created.

🧠 Our Take

The post was published on the exact day the incident was closed — a classic move. First a week of maintenance and silence, then "we made it through, thanks for your patience." Our assessment: the text was written with the flood of complaints in mind, which is why a single paragraph contains both "quite fair complaints" and gratitude to customers. That's more honest than the usual "scheduled maintenance completed," but there are still zero details.

For customers, the key fact is that physical servers were untouched. For the cloud, the news is worse: the ransomware reached the management systems, not just a single service. That means the question isn't "a disk failed" but how the attacker got into the control plane. As a rule, that's where the most valuable assets live — credentials, backups, billing. We believe a week of cloud downtime costs more than just reputation — it costs money: SLA credits, compensation, and manual migration for those who didn't keep copies outside the cloud.

The winners are competitors who only need to say: "that never happened to us." The losers are customers without their own backups stored outside the cloud. My bet is that some smaller customers will leave — not because of the attack itself, but because of a week of uncertainty.

⚠️ What We Don't Know

How many customers were affected, what the entry point was, whether backups survived, and whether there were any data leaks. The stated cause — "according to preliminary data" — comes with no public analysis of the attack. The company promises to "strengthen security" but names neither measures nor timelines. It's best to verify things yourself: spin up a test VPS, log into billing, and check whether snapshots and console access are in place.

Prediction: within the quarter, ESTT will release a post-mortem or a brief report on the causes — otherwise some customers will move to providers that publish such reports.

Disclaimer: Not officially confirmed: the company presents the ransomware attack as the cause of the outage only as a preliminary version; there is no independent analysis of the incident and no confirmation from third parties.

Source: Habr