English
Русский
The morning of May 19 did not begin with coffee and uptime charts for some clients of THE·Hosting and UFO·Hosting. Instead, users received support replies stating that their virtual servers could not be restored and that all data had been lost permanently. The hosting industry loves the word “uptime,” but sometimes reality schedules an unsanctioned outage of its own.
The first complaints started appearing on May 18. Users reported inaccessible VPS instances, while THE·Hosting’s website and billing panel also went offline at the same time. Support later described the situation as a “technical failure” and offered affected customers replacement VPS instances in other locations along with compensation in the form of additional service time. The proposal sounded a bit like replacing lost luggage with an airport coffee voucher.
Image: krebsonsecurity.com
Complaints Spread Faster Than Support Responses
Early reports mainly came from UFO·Hosting customers using VPS infrastructure in the Netherlands. Users described lost data, delays in receiving replacement servers, and a lack of proactive notifications about the outage. One customer claimed that support acknowledged the loss of the server only after several days of correspondence and suggested ordering a VPS in another country, although the replacement had still not been activated by the time the review was published.
Similar complaints later appeared from THE·Hosting customers on Trustpilot. Users wrote that their servers went offline on May 18 and that support later confirmed the data loss. Some customers claimed backup copies disappeared alongside the VPS instances themselves. Others criticized the compensation model, where vanished infrastructure was effectively exchanged for extra days of hosting service.
By May 21, the websites and client panels of both providers became accessible again. However, the return of the billing systems did not restore customer infrastructure. Users reported that lost VPS instances still appeared as “active” in dashboards despite being unreachable. New complaints mentioned outages not only in the Netherlands, but also in Germany, the United States, and Austria. One UFO·Hosting customer claimed to have lost 14 servers, while another said a replacement VPS deployed in Finland stopped working within hours, after which support stopped responding entirely.
Neither provider published a public technical report explaining the incident or disclosing the number of affected customers. At the time, the latest news post on THE·Hosting’s website discussed an industry award, while UFO·Hosting’s news section appeared frozen in November 2025. The internet, as it turns out, can preserve silence almost as effectively as backup systems — especially when the backups are gone too.
The Real Cause Emerged Days Later
On May 25, the story took a far more serious turn. The Fiscal Information and Investigation Service, better known as FIOD, announced that Dutch law enforcement had conducted a series of raids targeting companies connected to hosting and network infrastructure services.
Image: fiod.nl
Investigators suspect the involved parties of helping circumvent European Union sanctions and supporting operations allegedly linked to cyberattacks and disinformation campaigns in Europe. Authorities arrested a 57-year-old resident of Amsterdam and a 39-year-old entrepreneur from The Hague. According to investigators, both allegedly assisted sanctioned entities through intermediary corporate structures.
Searches were carried out in offices located in Enschede and Almere, as well as data centers in Dronten and Schiphol-Rijk. FIOD officers seized documents, laptops, phones, and more than 800 servers. After that kind of “maintenance window,” many VPS instances understandably entered an existential crisis.
Image: fiod.nl
The Story Actually Began a Year Earlier
The roots of the incident trace back to May 2025, when the European Union imposed sanctions against Stark Industries Solutions Limited. According to investigations conducted by journalists and cyber intelligence researchers, the company allegedly served as a front structure concealing the real customers of hosting provider PQ·Hosting.
Both companies have been linked to Moldovan brothers Ivan and Iurii Neculiti. Investigative reports alleged that infrastructure connected to PQ·Hosting and related entities had repeatedly been used in DDoS attacks and disinformation operations.
Following the sanctions, the business structure was rapidly reorganized. PQ·Hosting effectively disappeared from the market, while THE·Hosting and UFO·Hosting emerged shortly afterward. Investigators believe a significant portion of the infrastructure was transferred to the Dutch company WorkTitans B.V., which owns the THE·Hosting brand. According to investigators, the organization may have served as a vehicle for continuing the operations of sanctioned entities under different branding.