Colocation provider MIRhosting has seen the power disconnected from its equipment at an nLighten data center in the Netherlands, bringing down all of its customers.
The issues were flagged by web hosting provider AlexHost via LinkedIn, which said that on June 2 “all of our infrastructure hosted in the Netherlands went offline.”
“Upon immediate contact with MIRhosting — our colocation provider at the nLighten data center — we discovered that power had been disconnected to equipment belonging to every company colocated through them, with no prior notice or official explanation provided.”
By June 16, the company said it had successfully recovered and migrated its servers to a new data center, and thanked numerous members of the nLighten team for their help.
NLighten told DCD via email: “We are aware of investigations by the Dutch authorities into MIRhosting and other companies and individuals. nLighten has fully co-operated with these investigations and will continue to do so. nLighten is a provider of data center space and MIRhosting was a customer of nLighten leasing space for their equipment; this relationship and the associated service provision have been terminated.”
NLighten has two data centers in the Netherlands, both located in Amsterdam.
While details of the “investigation” were not provided, MIRhosting was recently in the news after Andrey Nesterenko and Youssef Zinad were arrested and more than 800 servers were seized.
According to Krebs on Security, Nesterenko operates the MIRhosting business, and Zinad had previously worked there. The raid was conducted because MIRhosting’s customer – WorkTitans, a bullet-proof hosting provider which is also controlled by Nesterenko and Zinad – was suspected of providing Internet connectivity to Stark Industries, another company that had violated sanctions law by directly or indirectly making economic resources available to EU-sanctioned entities.
According to local newspaper De Volkskrant, data showed that WorkTitans and MIRhosting were the most-used networks in pro-Russian attacks on Danish government bodies between November 13 and 19, 2025, the week of Denmark’s municipal elections.
MIRhosting posted a statement on May 22 addressing the reports: “We have taken note of the content of the publication and emphatically deny that we are playing an active role in this matter. We are fully cooperating with the competent authorities in the context of the investigation and are providing them with all necessary information.
“Due to the nature of the allegations, we have temporarily suspended our services to WorkTitans. We provide colocation services to this party. This entails that we exclusively make the physical server space, power, and network connection available in a third-party data center. The operational management of the hardware, software, and data rests entirely with the client. Consequently, we have no direct access to or visibility of the stored data and applications.”
Regarding the allegations surrounding the Danish election at the start of June, MIRhosting shared the record of its network data, in which it claims its central finding was that “in our data, the attacks came toward the customers we protect, and nothing anomalous left our network.”
The company added: “MIRhosting operates lawfully, cooperates with the authorities, and takes abuse of its network seriously. On the specific technical question that has been raised – whether these attacks originated from or were launched through our network – our own data gives a clear answer, and we are putting that data on the table.”
No further updates have been provided. DCD has contacted MIRhosting for a current status report.
More in Colocation & Wholesale
More in Security & Risk
