What Happens When Your Web Host Gets Acquired

Every hosting acquisition announcement sounds the same. “Customers will continue receiving the same support and services.” “This creates long-term value for customers, partners, and employees.” “We are committed to the customer-first approach that made this company great.”

Three hosting companies said exactly those things to their Dutch customers in 2013. Weeks later, thousands of those customers’ websites were serving malware to their visitors. The three hosts had been consolidated under shared DNS infrastructure. Someone gained access to the Dutch domain registry system and redirected that infrastructure to malicious servers. Because the hosts now shared the same DNS layer, one breach hit all three simultaneously.

That’s an extreme outcome. But the pattern underneath it plays out in less dramatic ways every day: consolidation creating shared risk, customers bearing consequences they didn’t sign up for.

The Dutch Case: What Consolidation Actually Looks Like

Digitalus, Webstekker, and VDX were three separate Dutch hosting companies. Over time, through a series of acquisitions, they were brought under the same corporate roof. Their customers didn’t necessarily know this. They were still logging into separate dashboards, paying separate bills, calling separate support lines. Underneath, though, the infrastructure was being consolidated.

On August 5, 2013, security researchers at Fox-IT detected malicious redirects starting on the Dutch retail site conrad.nl and spreading rapidly. The attacker had gained access to SIDN’s DRS system, the Dutch domain registry, and substituted the nameservers for all sites hosted across the three providers with malicious ones pointing to a server running the Blackhole Exploit Kit. Every visitor to an affected site got a blank page with a hidden iframe that attempted to install malware via PDF and Java exploits. The attackers deliberately set a 24-hour TTL on every DNS response from their fake servers, maximising how long the malicious records would stay cached at ISPs.

How the attacker got into SIDN’s registry was never publicly disclosed. What was clear was the consequence of the consolidation: three providers, one shared attack surface, thousands of affected websites, and customers who had no idea any of this was coming when they signed their hosting contracts.

The story didn’t end in 2013. The brands kept changing hands. VDX and related brands were eventually absorbed by TransIP. TransIP merged with Combell in 2019 to form team.blue. Customer complaints since the acquisitions include price increases, SSL certificates not auto-renewing and taking sites offline, and websites being modified without prior notice. One Dutch reviewer in 2026 described VDX plainly as “a team.blue absorption brand for acquired customer bases.”

What Happened Next: VDX in 2026

With a 4.7/5 on Trustpilot and consistent praise for its support, VDX has found its footing under its current ownership within team.blue. Customers report fast responses and reliable uptime.

The chaos belonged to an earlier era. The DNS incident happened while these brands were being consolidated under IT-Ernity Holding, the group that absorbed Digitalus, Webstekker, and VDX in a short window without the operational capacity to manage all of them at once. Too many customers, too many moving parts, too little visibility into shared infrastructure. TransIP later acquired IT-Ernity, and through subsequent ownership the product stabilised. The brand recovered. But the window between acquisition and stable operation was where the damage happened.

That’s the broader lesson from the VDX story. Acquisitions don’t have to end badly. But the transition period, the 12 to 24 months where staff are being merged, infrastructure is being consolidated, and nobody is quite sure who’s responsible for what, is when customers are most exposed. What you sign up for and what you get can diverge significantly during that window, even if things eventually settle.

The American Version: EIG and the Art of the Roll-Up

The Dutch story has a US equivalent that’s better documented in English: Endurance International Group, now Newfold Digital.

EIG started acquiring hosting companies in the late 1990s and didn’t stop. By the time it was acquired itself by Clearlake Capital for around $3 billion in 2021 and rebranded as Newfold Digital, it owned Bluehost, HostGator, iPage, FatCow, iPower, Domain.com, A Small Orange, Site5, Arvixe, PowWeb, IX Web Hosting, and dozens of others. Each brand kept its own name, its own logo, and its own pricing page. Most customers had no idea they were all the same company.

The pattern that followed each acquisition became so predictable that “EIG acquired” became shorthand in hosting forums for “quality is about to decline.” The changes were consistent: original support teams replaced with cheaper, often offshored alternatives; servers migrated to centralised data centres in Provo, Utah regardless of where customers’ audiences were; ticket response times increasing from hours to days; outdated hardware while competitors moved to NVMe storage and faster server software. Smaller brands got folded into larger ones or quietly retired.

The sheer size of the portfolio created another problem unique to the roll-up model. Someone unhappy with their HostGator experience who switched to iPage to escape hadn’t escaped at all. They’d moved from one EIG brand to another. Without knowing who owns what, customers couldn’t make an informed decision about where to take their business.

In 2024, a security researcher found an exposed Newfold Digital server containing data on over 100,000 customers, including names, addresses, emails, and partial credit card numbers. Consolidation at scale doesn’t just create operational risk. It creates a data target.

The European Roll-Up: team.blue in 2026

team.blue is the European equivalent of the EIG model, and it’s still actively acquiring. Backed by private equity firm Hg Capital and Canada’s CPP Investments at a €4.8 billion valuation, the group now operates more than 60 brands across 22 European countries, serving 3.3 million customers. Its portfolio includes TransIP, Vimexx, Combell, Register.it, Binero in Sweden, VDX, and dozens of others. In 2025 alone it completed 11 acquisitions. Three more had already closed by March 2026.

The group is increasingly acquiring SaaS businesses rather than hosting companies, which is a strategic shift. But hosting customers of team.blue brands are still navigating what consolidation means in practice: servers that may no longer be in the country they expected, pricing that’s drifted upward since the acquisition, support infrastructure that’s been standardised across the group.

team.blue’s own 2024-25 impact report acknowledged that its emissions were rising, not falling, despite net-zero commitments. The reason given was straightforward: acquiring more data centres adds more emissions to the total you’ve promised to cut. The same honesty doesn’t always extend to customers of acquired brands.

If your host is part of team.blue, you can check: the group’s brands include TransIP, Combell, Vimexx, Register.it, Binero, VDX, and Hostnet, among others. The hosting consolidation post covers the full picture of who owns what.

2026: HostPapa’s Acquisition Spree

The acquisitions aren’t slowing down. In April 2026, HostPapa acquired two hosting companies in twelve days: Tailor Made Servers on April 17, and Hostwinds on April 29. Hostwinds had built a strong reputation over 16 years: 5-minute ticket response times, 24/7 live chat, multiple PC Magazine Editors’ Choice awards, and a loyal developer and reseller customer base. Its data centres in Seattle, Dallas, and Amsterdam added infrastructure in locations HostPapa didn’t previously have.

The press release said exactly what you’d expect: customers will continue receiving the same support and services, this creates long-term value, HostPapa is committed to Hostwinds’ customer-first approach. It may well be true. HostPapa isn’t EIG. But Hostwinds customers who care about these things should be watching their support response times, their infrastructure location, and their renewal pricing over the next 12 to 18 months, because that’s where the reality of any acquisition shows up.

What the Pattern Looks Like From the Customer Side

Across all three cases, the customer experience follows a recognisable sequence. In the first few months after an acquisition, nothing changes visibly. The same dashboard, the same support number, the same pricing. The press release language is accurate, for now. Then, typically between six months and two years in, things shift.

Support is usually the first thing to change. Either the team is restructured or headcount is cut to find the cost savings that justified the acquisition price in the first place. Ticket response times increase. Phone support disappears or gets moved to a higher tier. The people who knew the product deeply are replaced by a centralised team working from scripts.

Pricing changes come at renewal. The acquisition announcement doesn’t change your contract. But when your contract renews, the new owner sets the new price. Promises made in a press release aren’t binding on your renewal invoice. The renewal pricing guide covers how this plays out across the industry generally, but acquisitions often accelerate the timeline.

Infrastructure changes are the least visible but the most consequential. If your host’s servers move from Amsterdam to a centralised facility in the UK or US, your site’s performance for European visitors changes. If your host’s DNS infrastructure is consolidated with other acquired brands, you inherit their shared attack surface, as the 2013 Dutch case showed directly.

What to Do When Your Host Gets Acquired

The announcement is the moment to act, not the moment to wait and see. Here’s what to do immediately:

Back up everything. Before any migration happens, download a complete backup of your site files and database. Don’t rely on the host’s backup system during a transition period. Use a plugin like UpdraftPlus or your own FTP access and store a copy somewhere you control.

Screenshot your current plan and pricing. What you’re paying now, what’s included, what the renewal price is. If pricing changes post-acquisition, having this documented gives you a clear before-and-after comparison and a basis for any dispute.

Check the data residency question. If you’re on a European host and GDPR compliance depends on your data staying within the EU, find out where the new owner’s infrastructure actually is. Promises made in the announcement don’t override where the servers physically sit.

Monitor your DNS records. During infrastructure migrations, DNS misconfigurations are a common cause of brief outages. Use the DNS Lookup tool to check your records before and after any announced migration. If your nameservers change without warning, that’s worth investigating immediately.

Know your exit window. Most hosting contracts have a refund period. If quality drops noticeably in the first 30 to 90 days post-acquisition, use it. Moving a WordPress site to a new host is less painful than tolerating one that’s no longer what you signed up for.

What to Look for in a Host That Won’t Get Acquired

No host is immune to acquisition. But some structural factors make it less likely. Independent, founder-led companies with no external investors have no obvious exit path and no pressure to sell. InMotion Hosting has been founder-owned since 2001 and explicitly markets that independence as a feature. Hetzner is a family-owned German company that has never taken outside investment. Krystal Hosting in the UK is independently owned and employee-focused.

These aren’t guarantees. Founders sell. Independence ends. But they’re meaningful signals compared to hosts that are already subsidiaries of private equity-backed holding groups, where the acquisition has, in a sense, already happened.

The consolidation story isn’t slowing down. In 2026, the hosting market is more concentrated than it’s ever been. Understanding who owns your host, and what happens when that ownership changes, is as important as understanding what’s in your hosting plan.