Hetzner account locked: what actually happens to your data

If you are reading this because your Hetzner Console shows a lock, or because an email told you the contractual relationship has ended, skip to the recovery runbook. Everyone else: this is an inventory of what Hetzner's terms allow, what has happened to other customers since 2022, and what is inside the blast radius when an account goes.

Hetzner is not the villain here. Its prices are why most of us are there, and every case below has a version at AWS, Google and every other provider. The single point of failure is not the company; it is that the server, its snapshots, its backups and its Storage Box all sit behind one login.

Locked versus terminated

Hetzner uses two distinct mechanisms, and they have very different outcomes.

A lock suspends access to a product or an account while the contract continues. Hetzner's Guideline for locked products (written for dedicated servers) lists three reasons: non-payment, abuse (phishing, malware, copyright, spam) and network problems such as attacks or scans originating from your server. The guideline says "We can only unlock the product(s) after you completely fix the issue(s)." Locks are reversible. Your data is still there.

A payment lock is the most common. The payment overview says invoices are due within ten days, after which reminders go out by email, and then Hetzner "may take one of these steps: Lock one or more of your Hetzner servers or services, Cancel your Hetzner products, Lock or delete your entire Hetzner account." Reactivation is automatic once payment arrives, with one condition: "We will only do so if we receive the payment before we issue a notice of termination." And: "You cannot revoke a notice of termination that we issue."

A verification failure happens at the start, not the end. The fraud prevention FAQ says "Incomplete and/or false information can lead to delays with the registration process, or may lead our team to reject your account," and Hetzner may ask for a copy of a government-issued ID. The risk is deploying production onto an account that is later judged not to have passed.

A termination ends the contract. Hetzner's terms and conditions allow two kinds. Section 2.6: "The contract may be terminated by either party with 30 days' notice to the end of the month, without specifying any reasons." Section 2.7: "we reserve the right to terminate the contractual relationship without notice for good cause. Such good cause is deemed to exist, among other reasons, if the Customer fails to meet its payment obligations or violates other important customer obligations."

The first clause matters more. Hetzner does not need a reason to end the relationship with 30 days' notice, and several cases below were exactly that.

What happens to data afterwards is described only for the voluntary case. The cancellation overview says: "After you have finished the cancellation, we at Hetzner will immediately delete your data." and "We cannot recover your data after you cancel the product." There is no Hetzner document that states what happens to snapshots, backups or Storage Boxes when the account is closed involuntarily. The cases answered that question empirically.

A timeline of public cases, 2022 to 2026

Each row is one factual sentence drawn from the linked thread. Where a claim is one side's account, it is attributed as such.

Two observations. First, the pattern is not "Hetzner deletes servers at random": Hetzner says Kiwix was notified a month earlier, pixeldrain had a deadline, the Russia terminations had six weeks of notice. The failure mode is a notice that was not seen, an email address that was compromised, or a decision that could not be appealed. Second, in the two cases with a tolerable ending, Kiwix and the Mastodon admin, the data that survived was stored somewhere that was not Hetzner. Everything else was gone.

What is inside the blast radius

When an account is terminated, everything billed to that account goes.

• Servers. Gone with the account. Kiwix's servers were wiped before anyone there knew.
• Backups. Bound to the server. The backups and snapshots FAQ says "Backups are bound to a single server and will automatically be deleted if you delete the server." An account closure deletes the server.
• Snapshots. The same FAQ says snapshots "remain available even if you delete the server a Snapshot was taken of." That is true inside a living account. Snapshots are still account resources with no export and no download, so when the account goes, they go. The April 2022 incident showed they can also be lost while the account is healthy.
• Volumes. Excluded from every snapshot and backup to begin with. Hetzner's volumes documentation states "we do not provide Backups or Snapshots for Volumes." A volume is only ever as safe as the account it is in; see Hetzner snapshots do not include volumes.
• Storage Box. Managed from the same Hetzner account and billed to it. It is a different product on different hardware, and it is a good, cheap backup target, but it is not outside the failure domain. The next section is about this.
• Floating IPs and primary IPs. Released; anything that hard-coded them now points at nothing or at a stranger.
• DNS. If your zones are on Hetzner DNS, they vanish with the account. If your domains are registered through Hetzner, the Mastodon admin's thread describes what comes next: "I'm fighting them to let me move my .eu domains."

What is not a copy outside the account

Three things look like off-site copies and are not.

A Storage Box. It is outside the server, which protects you against a disk failure or a bad deploy. It is inside the account, which is the failure domain this article is about. The full comparison is in Hetzner offsite backup: a Storage Box is not outside Hetzner.

A second project. Projects separate API tokens and team members. They share one account, one invoice and one snapshot quota of 30. A termination is account-wide.

A second server at Hetzner. Replication to a second VM in another location protects against a datacenter incident. Both VMs are in the same account. Kiwix had several servers; all of them went at 00:00.

A copy outside the account means a copy on infrastructure billed to someone else, or on hardware you own, reachable with credentials that do not depend on the Hetzner login.

The 30-minute exit test

Do this today, with a read-only API token, and write down the answers.

1. List every server and every volume. GET /servers and GET /volumes, paginated; the API returns 25 items per page by default. For each server with an attached volume, note that no snapshot, backup or image-level export covers that data.
2. Count snapshots against the limit. The default is 30 across the whole account. If you are near it, your retention strategy is already failing quietly.
3. Find the newest copy that is not at Hetzner. For each server, name the location and the date of the most recent copy that would survive the account. If the answer is "the Storage Box," that is a Hetzner location.
4. Confirm one of them boots. A file-level backup you have restored onto a fresh machine counts. A whole-server image you have booted under QEMU or Proxmox counts. A backup you have never restored does not.
5. Check DNS and mail. Is the registrar outside Hetzner? Are the authoritative name servers outside Hetzner? Could you point the domain somewhere else in fifteen minutes without logging into the Hetzner Console?
6. Check the account itself. Two-factor authentication on, recovery email on a domain not hosted at Hetzner, invoices paid by a method that does not expire, and at least one other person who receives the billing and abuse emails. The Discourse case started with a hijacked email address; the Kiwix case with a notice that never reached anyone.

If it has already happened

For a lock: fix, then ask. Non-payment locks release automatically on payment if no notice of termination has been issued. Abuse and network locks release after you fix the cause and submit the unlock request referencing the locking ID from the email. State plainly what the cause was, what you changed, and how you verified it. Do not argue the merits in the unlock form; that goes in a separate ticket.

For a termination: ask for time and for data, in that order. Open a ticket, quote the termination email's date and reference, and ask for two specific things: an extension of the deadline to migrate, and confirmation of whether snapshots and Storage Box contents remain accessible until that date. Ask for the date the original notice was sent and to which address; in the Kiwix case Hetzner produced the cancellation email after being asked, nine days after the servers were wiped. Be concrete about the data volume and how long it takes to move.

Realistic expectations, from the threads. The 2022 HN poster, Unredacted and the Mastodon admin were all told the decision was final. In none of the cases above did anyone report Hetzner handing over server data after a termination had taken effect. If the servers are already gone, plan as if they are not coming back, and put your energy into the recovery rather than the appeal.

DNS and mail first. Lower TTLs on anything you still control. Move the zone to a provider you can log into. Point MX records at something that accepts mail, so the password-reset emails you will need next have somewhere to land. Then rebuild from whatever copy you have.

Why this exists

This is the problem hetshield was built for. It exports a running Hetzner Cloud server as a bootable disk image, without an agent and without a reboot, by snapshotting the server, cloning the snapshot onto a throwaway machine, and streaming the disk out of Hetzner. What you receive is a file you own, on storage that has nothing to do with the account. The docs list every API call it makes and what each one costs at Hetzner.

It is worth repeating that none of this is specific to Hetzner. A developer described in July 2025 how AWS deleted a ten-year-old account and every byte in it over a missed verification deadline: "No warning. No grace period. No recovery options." The provider changes; the single account does not.