GoDaddy hack causes data breach affecting 1.2 million customers

In a data breach notification published today, GoDaddy said that the data of up to 1.2 million of its customers was exposed after hackers gained access to the company’s Managed WordPress hosting environment.

The incident was discovered by GoDaddy last Wednesday, on November 17, but the attackers had access to its network and the data contained on the breached systems since at least September 6, 2021.

“We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement,” said Demetrius Comes, GoDaddy’s Chief Information Security Officer.

“Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.

“Our investigation is ongoing and we are contacting all impacted customers directly with specific details. Customers can also contact us via our help center (https://www.godaddy.com/help) which includes phone numbers based on country.”

The attackers were able to access the following GoDaddy customer information using the compromised password:

• Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed. The exposure of email addresses presents risk of phishing attacks.
• The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, we reset those passwords.
• For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.
• For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.

The company also disclosed a breach last year, in May, when it alerted some of its customers that an unauthorized party used their web hosting account credentials in October to connect to their hosting account via SSH.

GoDaddy’s security team discovered that incident after spotting an altered SSH file in GoDaddy’s hosting environment and suspicious activity on a subset of GoDaddy’s servers.

In 2019, scammers also used hundreds of compromised GoDaddy accounts to create 15,000 subdomains, attempting to impersonate popular websites and redirect potential victims to spam pages pushing snake oil products.

Earlier in 2019, GoDaddy was found to inject JavaScript into US customers’ sites without their knowledge, thus potentially rendering them inoperable or impacting their overall performance.

GoDaddy is one of the world’s largest domain registrars and a web hosting company providing services to more than 20 million customers worldwide.