GoDaddy data breach has affect 1.2 million customers
On 22nd November 2021 GoDaddy published a data breach notification stating that 1.2 million customer data was exposed after threat actors hacked the company’s Managed WordPress hosting environment.
“On November 17, 2021, we discovered unauthorized third-party access to our Managed WordPress hosting environment. We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement. Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.” Said Demetrius Comes, GoDaddy’s Chief Information Security Officer.
There CISO further mention that it’s believed that the threat attackers had gain access to since 6th September 2021. Threat Actors were able to gain access to the following customer information using the compromised password:
- Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed. The exposure of email addresses presents risk of phishing attacks.
- The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, we reset those passwords.
- For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.
- For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.
All the impact customers are notified, and the investigations are still ongoing. “Our investigation is ongoing, and we are contacting all impacted customers directly with specific details. Customers can also contact us via our help center (https://www.godaddy.com/help) which includes phone numbers based on country.”
However, this is not the first time GoDaddy suffered from a data breach. In May 2020 it was reported that an unauthorized Party is using web hosting accounting of compromised users in October 2019 to connect to their hosting account via SSH.
Reference
