Cybersecurity: GoDaddy’s September Breach Exposed Up to 1.2 Million Customers’ Data

GoDaddy has disclosed that the domain registrar experienced a security breach that allowed attackers access to the data of over 1 million active and inactive Managed WordPress users. Demetrius Comes, GoDaddy’s chief information security officer, stated in a filing with the Securities and Exchange Commission (SEC) that the company discovered suspicious activity in its Managed WordPress hosting environment.

According to Comes, the attacker gained access around September 6 using a “compromised password,” and the company discovered the breach last week on November 17. “Upon discovering this incident, we immediately blocked the unauthorized third party from our system,” according to the report.

“Our investigation is ongoing, but we have determined that, beginning on September 6, 2021, the unauthorized third party used the vulnerability to gain access” to customer information.

The following information was compromised as a result of the GoDaddy breach:

• 1. Up to 1.2 million active and inactive Managed WordPress customers’ email addresses and customer numbers.
• The original WordPress administrator password. GoDaddy claims to have reset the passwords.
• sFTP and database usernames and passwords were revealed and reset.
• A subset of active customers’ SSL private keys were exposed. “We are currently issuing and installing new certificates for those customers,” the company stated.

Because the company has over 20 million customers worldwide, any breach affects a large number of people. GoDaddy has yet to reveal how the unauthorized person obtained the password that resulted in the data breach.