GoDaddy breach exposes 1.2 million customer accounts

Data Breach
(Image credit: Shutterstock)
Audio player loading…

The domain registrar (opens in new tab) and web hosting (opens in new tab) company GoDaddy (opens in new tab) has revealed that it suffered a data breach in which the user data of 1.2m of its customers may have been accessed.

In a filing with with Securities and Exchange Commission (SEC (opens in new tab)), the company's chief information security officer Demetrius Comes explained that an “unauthorized third party” had gained access to its managed WordPress (opens in new tab) hosting environment.

For those unfamiliar, WordPress is a content management system (CMS (opens in new tab)) used by millions of site owners worldwide to set up blogs and websites and like other hosting providers, GoDaddy offers WordPress hosting (opens in new tab) in addition to shared hosting (opens in new tab), VPS hosting (opens in new tab), dedicated servers (opens in new tab) and more.

According to GoDaddy, the unauthorized person gained access to its systems around September 6 by using a compromised password. However, it wasn't until last week on November 17 that the company discovered the breach.

Compromised user accounts

GoDaddy's SEC filing (opens in new tab) says that the breach affects 1.2m active and inactive managed WordPress users who had their email addresses as well as their customer numbers exposed.

The company also said that the original WordPress admin password (opens in new tab), which was created when WordPress was first installed was also exposed. With this password in hand, an attacker can access a customer's WordPress server.

GoDaddy also revealed that active customers had their sFTP credentials and the usernames and passwords for their WordPress databases, that are used to store all of their content, exposed in the breach. However, in some cases, customer's SSL private keys were exposed and if abused, this key could allow an attacker to impersonate a customer's website or other services. While GoDaddy has reset customer WordPress passwords and private keys, it is currently in the process of issuing them new SSL certificates (opens in new tab).

We'll likely hear more regarding the details of this data breach after GoDaddy finishes conducting a full investigation into the matter.

We've also featured the best data loss prevention (opens in new tab) services and best database software (opens in new tab)

Via TechCrunch (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.