GoDaddy Security Breach Exposes 1.2 million WordPress Users' Data

GoDaddy said the incident was discovered on November 17.

GoDaddy Security Breach Exposes 1.2 million WordPress Users' Data

GoDaddy's shares fell about 1.6 percent in early trading

Highlights
  • The third-party accessed the system using a compromised password
  • The exposure of email addresses presents risk of phishing attacks
  • Up to 1.2 million Managed WordPress customers had number exposed

Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorised third-party access.

The company said the incident was discovered on November 17 and the third-party accessed the system using a compromised password.

"We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement," Chief Information Security Officer Demetrius Comes said in a filing.

The company, whose shares fell about 1.6 percent in early trading, said it had immediately blocked the unauthorised third party, and an investigation was still going on.

Here's what the company said in the filing:

On November 17, 2021, we discovered unauthorised third-party access to our Managed WordPress hosting environment. Here is the background on what happened and the steps we took, and are taking, in response:

We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement. Using a compromised password, an unauthorised third party accessed the provisioning system in our legacy code base for Managed WordPress.

Upon identifying this incident, we immediately blocked the unauthorised third party from our system. Our investigation is ongoing, but we have determined that, beginning on September 6, 2021, the unauthorised third party used the vulnerability to gain access to the following customer information:


•Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed. The exposure of email addresses presents risk of phishing attacks.

•The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, we reset those passwords.

•For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.

•For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.

Our investigation is ongoing and we are contacting all impacted customers directly with specific details. Customers can also contact us via our help centre (https://www.godaddy.com/help) which includes phone numbers based on country.

We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers' data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection.

Demetrius Comes
Chief Information Security Officer

© Thomson Reuters 2021


Can PUBG: New State rival BGMI and PUBG Mobile in the battle royale space? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Further reading: GoDaddy, WordPress
Walmart Partners With DroneUp to Start Drone Deliveries in Arkansas
PUBG: New State Getting Anti-Cheating Update on Android, With Extra Medals for Players

Related Stories

Share on Facebook Tweet Snapchat Share Reddit Comment
 
 

Advertisement

Advertisement

Advertisement

© Copyright Red Pixels Ventures Limited 2021. All rights reserved.
Listen to the latest songs, only on JioSaavn.com