Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

GoDaddy Says Several Brands Hit by Recent WordPress Hosting Breach

Domain registrar and web hosting giant GoDaddy says the recently disclosed data breach impacts several of its brands, including 123Reg, Domain Factory, Heart Internet, Host Europe, Media Temple and tsoHost.

Domain registrar and web hosting giant GoDaddy says the recently disclosed data breach impacts several of its brands, including 123Reg, Domain Factory, Heart Internet, Host Europe, Media Temple and tsoHost.

GoDaddy revealed on November 22 that it had identified unauthorized access to its managed WordPress hosting environment. The incident resulted in the exposure of email addresses and customer numbers of as many as 1.2 million active and inactive Managed WordPress users.

Other information exposed in the breach included WordPress admin passwords set during provisioning, sFTP and database usernames and passwords, and SSL private keys.

GoDaddy systems were apparently first accessed by the hackers on September 6, but the intrusion was only discovered on November 17.

WordPress security company Defiant has learned that GoDaddy brands reselling Managed WordPress services are also affected by the incident. A majority of the impacted brands were acquired by GoDaddy in 2017 with the acquisition of Host Europe Group.

“The GoDaddy brands that resell GoDaddy Managed WordPress are 123Reg, Domain Factory, Heart Internet, Host Europe, Media Temple and tsoHost,” said Dan Rice, VP of corporate communications at GoDaddy. “A small number of active and inactive Managed WordPress users at those brands were impacted by the security incident. No other brands are impacted. Those brands have already contacted their respective customers with specific detail and recommended action.”

The impacted brands told customers that the hackers could have gained the ability to access their managed WordPress service and make changes to it, including altering the site and the content stored on it. They also warned that the compromised email addresses could be useful for phishing attacks.

Compromised credentials have been reset and users will not be able to edit the content on their websites until they set a new password.

Last year, GoDaddy notified customers of a data breach that may have resulted in their web hosting account credentials getting compromised.

Related: Hackers Trick GoDaddy Staff in Operation Targeting Cryptocurrency Services

Related: GoDaddy Notifies Customers of Data Breach

Related: Amazon S3 Bucket Exposed GoDaddy Server Information

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.