Tag Archives: Breach

GoDaddy data breach overview: 

• Who: GoDaddy has revealed that it suffered a multiyear data breach that the hosting company is linking back to previous data breach disclosures in March 2020 and November 2021. 
• Why: GoDaddy is attributing the data breach to a multiyear campaign conducted by bad actors they believe are intentionally targeting hosting services. 
• Where: Consumers nationwide use GoDaddy. 

GoDaddy has revealed it suffered a multiyear data breach in which unknown hackers stole source code and installed malware on the company’s servers. 

The hosting company has attributed the security incident to a breach of its cPanel shared hosting environment by a “sophisticated and organized group targeting hosting services like…

GoDaddy also faced security events from 2020 to 2022, which it shared were carried out by the same attacker.
| Photo Credit: Special Arrangement

An unauthorised third party gained access to GoDaddy, a web host, domain registrar and website building platform’s, servers in its cPanel shared hosting environment and installed malware causing intermittent redirection of customer websites, the platform shared in a blog post.

The breach was first discovered in December 2022 after the platform investigated customer complaints about their sites being used to redirect to random domains.

The company claims that a sophisticated threat actor group, among other things, installed malware on its systems and obtained pieces of code related to some services in the Dec. 2022 attack.

The company also…

An unknown threat actor has been sitting in GoDaddy’s systems for years, installing malware, stealing source code, and attacking the company’s customers, the web hosting giant confirmed in an SEC filing late last week. 

Per the filing (opens in new tab) (via BleepingComputer (opens in new tab)), the attackers breached GoDaddy’s cPanel shared hosting environment and used that as a launch pad for further attacks. The company described the hackers as a “sophisticated threat actor group”.

The company believes a “sophisticated and organised” group targeting hosting services was responsible for the attack.

GoDaddy is one of the largest domain registrars and web hosting services in the world, with more than 20 million customers worldwide.

The firm said some customers complained about websites being intermittently redirected in early December 2022.

Upon investigation, the company found the issue was affecting random websites hosted on GoDaddy’s cPanel shared hosting servers.

GoDaddy found that an unauthorised third party had gained access to its servers in the cPanel shared hosting environment, and had also installed malware causing the intermittent redirection.

As is standard, the company remediated the situation and implemented new security measures.

While it discovered…