Update, October 2026: In its annual report for 2022, filed in February 2023, GoDaddy said it believed this breach was part of a multi-year campaign by a sophisticated threat actor group that installed malware on its systems and obtained pieces of code related to some of its services (GoDaddy 10-K). In May 2025 the FTC finalized an order requiring GoDaddy to run a comprehensive information-security program and have it reviewed by an independent assessor (FTC).
Godaddy’s Chief Information Security Officer, Demetrius Comes, said that the company detected unauthorized access to its systems where customer’s WordPress servers are hosted and managed.
How Did It Happen
While the incident is still under investigation, Godaddy said that the unauthorized person used a compromised password to get access to GoDaddy’s systems around September 6.
It is unclear if the compromised account was protected with two-factor authentication.
The breach was discovered more than a month later on November 17.
1.2 Million Customer Accounts Affected
1.2 million, active and inactive managed wordpress users had their email addresses and customer numbers exposed. Godaddy said that these users could face risks of phishing attacks.
The initial admin passwords created during the installation of wordpress were also exposed.
According to GoDaddy, active customers had their sFTP credentials (for file transfers), and the usernames and passwords for their WordPress databases, which store all the user’s content, exposed in the breach. In some cases, the customer’s SSL (HTTPS) private key was exposed, which if abused could allow an attacker to impersonate a customer’s website or services.
Actions Taken
GoDaddy said it reset customer WordPress passwords and private key and is in the process of issuing new SSL certificates.
GoDaddy issued a filling with Securities and Exchange Commission regarding this incident.