Godaddy’s Chief Information Security Officer, Demetrius Comes, said that the company detected unauthorized access to its systems where customer’s WordPress servers are hosted and managed.
How Did It Happen
While the incident is still under investigation, Godaddy said that the unauthorized person used a compromised password to get access to GoDaddy’s systems around September 6.
It is unclear if the compromised account was protected with two-factor authentication.
The breach was discovered more than a month later on November 17.
1.2 Million Customer Accounts Affected
1.2 million, active and inactive managed wordpress users had their email addresses and customer numbers exposed. Godaddy said that these users could face risks of phishing attacks.
The initial admin passwords created during the installation of wordpress were also exposed.
According to GoDaddy, active customers had their sFTP credentials (for file transfers), and the usernames and passwords for their WordPress databases, which store all the user’s content, exposed in the breach. In some cases, the customer’s SSL (HTTPS) private key was exposed, which if abused could allow an attacker to impersonate a customer’s website or services.
Actions Taken
GoDaddy said it reset customer WordPress passwords and private key and is in the process of issuing new SSL certificates.
GoDaddy issued a filling with Securities and Exchange Commission regarding this incident.