GoDaddy WordPress data breach: A timeline

Security incidents affecting WordPress have been of notable prevalence in recent years as more companies rely on the hugely popular content management system to power their websites. The latest organizations to fall foul of WordPress security vulnerabilities is domain registrar GoDaddy, which recently went public on unauthorized third-party access to its Managed WordPress hosting environment, impacting up to 1.2 million active and inactive customers.

Here is a timeline of the incident featuring detail and insight from the company and experts across the field.

GoDaddy WordPress data breach timeline

November 17, 2021: GoDaddy discovers unauthorized third-party access on Managed WordPress

In a Securities and Exchange Commission (SEC) filing, Demetrius Comes, GoDaddy’s CISO, announced that the organization had discovered unauthorized access to its Managed WordPress servers. GoDaddy determined that the incident began on September 6, 2021, and exposed data on 1.2 million active and inactive Managed WordPress customers. “We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement,” Comes said. “Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.”

November 22, 2021: GoDaddy announces data breach 

GoDaddy reveals the breach in the above-mentioned SEC filing and announced that it had blocked the unauthorized third party from is systems. While the investigation continues, GoDaddy determined the third party had exploited a vulnerability to access the following customer information:

• Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed, presenting a risk of phishing attacks
• The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, GoDaddy reset those passwords
• For active customers, sFTP and database usernames and passwords were exposed. GoDaddy reset both passwords
• For a subset of active customers, the SSL private key was exposed. GoDaddy was in the process of issuing and installing new certificates for those customers

“We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection,” said Comes.

November 23, 2021: Cybersecurity industry reacts, and Managed WordPress resellers revealed to be impacted

In the wake of GoDaddy’s data breach announcement, experts in the cybersecurity field shared reactions and insight around the incident, GoDaddy’s response, and the wider implications for organizations and users.

“Perhaps one of the most surprising revelations to come out of the GoDaddy breach is the delay between the initial attack and the company’s discovery of the breach over a month later,” said Dominic Trott, UK manager at Orange Cyberdefense. “A lack of round-the-clock threat detection and response activity will inevitably leave critical assets such as customer data at much greater risk of exploitation, exposing GoDaddy to both reputational and financial damage. In this case, 1.2 million email addresses and account passwords were breached, leaving customers vulnerable to the threat of phishing that could put them, their personal devices, and finances at risk.”

Digital cryptography expert and Sectigo CTO Nick France said breaches of this nature in which large amounts of private keys are compromised ultimately lead to events where the compromised certificates all need to be revoked in a very short space of time. “The impact this can have on businesses reliant on those certificates can be significant—especially on holiday weeks such as this.”

Indeed, a breach of this size is particularly dangerous around the holidays, added Ed Williams, director, Trustwave SpiderLabs. “Hackers try to take advantage of every new email address and password exposed in an attempt to launch phishing attacks and social engineering schemes.”

Wordfence confirmed that at least six resellers of GoDaddy Managed WordPress were also affected by the breach: tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe. GoDaddy said that only a small number of reseller customers were affected.