GoDaddy has identified a December 2022 malware incident on its hosting servers as part of a series of attacks on the company infrastructure since 2020. Credit: GoDaddy Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.None of these incidents or other cyberattacks has amounted to any material adverse impact to GoDaddy’s business or operations, the company said. Earlier attacks in the alleged chain In the SEC filing, GoDaddy also detailed a March 2020 attack where “a threat actor compromised the hosting login credentials of over 28,000 hosting customers to their hosting accounts as well as the login credentials of a small number of GoDaddy personnel.”However, the company said, none of the customers’ access to the main GoDaddy account was compromised. “We have spent resources investigating and responding to this activity, notified the impacted customers, reported the activity to applicable regulatory authorities, and are responding to requests for information regarding our data privacy and security practices,” the company said in the filing, adding that the filing indicating the timing of resolution and the outcome of the matter remained uncertain.Another attack in the chain included a November 2021 incident wherein an unauthorized third party used compromised credentials to access the provisioning system in GoDaddy’s code base for Managed WordPress (MWP). The attack affected up to 1.2 million active and inactive MWP customers across multiple GoDaddy brands.GoDaddy added that it reported the incident to applicable authorities and responded to user, partner and media inquiries, howbeit, with no certainty on the outcome and timing of resolution on the matter.The company expressed that such cybersecurity incidents could expose the brand to litigation and possible liability and subject it to regulatory or other government inquiries and investigations, attracting significant capital expenditure to remediate the breach.In other recent developments, GoDaddy laid off 8% of their employees citing ‘increasingly challenging macroeconomic conditions’ despite reporting a 7.2% year-on-year jump in revenue to a total of $4.1 billion in the fourth quarter of 2022. Related content news Multibillion-dollar cybersecurity training market fails to fix the supply-demand imbalance Despite money pouring into programs around the world, training organizations have not managed to ensure employment for professionals, while entry-level professionals are finding it hard to land a job By Samira Sarraf Oct 02, 2023 6 mins CSO and CISO CSO and CISO CSO and CISO news Royal family’s website suffers Russia-linked cyberattack Pro-Russian hacker group KillNet took responsibility for the attack days after King Charles condemned the invasion of Ukraine. By Michael Hill Oct 02, 2023 2 mins DDoS Cyberattacks feature 10 things you should know about navigating the dark web A lot can be found in the shadows of the internet from sensitive stolen data to attack tools for sale, the dark web is a trove of risks for enterprises. Here are a few things to know and navigate safely. By Rosalyn Page Oct 02, 2023 13 mins Cybercrime Security news ShadowSyndicate Cybercrime gang has used 7 ransomware families over the past year Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations By Lucian Constantin Oct 02, 2023 4 mins Hacker Groups Ransomware Cybercrime Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe