GoDaddy connects a slew of past attacks to a multi-year hacking campaign

Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.

The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.

“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.

None of these incidents or other cyberattacks has amounted to any material adverse impact to GoDaddy’s business or operations, the company said.

Earlier attacks in the alleged chain

In the SEC filing, GoDaddy also detailed a March 2020 attack where “a threat actor compromised the hosting login credentials of over 28,000 hosting customers to their hosting accounts as well as the login credentials of a small number of GoDaddy personnel.”

However, the company said, none of the customers’ access to the main GoDaddy account was compromised.

“We have spent resources investigating and responding to this activity, notified the impacted customers, reported the activity to applicable regulatory authorities, and are responding to requests for information regarding our data privacy and security practices,” the company said in the filing, adding that the filing indicating the timing of resolution and the outcome of the matter remained uncertain.

Another attack in the chain included a November 2021 incident wherein an unauthorized third party used compromised credentials to access the provisioning system in GoDaddy’s code base for Managed WordPress (MWP). The attack affected up to 1.2 million active and inactive MWP customers across multiple GoDaddy brands.

GoDaddy added that it reported the incident to applicable authorities and responded to user, partner and media inquiries, howbeit, with no certainty on the outcome and timing of resolution on the matter.

The company expressed that such cybersecurity incidents could expose the brand to litigation and possible liability and subject it to regulatory or other government inquiries and investigations, attracting significant capital expenditure to remediate the breach.

In other recent developments, GoDaddy laid off 8% of their employees citing ‘increasingly challenging macroeconomic conditions’ despite reporting a 7.2% year-on-year jump in revenue to a total of $4.1 billion in the fourth quarter of 2022.