For years, the domain registrar and Web hosting company GoDaddy has experienced a cyber barrage of extraordinary scale, it has confirmed — affecting both the company and its many individual and enterprise clients.
As described in its 10K filing for 2022, released Feb. 16, the company has been breached once every year since 2020 by the same set of cyberattackers, with the latest occurring just last December. It’s worth also mentioning that the company has been the subject of earlier cyber incursions as well. The consequences to GoDaddy are one thing, but, more notably, the breaches have led to data compromises for more than 1 million of the company’s users.
That may well be the key to why the bad guys keep coming back. Because of the nature of its business, GoDaddy is a connecting link to millions of businesses around the world. As Brad Hong, customer success lead at Horizon3ai puts it: “This is the equivalent of your landlord’s office being left unlocked, giving a bad actor access to the keys to your house.”
GoDaddy’s Three-Headed Breach
While the world was coming to grips with COVID-19, thousands of GoDaddy customers had a second problem on their hands. In March 2020, the company discovered that an attacker had compromised the login details for a small number of their employees, as well as 28,000 of their hosting customers.
It was a harbinger of worse things to come.
In November 2021, a threat actor got their hands on a password that allowed them access to Managed WordPress, GoDaddy’s hosting platform for building and managing WordPress sites. This case touched 1.2 million Managed WordPress customers.
There was yet more. In a statement published alongside its 10K, GoDaddy shared details of yet a third compromise.
“In early December 2022, we started receiving a small number of customer complaints about their websites being intermittently redirected,” the company said. It turned out that an attacker had breached and planted malware on the company’s hosting servers for cPanel, a control panel program for Web hosts. This malware intermittently redirected users from the websites they intended to visit, to malicious sites.
In their statement, the company claimed to “have evidence, and law…