GoDaddy Hosting Lost Passwords And SSL Keys Of 1.2 Million Users

One of the world’s largest web hosts, GoDaddy, has lost the personal information of millions of customers. Attackers succeeded in gaining access to the information of over 1.2 million users of the company’s services.

As the company said yesterday in a statement to the US Securities and Exchange Commission, suspicious activity was found on its own systems in the past week. On November 17th it was then clear what exactly had happened. According to their own analyzes, the attackers had already had access to the web host’s systems for more than two months at this point in time.

Data theft affects customers who use the provider’s WordPress hosting. In total, the more than 1.2 million data records mentioned, consisting of e-mail addresses and customer numbers, have been lost. The attackers were also able to see the first admin password, which is automatically sent after an account has been set up. If you have never changed this, you could get further problems with your website.

GoDaddy Informed Authorities

In addition, access data for FTP connections were sometimes lost, and new login information was then sent to the users. In addition, private SSL keys were sometimes lost, and in these cases, the GoDaddy admins are working to ensure that new certificates are issued to those affected and that the relevant information is sent to them.

The hoster also informed the responsible law enforcement authorities about the incident. A company that specializes in IT forensics has already been called into work through the details of the incident. This will particularly affect the question of whether the attackers have already gained access to customers’ WordPress instances, which the measures that have now been taken have not yet contained.