According to a disclosure it filed with the Security and Exchanged Commission (SEC) on Monday, web hosting company GoDaddy Inc said email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access.
GoDaddy’s chief information security officer Demetrius Comes said the company detected unauthorized access to its systems where it hosts and manages its customers’ WordPress servers. WordPress is a web-based content management system used by millions to set up blogs or websites. GoDaddy lets customers host their own WordPress installs on their servers.
The company says the attacker gained access to a provisioning system meant to set up and automatically configure new sites when customers create them in early September by “using a compromised password.” GoDaddy says that it noticed the intrusion on November 17th and immediately locked the attacker out before beginning an investigation and contacting law enforcement.
The hackers had access to more than just the email addresses — they could also see the original WordPress admin passwords set by the provisioner, as well as the credentials for active users’ databases and sFTP systems. The company also says that some customers had their private SSL keys exposed, which are responsible for proving that a website is who it says it is (powering the little lock icon you often see in your browser’s address bar).
According to GoDaddy, it’s working to mitigate the issues by resetting affected passwords and regenerating security certificates if needed. The company also says that it’s “contacting all impacted customers directly with specific details.” While those seem like appropriate steps, having to deal with a reset password will probably be a nuisance for some of its users.
In recent intrusions at other companies, phishing or social engineering has been to blame though there have also been instances of simply poor password security. GoDaddy itself has some pretty upsetting history with testing its employees’ cybersecurity awareness when it comes to fake emails, but attackers really only need to get lucky once to access treasure troves of data.
