Major security breach impacts GoDaddy Managed WordPress clients

Hackers gained access to login and FTP credentials, along with 1.2 million email addresses.

A security breach in GoDaddy’s Managed WordPress environment gave hackers the keys to clients’ WordPress sites.

GoDaddy (NYSE: GDDY) discovered the issue the prior week and determined that the hackers started exploiting the vulnerability on September 6. Using a compromised password, the hackers accessed the provisioning system in the firm’s legacy code base for Managed WordPress. They were able to access WordPress login credentials and FTP credentials. Per the firm, here’s what was exposed:

• Up to 1.2 million active and inactive Managed WordPress clients had their email address and client number exposed. The exposure of email addresses presents risk of phishing attacks.
• The original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, we reset those passwords.
• For active clients, sFTP and database usernames and passwords were exposed. We reset both passwords.
• For a subset of active clients, the SSL private key was exposed. We are in the process of issuing and installing fresh certificates for those clients.

I have two sites on GoDaddy’s Managed WordPress platform. (Reglike is on a different hosting provider.) On November 3, I received an email that stated:

During a routine audit of our hosting environment, we found malware on your WordPress site(s). Although the detected malware was not related to GoDaddy’s hosting platform, your security is notable to us, so our team proactively removed the detected malware for you.

The email didn’t identify which site was impacted, but the package I use doesn’t include the removal of malware (that costs extra). So it’s possible that an unusually high number of sites needed malware removal, and GoDaddy did it proactively. I’m not sure that this is related to the breach, but the timing suggests it might be.