Domain registrar GoDaddy recently announced a data breach impacting 1.2 million customers via its Managed WordPress hosting environment. Here's how the breach is unfolding. Credit: Hernan4429 / Getty Images Security incidents affecting WordPress have been of notable prevalence in recent years as more companies rely on the hugely popular content management system to power their websites. The latest organizations to fall foul of WordPress security vulnerabilities is domain registrar GoDaddy, which recently went public on unauthorized third-party access to its Managed WordPress hosting environment, impacting up to 1.2 million active and inactive customers.Here is a timeline of the incident featuring detail and insight from the company and experts across the field.GoDaddy WordPress data breach timelineNovember 17, 2021: GoDaddy discovers unauthorized third-party access on Managed WordPressIn a Securities and Exchange Commission (SEC) filing, Demetrius Comes, GoDaddy’s CISO, announced that the organization had discovered unauthorized access to its Managed WordPress servers. GoDaddy determined that the incident began on September 6, 2021, and exposed data on 1.2 million active and inactive Managed WordPress customers. “We identified suspicious activity in our Managed WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and contacted law enforcement,” Comes said. “Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.” November 22, 2021: GoDaddy announces data breach GoDaddy reveals the breach in the above-mentioned SEC filing and announced that it had blocked the unauthorized third party from is systems. While the investigation continues, GoDaddy determined the third party had exploited a vulnerability to access the following customer information: Up to 1.2 million active and inactive Managed WordPress customers had their email address and customer number exposed, presenting a risk of phishing attacksThe original WordPress Admin password that was set at the time of provisioning was exposed. If those credentials were still in use, GoDaddy reset those passwordsFor active customers, sFTP and database usernames and passwords were exposed. GoDaddy reset both passwordsFor a subset of active customers, the SSL private key was exposed. GoDaddy was in the process of issuing and installing new certificates for those customers“We are sincerely sorry for this incident and the concern it causes for our customers. We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection,” said Comes.November 23, 2021: Cybersecurity industry reacts, and Managed WordPress resellers revealed to be impactedIn the wake of GoDaddy’s data breach announcement, experts in the cybersecurity field shared reactions and insight around the incident, GoDaddy’s response, and the wider implications for organizations and users. “Perhaps one of the most surprising revelations to come out of the GoDaddy breach is the delay between the initial attack and the company’s discovery of the breach over a month later,” said Dominic Trott, UK manager at Orange Cyberdefense. “A lack of round-the-clock threat detection and response activity will inevitably leave critical assets such as customer data at much greater risk of exploitation, exposing GoDaddy to both reputational and financial damage. In this case, 1.2 million email addresses and account passwords were breached, leaving customers vulnerable to the threat of phishing that could put them, their personal devices, and finances at risk.”Digital cryptography expert and Sectigo CTO Nick France said breaches of this nature in which large amounts of private keys are compromised ultimately lead to events where the compromised certificates all need to be revoked in a very short space of time. “The impact this can have on businesses reliant on those certificates can be significant—especially on holiday weeks such as this.”Indeed, a breach of this size is particularly dangerous around the holidays, added Ed Williams, director, Trustwave SpiderLabs. “Hackers try to take advantage of every new email address and password exposed in an attempt to launch phishing attacks and social engineering schemes.”Wordfence confirmed that at least six resellers of GoDaddy Managed WordPress were also affected by the breach: tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe. GoDaddy said that only a small number of reseller customers were affected. Related content news F5 patches BIG-IP Next Central Manager flaws that could lead to device takeover Two high-risk vulnerabilities could allow attackers to gain full administrative control on devices via leaked password hashes. By Lucian Constantin May 08, 2024 5 mins Threat and Vulnerability Management Cloud Security Vulnerabilities news Suspected Chinese hack of Britain’s Ministry of Defence linked to contractor, minister confirms The UK’s defence minister would not confirm that the attack was conducted by an element of the Chinese state, rather blaming the “potential failings” of a partner. By John Dunn May 08, 2024 4 mins Aerospace and Defense Industry Data Breach Government news analysis Massive security hole in VPNs shows their shortcomings as a defensive measure Researchers found a deep, unpatchable flaw in virtual private networks dubbed Tunnelvision can allow attackers to siphon off data without any indication that they are there. By Evan Schuman May 08, 2024 8 mins Threat and Vulnerability Management Data and Information Security Network Security news DocGo says hackers stole patient data in a recent cyberattack The attack compromised some healthcare data with no material or financial losses, the company said. By Shweta Sharma May 08, 2024 3 mins Data Breach Hacking PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe